Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
Analyzing Iranian Tradecraft: Leveraging Loader Scripts and Telegram for C2
Threat Actors
Malware Families
Excerpt
Amid escalating tensions between the US and Iran, Iranian cyber threats are facing increased attention and scrutiny. The Pulsedive research team recently analyzed a series of loader scripts added to Malware Bazaar by Security Researcher @JAMESWT_WT . These scripts caught our attention because they were associated with malware intrusions, in which Telegram was used for Command and Control (C2) - a tactic recently outlined in an FBI FLASH Report . Released on March 20, 2026,…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →13 indicators
IOC Relationship Graph
Building graph…