Pierluigi Paganini September 29, 2022

Several hacker groups are assisting protestors in Iran using Telegram, Signal and other tools to bypass government censorship.

Check Point Research (CPR) observed multiple hacker groups using Telegram, Signal and the darkweb to support protestors in Iran in bypassing regime censorship. The hackers are sharing tools and tips to bypass censorship, including opening VPN servers, to avoid restrictions introduced in the country following the death of Mahsa Amini.

The hacktivists used the above channels to leak sensitive data, including officials’ phone numbers and emails, and maps of sensitive locations.

CheckPoint researchers also reported that there are some hacking groups that are trying to make a profit from the situation and to sell information from Iran and the Regime.

Multiple groups were observed providing a list of proxies and VPN that help to bypass the censorship, along with reports on the internet status in Iran.

At least one hacker group is helping the anti-government protesters to access social media platforms.

One of the most popular Telegram channels supporting protesters is called Official Atlas Intelligence Group (AIG), it has 900 members and primarily focuses on publishing data associated with government officials as well as maps of sensitive locations.

Another Telegram group called ARVIN, with more than 5000 members, focuses on news from the protests in Iran, reporting videos and images from the streets where the protests are.

Signal also decided to provide support to the protests in Iran, helping other people to setup proxy servers that can be used to bypass the censorship in Iran. https://signal.org/blog/run-a-proxy/

“What we see are groups from Telegram, dark web and on the ‘regular’ internet helping the protestors to bypass the restrictions and censorship that are currently in place by the Iranian Regime, to suppress the protests.” concludes CheckPoint “We began seeing these groups emerge roughly a day after the protests began. These groups allow people in Iran to communicate with each other, share news and what is going on in different places”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Log4Shell)

[adrotate banner=”5″]

[adrotate banner=”13″]