![\"Iran](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2019\/08\/Iran_MOIS_Futile_and_Disgraceful_Ploys_Targeting_Iran_Resistance.jpg\" "\\"On")
\n![\"a-50\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2018\/01\/a-50.png\" "\\"a-50\\"")
<\/em>Crazed acts of Iran\u2019s cyber war machine to counter Resistance\u2019s international campaign<\/strong><\/p>\nThe Iranian regime seems to have lost its bearings after large opposition rallies in numerous world capitals and the five-day gathering in Ashraf 3 attended by over 350 political dignitaries from 47 countries, in addition to an increasing stream of activities by resistance units inside the country. The events have dealt a lethal blow to the regime in the midst of a comprehensive oil embargo and international sanctions against the regime\u2019s supreme leader, Ali Khamenei, and its foreign minister, Mohammad Javad Zarif.<\/p>\n
On August 4, 2019, Ali Rabie, the regime\u2019s government spokesman and a founding member of the Iranian regime\u2019s Ministry of Intelligence and Security (MOIS), complained that the White House\u2019s discourse against the regime has become similar to that of the People\u2019s Mojahedin Organization of Iran (PMOI\/MEK).<\/p>\n
Khamenei\u2019s mouthpiece, the Kayhan daily, wrote on August 8, the MEK \u201chas penetrated deeply into our homes and its impact is being felt.\u201d<\/p>\n
An IRGC brigadier general named Assadollah Nasseh said on state TV on July 28, \u201cWe must know that everything that takes place in the world against us is the result of their [PMOI\/MEK\u2019s] lobbying effort somewhere, or a price that they have paid… On the issue of missiles, we witness that it was based on the information that they provided to the Americans. Regarding human rights, they make up dossiers and files and provide them to Europeans and they put pressure on us in this way. They use every leverage against us.\u201d<\/p>\n
Iranian regime officials are horrified at the specter of what they see as the warm welcome for the PMOI\/MEK and Iranian Resistance in social media networks.<\/p>\n
IRGC Brigadier General Gholamreza Jalali, who heads the regime\u2019s civil defense forces, told state run ISNA on July 29, 2019, \u201cour new war [with the PMOI\/MEK] in cyberspace is more difficult than the Mersad operation.\u201d [Mersad, or Operation Eternal Light, was a major offensive by the Iranian resistance that penetrated 100 miles inside of Iran leading to the liberation of two cities in July 1988 that shook the regime to its foundations.] “Many hateful, insulting and slanderous comments are posted by them [PMOI\/MEK] with fake accounts. Their fingerprint is on many of the controversies that we face. Many of the news cycles in cyberspace that are orientated against the state and the revolution are their psychological warfare against us\u2026 They [PMOI\/MEK] take advantage of some of the weak economic circumstances domestically and incite people to rise up\u2026 During last year\u2019s events we saw this same fake news in cyberspace had a significant role in fanning the perception of shortage of basic goods\u2026 They try to influence public opinion and perception in society negatively, and to instill despair, disappointment and a sense of failure of the Islamic Republic.\u201d<\/p>\n
The deputy commander of IRGC\u2019s Sarollah headquarters said, \u201cToday they [PMOI\/MEK] have put all efforts into humiliating the holy system of the Islamic Republic in cyberspace.\u201d<\/p>\n
On July 29, 2019, an MOIS operative named Mohammad Javad Hasheminejad complained of the \u201cpresence of 1,500 of their [PMOI\/MEK] units in three shifts round the clock\u201d in social media networks and their role in \u201cthe riots of 2018 in the country,\u201d adding, \u201cwe need to know our enemy and know its objectives so we can counter it accordingly.\u201d<\/p>\n
A founding member of the IRGC brigadier general Abolghassem Forootan, told the State run Mizan news agency, on August 2, 2019, \u201cThis time they want to harm the values of our nation and system through the use of cyberspace and soft power.\u201d<\/p>\n
It is evident that the MOIS, IRGC, and Qods Force have embarked on a futile campaign to counter the growing resistance to the regime by using their propaganda and cyberwarfare machine. Their known suppressive tactics employed against the Iranian Resistance has been demonization campaigns, dissemination of false information and news, use of fraudulent emails and accounts, sending threatening emails, injecting virus and worms to hack the computers and email accounts of Iranian Resistance supporters.<\/p>\n
1. An English language website created by the Iranian regime called Iran Front Page (IFP) has spread a ridiculous and categorically false claim that it has access to a video clip of a \u201cprivate meeting of the MEK in Albania.\u201d The two minute long clip of this \u201cprivate\u201d meeting features the voice of Mr. Mehdi Abrishamchi reviewing the policies of past US administrations in appeasing the clerical regime and has been quickly republished in a network of websites affiliated to the Iranian MOIS. There is nothing new, private, or confidential in this clip. It is not related to Albania either. It is just an out of context part of a public meeting with Iranians after the large gathering of Iranians in Paris on July 1, 2017. Similar commentary has been broadcast on numerous occasions in Simaye Azadi television and websites affiliated to the Iranian Resistance. The lies of the MOIS just go to show the regime\u2019s bankrupt need for such news to lift the morale of its dispirited loyalists. The IFP website, published in English and Arabic, is registered to Mahmoud Asgari in 26 Ali Shariati and Pir-Jamali Street, in Tehran, since June of 2014. The telephone number for this website is +93-2177528888 and the country code of 93 is for Afghanistan.<\/p>\n
2. In another amateurish and ridiculous act, the MOIS has claimed accessing another sound clip of Mr. Abrishamchi in another internal meeting in Albania and published this claim on a website called Mozahemin.org [meaning Nuisances]. The website published a sound clip of a woman asking a question under a photograph that shows Mr. Abrishamchi in a public meeting in Paris. The woman asks, \u201cIn 2013 a message announced that the regime would be overthrown in six months\u2026\u201d The MOIS website then goes on to portray the short out of context sound clip as proof of protests by high ranking members of the PMOI in Albania. But the photo in the article and the woman\u2019s voice (assuming it has not been produced by the MOIS) have no relation to Albania. The question also (a message in 2013) has no relation to any of MR. Abrishamchi\u2019s meetings and speeches in which he has answered compatriots\u2019 questions. Not to mention that the mentioned message of 2013 never existed. The Mozahemin website that is registered in Mashhad has its address as the MOIS offices and projects its own moto onto the PMOI\/MEK by writing \u201cwherever there is terrorism, murder, and treason, we are there.\u201d The website introduces itself as \u201cwebsite for people\u2019s nuisance organization of Iran\u201d to parody the MEK and continues that it is \u201ca window onto a student, scientific, and human rights organization that is the result of the efforts of some students all over Iran and essentially from those interested in the field of counter-terrorism.\u201d The meaning of student, science, and human rights in the vulgar world of the clerics of Iran cannot be more than that. The website\u2019s directors are probably the same students that Khamenei talked of on May 22, when he said, \u201cAccording to reports that I receive, student organizations and associations have in the past year or two done good work in various fields. In national affairs, and international affairs. This is a good presence. A gathering in front of some embassies is good sometimes. Of course it should be restrained, calculated, rational, and to show our moral and spiritual superiority. It is not that scaling the walls [of embassies] is good all the time. Sometimes however it is good.\u201d<\/p>\n
3. The MOIS\u2019 inability to counter the MEK was on display in the state run daily Khorasan article on June 3, 2019 entitled \u201cPublication of first document of MEK\u2019s interference in riots of December 2017.\u201d It quotes Khamenei on January 9, 2018, and states that the MEK are the third side of a triangle that created the uprising that they had prepared since months earlier. Then it trumpets victoriously that \u201cWe are publishing for the first time parts of a secret internal meeting of the terrorist monafeghin [pejorative for PMOI\/MEK] in January 2018 in which Mehdi Abrishamchi, second in command of the group, explicitly revealing the terrorists\u2019 role in the riots of December 2017.\u201d The article adds, \u201cThe voice clip of this five hour confidential meeting has been published by a high ranking member of this terrorist group and parts of the transcript are published in Khorasan.\u201d Then it goes on to report on the role of the PMOI\/MEK and resistance units in protests in Kazeroun, Ahvaz, and Touysirkan based on the \u201chighly confidential\u201d source. It quotes Mehdi Abrishamchi emphasizing the necessity of activating 1,000 Ashraf bases meaning 1,000 resistance units and enflaming the uprising in the cities. In short, this is the unending nightmare of this regime and the MOIS.<\/p>\n
4. Subsequent to the scandal involving the fake Twitter account of the French Consul General in Jerusalem (about which the NCRI Counterterrorism Committee issued a statement), the MOIS put out a fake tweet on behalf of a Toronto Police Official (Donald Belanger). On August 8, the Daily Beast wrote in this regard, \u201cAmerican intelligence officials are monitoring a social media disinformation campaign that attempted to falsely implicate the White House National Security Adviser in a global money laundering and drug trafficking operation. On Monday, a Twitter user claiming to be a high-ranking Canadian law enforcement official posted records supposedly showing a $350,000 wire transfer from a Canadian children\u2019s apparel company to a Swiss bank account owned by National Security Adviser John Bolton\u2019s daughter\u2026 Twitter suspended the fake Belanger account and Toronto Police Service spokesman Alex Li confirmed to The Daily Beast that it was \u2018a fraudulent\u2019 persona. The real police official the account had impersonated has never had a Twitter account. A U.S. official familiar with the apparent disinformation campaign said intelligence community officials were aware of the effort. And Lee Foster, an information operations intelligence analyst at the cybersecurity firm FireEye, told The Daily Beast that the hoax\u2019s techniques are \u2018consistent with what we’ve seen with previous pro-Iranian influence operations.\u2019 Bolton is among the Trump administration\u2019s most aggressive critics of the Iranian regime. The U.S. official, while not commenting on this week\u2019s disinformation campaign specifically, said Bolton has been the target of state-sponsored influence operations designed to weaken his standing in the administration. Though Twitter quickly removed the tweet on Monday and suspended the account, it had already been picked up and covered by a handful of websites with editorial positions sympathetic to the Iranian government. News outlets such as Iran Front Page blared \u2018Belanger\u2019s\u2019 claims that a Canadian business had supposedly transferred the funds at issue had been caught smuggling \u2018a significant amount of opium\u201d and \u201chas close ties with the Mujahedin Khalq Organization (MKO) terrorist group.\u2019\u201d<\/p>\n
5. In July 2019, the MOIS began sending messages to supporters of the Iranian Resistance by way of fake email accounts, such as m.a.tohidie@gmail.com, and m.abrisham1957@gmail.com,. Using these emails, which carry the names of well-known persons, or are similar but fake email accounts, the Iranian regime attempted to disseminate false and misleading information among Iranians and supporters of the Resistance.<\/p>\n
6. In late July, the regime\u2019s cyber army used a fake telegram account, @SetareganZamini, to contact several Iranians and Resistance\u2019s sympathizers, asking them for financial support for Resistance units inside Iran.<\/p>\n
7. Also in July, it used the name and email of a PMOI supporter Zahra Asl Rousta (Zahra.aslerousta@gmail.com) to send a message with a pdf file that contained a series of questions, asking the recipients to respond. The pdf file carried a virus and was designed to hack and steal the data stored in the recipient computers.<\/p>\n
8. In April and May, a person with the fake name of Arezoo, introduced herself as an official of the PMOI who was dealing with issues related to PMOI supporters. She contacted many of them to tell them that because she was busy with successive demonstrations, another individual, Homa, will replace her. The MOIS agent introducing herself as Homa would pose different questions to obtain information about the Iranian Resistance. For example she would write, \u201cI want to know whether you know anyone in Iran who you can introduce and with whom I can speak? Let us know about anyone, anywhere, who you think could be in touch with us or give us any news or carry out even a small task. I would be very grateful.\u201d<\/p>\n
9. In April 2019, by using a fake email, ashraf3.albani@gmail.com, the regime sent a pdf file, named \u201ca visual report on the residents of Ashraf in Albania.\u201d The file contained a virus which would infect any computer that would click on it.<\/p>\n
10. In April 2019, the regime\u2019s cyber operative used a fake email account, carrying the name of a Resistance official, to send urgent messages and warn that some emails have been hacked. One such message said, \u201cHi, I would like to inform you that email of \u2026. has been hacked. If he\/she sends you an email, don\u2019t click on it because it is a virus and will infect your computer and cellphone. Please let all friends know.\u201d A short while later, he\/she would send messages urging the recipients to contact a specific email. By claiming to have lost their phone numbers, he was trying to connect people to MOIS email accounts and obtain information.<\/p>\n
11. In April 2019, a cyber-operative used arman.sarfraz1340@gmail.com to show that the regime had infiltrated the ranks of the PMOI. To this end, he copied a text, entitled \u201calert number 10,\u201d previously sent to PMOI supporters, and wrote, \u201cThe collection of these issues in recent days speaks to the presence of infiltrators among the ranks of PMOI supporters and the PMOI itself, which only adds to the need for awareness about those around us and about drawing lines and being vigilant.\u201d The same text contained a series of false reports about regime emails or suspicious phone numbers used to contact PMOI supporters asking for donations. These were designed to gain the trust of the recipients. It goes without saying that PMOI supporters never use such methods to provide donations.<\/p>\n
12. In another example, the regime used the telegram account of a detained person to contact his brother abroad and invite him to go to Iran. After some follow up, this individual realized that his brother had been arrested and that his telegram account had been used.<\/p>\n
13. A regime cyber operative used the fake email account h_meli896@gmail.co (similar to Hambastegi Meli email account) to spread false information and slanders against the PMOI and the Resistance. The correct email account is hmeli896@gmail.com.<\/p>\n
14. MOIS operatives used two email accounts, toufan2019@gmail.com and emzamahfoz@gmail.com to send messages to Iranians and PMOI supporters. Posing as dissidents, they would ask a series of questions and then repeat some of the regime\u2019s anti-PMOI propaganda and allegations.<\/p>\n
15. The regime\u2019s cyber operatives also used a fake Skype account, ISSA, similar to one used by a Resistance member, to obtain information from PMOI supporters.<\/p>\n
16. Another tactic used by the MOIS was to send threatening messages to PMOI supporters active on telegram. One such message by \u201cdidban fazaye majazi\u201d reads, \u201cDear telegram user, you have joined the telegram group nationwide uprising, which belongs to the PMOI. So far your membership appears to be out of ignorance. If you continue to be a member, it would be perceived as deliberate membership and would have legal repercussions for you.\u201d<\/p>\n
17. In the past few months, the regime\u2019s intelligence agents have used the phone number 33937502075 to contact Resistance\u2019s supporters in France and obtain their Facebook and email accounts.<\/p>\n
18. Recently, the MOIS used an email account similar to the one used by a US journalist, and copied his picture and information, to ask for an interview with a PMOI supporter. It sent a dangerous virus to hack his computer, but failed.<\/p>\n
The NCRI\u2019s Committee on Security and Counterterrorism calls on all compatriots and PMOI supporters to expose the regime\u2019s pathetic ploys and neutralize their cyber plots. It urges them to refrain from responding to suspicious and unknown emails and contacts including in Telegram, Skype, Whatsapp, etc., and share suspicious cases with the NCRI representative offices or PMOI chapters in different countries.<\/p>\n
The National Council of Resistance of Iran<\/strong> Email carrying a virus<\/em><\/span><\/strong><\/p>\n Bogus Google alert:<\/strong><\/em><\/span><\/p>\n Emails impersonating others:<\/strong><\/em><\/span><\/p>\n False Skype account (the one on the right is a fake account):<\/strong><\/em><\/p>\n Threats sent to users by the regime\u2019s cyber patrols:<\/strong><\/em><\/span><\/p>\n Crazed acts of Iran’s cyber war machine to counter Resistance’s international campaign The Iranian regime seems to have lost its bearings after large opposition rallies in numerous world capitals and […]<\/p>\n","protected":false},"author":25,"featured_media":53726,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[178],"class_list":{"0":"post-26578","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-iran-resistance","8":"tag-save"},"yoast_head":"\n
Committee on Security and Counterterrorism<\/strong>
August 14, 2019<\/strong><\/p>\n![\"1\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2019\/08\/1.png\" "\\"1\\"")
<\/p>\n![\"2\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2019\/08\/2.png\" "\\"2\\"")
<\/p>\n<\/p>\n![\"3\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2019\/08\/3.png\" "\\"3\\"")
<\/p>\n![\"4\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2019\/08\/4.png\" "\\"4\\"")
<\/p>\n![\"5\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2019\/08\/5.png\" "\\"5\\"")
<\/p>\n![\"6\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2019\/08\/6.png\" "\\"6\\"")
<\/p>\n![\"7\"](\"images\/stories\/2019\/August\/a\/7.png\" "\\"7\\"")
Emails impersonating others to extract information:<\/em><\/span><\/strong><\/p>\n![\"7\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2011\/01\/7.jpg\" "\\"7\\"")
<\/em><\/span><\/strong><\/p>\n![\"8\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2019\/08\/8.png\" "\\"8\\"")
<\/p>\n![\"9\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2019\/08\/9.png\" "\\"9\\"")
<\/p>\n![\"10\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2019\/08\/10.png\" "\\"10\\"")
<\/strong><\/em><\/p>\n![\"Iran_MOIS_Futile_and_Disgraceful_Ploys_Targeting_Iran_Resistance-2\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2019\/08\/Iran_MOIS_Futile_and_Disgraceful_Ploys_Targeting_Iran_Resistance-2.jpg\" "\\"Iran_MOIS_Futile_and_Disgraceful_Ploys_Targeting_Iran_Resistance-2\\"")
<\/strong><\/p>\n![\"11\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2011\/01\/11.jpg\" "\\"11\\"")
<\/p>\n![\"11\"](\"images\/stories\/2019\/August\/a\/11.png\" "\\"11\\"")
<\/strong><\/em><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"