Operation Economic Outcast names nearly 60 targets, but the durable change is the standing authority to designate foreign firms in crypto, technology, gold, aviation and shipping.
Perspective Coverage
6 publishers
- Builder
- Builder 15%
- Operator
- Operator 52%
- Investor
- Investor 33%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+40
- Incentives60
- Confidence65
Group-IB says the Iran-linked leak-and-brag front Handala Hack runs HEAVYGRAM, a Python implant that takes orders from a Telegram bot, opens the microphone and lifts saved passwords after a loader writes Defender exclusions for it.
Perspective Coverage
9 publishers
- Builder
- Builder 44%
- Operator
- Operator 52%
- Investor
- Investor 4%
Reality
- Evidence82
- Adoption64
- Hype gap+5
- Incentives45
- Confidence80
A week of takedowns removed people and froze assets across five separate actions, while the kit that manufactures the stolen Microsoft 365 sessions those crews depend on still sells on Telegram for $320 a month.
Reality
- Evidence28
- Adoption52
- Hype gap+30
- Incentives58
- Confidence36
Kaspersky says an Iranian-linked framework now picks its channel per transaction from a DNS record, and can swap the Google relay behind it. Allowlisted SaaS domains carry the traffic.
Reality
- Evidence68
- Adoption62
- Hype gap+8
- Incentives58
- Confidence57
Minnesota's 30-plus plants and the FBI's seven states point at small municipal operators, and at a suspected Iranian campaign that no longer looks opportunistic.
Reality
- Evidence58
- Adoption62
- Hype gap+10
- Incentives55
- Confidence52