Intelligence Analysis

​

Intelligence Overview

​

MOSESS STAFF Campaign

​

Iranian Cyber Operations Directive

​

MOSESS STAFF Platform

• Coordinated cyber operations - Integration of technical attacks with information operations
• Government-directed activity - Direct IRGC-IO oversight and tasking
• Multi-domain targeting - Combined cyberattacks and public messaging

​

Front Company: JARF/ZHARF ANDISHAN TAFACOR SEFID

​

Company Identification

​

Organizational Structure

• Official company letterhead with “بسمه تعالی” (In the name of the Exalted/God) - common Iranian government format
• Signed by company director who is simultaneously an IRGC-IO official
• References personnel assignments within the APT structure

​

Purpose of Front Company

1. Legal Cover - Provides legitimate business registration for operational infrastructure
2. Financial Channel - Enables banking and payment processing for operations
3. Personnel Cover - Provides employment cover story for APT operatives
4. Infrastructure Procurement - Registers servers, domains, and services

​

Key Personnel

​

MANOOCHEHR VOSOUGHI NIRI

​

Dual Role

1. Director of JARF/ZHARF ANDISHAN TAFACOR SEFID - Civilian front company
2. IRGC-IO Official - Intelligence Organization operative

• Official document signature
• Authority to assign APT personnel
• Direct involvement in operational documentation

​

Operational Authority

• Personnel assignment authority
• Operational oversight
• Documentation approval powers
• Direct reporting relationship to IRGC-IO chain of command

​

MOHAMMAD ERFAN HAMIDI AREF

​

Identified Roles

• Listed as employee within the APT structure
• Referenced in front company organizational documents
• Connected to operational activities

• Took over infrastructure management role from MOHAMMAD NAJAFLOO
• Maintained Excel sheets documenting unified infrastructure
• Managed server procurement and access credentials

​

Infrastructure Management

• Server credentials - Login details for operational infrastructure
• Procurement identities - Accounts used to acquire servers
• Attack servers - Tunnel and operational systems
• Storage servers - File extraction and storage systems

​

Operational Continuity

• Succeeded previous infrastructure manager (NAJAFLOO, ID: 4270878835)
• Continued maintaining infrastructure documentation
• Represents younger generation of IRGC-IO cyber operatives

​

Connection to Abbas Rahrovi

​

Leadership Structure

• Direct Management - Oversees front company operations
• Asset Control - Manages infrastructure and personnel
• Campaign Direction - Directs malicious activity against international targets

​

Operational Security Failure

“Abbas Rahrovi is leading the campaign’s activity, assets, and malicious activity against international targets. Abbas is a ‘shadow man’, but the campaign he has set up has now been exposed, and is very embarrassing for the Iranian leadership.”

• Front company structure
• Key personnel identities
• Organizational relationships

​

Organizational Chart

IRGC-IO (Intelligence Organization)
    |
    └── Counterintelligence Division (Unit 1500)
            |
            └── Department 40 (CharmingKitten)
                    |
                    ├── Abbas Rahrovi (Overall Leader)
                    |
                    ├── JARF/ZHARF ANDISHAN TAFACOR SEFID (Front Company)
                    │       |
                    │       └── Manoochehr Vosoughi Niri (Director/IRGC Official)
                    |
                    └── Operations Personnel
                            |
                            ├── Mohammad Erfan Hamidi Aref (Infrastructure Manager)
                            ├── Mohammad Najafloo (Former Infrastructure Manager)
                            ├── Vahid Molawi (Attacker - Karaj team)
                            └── Additional operatives

​

Multi-Episode Intelligence Correlation

​

Cross-Episode Personnel Tracking

• Episode 3 - Identified in front company documents
• Episode 4 - Revealed as infrastructure manager with extensive access

• Central role in operations
• Long-term involvement
• Access to critical infrastructure

​

Intelligence Building

• Leadership (Abbas Rahrovi)
• Overall structure and targeting

• Attack reports and victims
• Additional personnel (Vahid Molawi)
• Server infrastructure

• Malware source code
• Front companies
• Additional personnel (Vosoughi Niri, Hamidi Aref)
• Technical capabilities

• Complete infrastructure mapping
• Detailed personnel roles
• Passwords and access credentials

​

Training and Technical Documentation

​

Training Programs

• Malware development training
• Anti-virus evasion techniques
• Target reconnaissance methods
• Operational security procedures (now proven inadequate)

​

Technical Intelligence Reports

• Israeli Entity Targeting - Multiple reports on Israeli-related intelligence
• Regional Intelligence - Middle East and Gulf states
• Technology Analysis - Security products and bypass methods

​

Espionage Operations

• Government entity targeting
• Telecommunications companies
• Aviation companies (FlyDubai)
• Intelligence organizations

​

Implications for Iranian Leadership

​

Political Embarrassment

• International Exposure - Personnel identities now public
• Front Company Revealed - Cover structure compromised
• Capability Assessment - Technical capabilities fully documented

​

Operational Impact

• Personnel Burned - Named individuals can no longer operate covertly
• Infrastructure Compromised - Servers and domains exposed
• TTPs Documented - Techniques available for defensive measures

​

Attribution Certainty

• Official IRGC-IO documents
• Personnel with dual government/company roles
• Direct chain of command documentation
• Signed documents from officials

​

Intelligence Assessment

​

Reliability: HIGH

• Official company documents with signatures
• Internal technical documentation
• Personnel records with national IDs
• Infrastructure credentials and access logs

​

Impact: CRITICAL

• Complete exposure of operational cell
• Front company structure revealed
• Key personnel identified
• Technical capabilities documented

​

Significance: UNPRECEDENTED

• Complete source code of operational malware
• Organizational structure documentation
• Personnel identification with national IDs
• Front company legal structure
• Technical training materials
• Victim targeting evidence

​

Recommended Actions

​

For Security Researchers

1. Cross-reference personnel - Check VOSOUGHI NIRI and HAMIDI AREF against other data sources
2. Front company investigation - Search for JARF/ZHARF ANDISHAN TAFACOR SEFID in business registries
3. Infrastructure mapping - Identify additional infrastructure linked to these personnel

​

For Defenders

1. Threat hunting - Use IOCs and TTPs from technical analysis
2. Personnel monitoring - Watch for these individuals in other contexts
3. Infrastructure tracking - Monitor for new infrastructure registration by exposed entities

​

For Intelligence Community

1. Network analysis - Map additional connections from exposed personnel
2. Financial tracking - Follow financial flows through front company
3. Capability assessment - Update Iranian APT capability estimates based on malware analysis

​

Related Documentation