Iranian American Hostage Appeals To Biden, Starts Hunger Strike

The Romanian firm published reported on efforts by the Iranian regime to phish information about people who use virtual private networks – or VPNs -- to circumvent severe restrictions the government put on internet access.

Iran has been filtering Internet content for more than two decades but in the past four months amid antigovernment protests the government has regularly shut off access and blocked popular applications such as Instagram and WhatsApp. 

While most of the people around the world take access to Internet for granted, users in Iran have to try out dozens of apps and VPNs before they find a way to bypass ISP restrictions. And, while some VPNs are fake or blocked, there are some others that are deliberately laced with malware, such as the 20Speed VPN. This spyware enters the victim's computer as the user installs the filter-breaking file. 

Since 2020, when people have started to work remotely from home, a problem has come up for businesses to monitor the activities and productivity of their employees. The solution comes in the form of monitoring software. One of the companies that offers such services is SecondEye with numerous capabilities that are not limited to screen recording, logging keystrokes, and live screen viewing. The monitoring application was developed in Iran and distributed legitimately via the developer’s website.

Earlier in the year, Blackpoint Cyber, specialized in stopping cyberthreats, identified and responded to two identical suspicious File Transfer Protocol (FTP) events connected to a server in Iran within a two-month span. This server was determined to belong to SecondEye.

Researchers at Bitdefender, as well as at Blackpoint, discovered a malware campaign that uses components of SecondEye suite and their infrastructure -- a legitimate monitoring application -- to spy on users of Iranian-based VPN service 20Speed but through Trojan-like installers of the VPN software that installed the spyware components along with the VPN product. The software, as well as another of the products EyeSpy, has the ability to fully compromise online privacy via keylogging and stealing of sensitive information, such as documents, images, crypto-wallets, and passwords.

The campaign started in May 2022, but detections peaked in August and September, as Iranians were rushing to use VPNs to get past the government’s restrictions. Most of the new detections originate from Iran, with a small pool of victims in Germany and the US.

The website of 20Speed is one of the most popular websites from which Iranians purchase their VPN subscriptions. The website has been active among Iranian users for about seven years. But if its VPN is laced with malware and collects personal information, the company cannot safeguard it from Iran’s intelligence services that can simply demand and receive access.

According to the data by the US company Similarweb -- which reviews and analyzes the statistics of the world's websites and provides behind-the-scenes analytics for every site online -- the main website of 20Speed had about one million visits during the three months ending in December 2022, most of them from Iran. Moreover, the Android version of this VPN, which is also available in the Google Play Store, has more than 100,000 active installations.

Earlier in January, the Islamic Republic decided to act against those selling VPNs and circumvention software to people, as a measure to further restrict access to the Internet. The Judiciary department in collaboration with the ministry of communications will take legal action against "unauthorized sellers of the VPNs and circumvention tools," local media reported. This is a measure to clamp down in real VPNs versus software that the government can have control over.

Almost all companies that sell VPN services inside Iran are affiliated with the government or state organizations. Most of these companies have increased their fees drastically during the past three months that Iranians have rushed to buy them to access the Internet. Many Iranians are unable to pay the higher prices for VPNs as the cost of food and other necessities have skyrocketed.

In the long run, if this trend continues, it is possible that people from the lower income will gradually lose their access to the global Internet, similar to what has taken place in China and these days in Russia. The security of such services is another problem as the Islamic Republic can easily acquire any data accessed by the users via VPNs.

Amid heightened restrictions on Internet access, Iranians’ use of VPNs rose over 3,000 percent in September, when Mahsa Amini was killed.

"Daily demand for VPN services in Iran is up over 3,000% compared to before the protests," Simon Migliano, the head of research at Top10VPN, told Axios, adding that "This is a massive spike, given that demand was already healthy before the social media shutdown."

In an exclusive report WSJ said that according to its sources, Tehran finding itself in a financial crunch and facing antigovernment protests, has asked the Bashar al-Assad government to pay around $70 per barrel of crude from now on. The move shows that Iran’s clerical regime finding itself in a political and economic crisis might be losing its leverage over regional allies such as Syria.

While the reported Iranian move might indeed be the result of its budget shortage and falling currency, Syria has been involved in a Russian-backed process to mend fences with Turkey, occupying part of the country’s north, without Iran’s participation. Tehran played a key role in saving the Syrian regime from its opponents in the 12-year-old civil war.

Iran, however, continues its public rhetoric in support of Syria and the Lebanese Hezbollah. During his trip to the two countries this week, foreign minister Hossein Amir-Abdollahian repeated offers of fuel and other assistance.

Iran by some estimates has spent more than $30 billion over the last decade to support Assad’s regime, in addition to tens of billions in assistance to Hezbollah and the Houthi rebels in Yemen. This has led to anger among Iranians who suffer from high inflation and declining living standards. Calls for ending the government’s regional interventions have echoed during protests in the past five years.

Head of Non-Governmental Schools and Centers Ahmad Mahmoudzadeh told ILNA Sunday that “We will have a call to produce content of language books for schools, which will be implemented in line with the order of the Supreme Leader.”

"Language books that have nothing to do with our culture will be discarded," he added.

Changing the content of textbooks based on the government's propaganda policies has been implemented in the last few years upon the order of Supreme Leader Ali Khamenei. However, this is the first time that these changes will be applied to the language teaching books of private institutes.

Ali Khamenei had earlier criticized teaching English in general, saying in 2016 that "now we have reached to a point that English language learning has been extended to kindergartens".

Following his comments, ministry of education put a ban on teaching English at primary schools.

English is not included in Iran's official curriculum during the six years of primary school, but various non-governmental and a small part of public schools teach students English as extra-curricular subject, and these classes are not mandatory.

In recent years, some government officials have also suggested that instead of English, the teaching of Russian, Chinese and German languages should be supported in Iran.

Hashem Moazenzadeh, surgeon and activist, was arrested by the IRGC intelligence during nationwide protests late October.

According to Human Rights Activists News Agency (HRANA), the sentence was issued at a preliminary court and if it is approved at the appeals court, Moazenzadeh could serve up to three years.

Based on HRANA’s report, a revolutionary court in Tehran tried Moazenzadeh for charges such as "holding gatherings and conspiring against the security of the country" and "propaganda against the establishment."

Also, "a two-year ban on leaving the country, membership in parties, political and social groups, and activities in cyberspace" has been considered as an additional punishment for him.

During the protests by doctors in Tehran on October 25, another general surgeon was shot in the head and killed by the security forces.

Doctor Parisa Bahmani, from Zanjan, was killed during the gathering of doctors in front of Tehran Medical Council, after government forces opened fire on demonstrators.

Doctors had held the protest rally against the government’s policies of preventing medical care for the wounded protesters, using ambulances to transport security forces, and militarizing the hospitals.

The regime has killed over 500 people including tens of children during the protests since mid-September.

Akbari, a former high-ranking defense official was accused by the regime of espionage for the United Kingdom.

Zarghami in a tweet on Saturday called for an investigation into Akbari's "change of behavior", saying that "I am worried about the repetition of this process." He did not say that he believes Akbari was innocent, something that would endanger his own security.

He added that "Alireza Akbari's fate was a bitter experience for the establishment" because he had "70 months of service" in the Iran-Iraq war.

Iran announced Akbari’s execution on Saturday, after sentencing the former Iranian deputy defense minister to death for espionage.

Akbari, also served as an advisor to the Secretary of Iran's Supreme National Security Council (SNSC) Ali Shamkhani.

A source close to the Islamic Revolutionary Guard Corps has provided information to Iran International showing that accusations against Akbari and his death sentence were aimed at weakening Shamkhani’s position in the clerical regime. It seems that President Ebrahim Raisi, Intelligence Minister Esmail Khatib and Interior Minister Ahmad Vahidi are exerting pressure to remove Shamkhani from the post.

The execution of Akbari was met with a wave of international condemnations, and Britain sanctioned Iran's Prosecutor General Mohammad Jafar Montazeri hours after Akbari’s execution was announced.

Britain called the execution a barbaric act, a sentiment echoed by the United States, France, Germany and Canada.