Mahshid Nazemi is constantly looking over her shoulder. Even when she’s at home.
Even 3,000 miles away from her homeland of Iran. Because those hunting her – members of the Iranian regime – have found everywhere she’s been, she says. “I feel like I am being watched all the time,” Nazemi says. The 38-year-old activist from the city of Kerman in the south-central region of Iran has been on the run since she was released from prison in 2016.
“I had been picked up by the police one day, along with eight other people. When I asked what I was being arrested for, they told me they had pictures of me at a forbidden, nationally protected site – but it was from during a demonstration supporting farmers who had been advocating for their land rights in Kerman,” she says.
Before being arrested, Nazemi worked as a teacher in a local high school. “I’d been threatened for not adhering to my own hijab before, but I lost my job when I supported the girls who resisted forceful hijabs too,” she says. After losing her job, Nazemi briefly started her own business, a traditional Iranian restaurant that soon became popular among women for offering a safe, judgment-free space, but she says she was ordered to shutter the restaurant because she refused to enforce the mandatory hijab rule.
Inspired by her sister Pouran Nazemi, a firebrand activist, she became active in grass-roots political movements in her region until her arrest. “After I was released on bail, my family insisted that I leave the country for a safer place, so I left for Türkiye,” she says. Her sister, however, refused to leave and continued civil and political advocacy despite threats and detentions.
On 12 December, Pouran was arrested alongside Narges Mohammadi, a Nobel Prize-winning human rights activist, just days ahead of waves of protests in Iran, which started in late December and have seen at least 3,117 people killed, as reported by Iranian state television on 21 January.
They were attending a memorial service for a human rights lawyer in the northeastern city of Mashhad when police raided the ceremony. Nazemi, who was on a video call with her sister at the time, recorded some of the attack. The shaky video clips show armed and uniformed men entering the mosque complex where mourners had gathered. Sounds of gunshots and screams can be heard before Nobel laureate Mohammadi grabs the phone and begins chanting slogans of freedom.
The clip cuts to show people with injuries huddled inside the mosque. She posted the clips online, campaigning for the release of her sister, Mohammadi and the 37 others taken captive. “The only thing my family was told is that Pouran was accused of moharbeh, and she was being held in solitary confinement. That was 29 days ago,” Nazemi said in January.
The charge of moharbeh, which roughly translates to “war with God” and can carry a death sentence, resulted from the 2022 protests; the case is still pending. However, the current charges include conspiracy and collusion to commit crimes against internal and external security, propaganda against the Islamic Republic system, insulting the Supreme Leader and disrupting public order and peace. Pouran was granted a medical furlough in February, this year and is undergoing treatment.
Nazemi, however, has heard from men claiming to be members of the Islamic Revolutionary Guard Corps (IRGC). She has received several messages and calls warning her to stop her work or face execution like her sister. “I will come to your service... Soon your head will be pushed under water”, one of the messages warned, along with a video of the perpetrator infiltrating the protest that she participated in. She isn’t sure who took that video, but it confirmed her fears – that she was being watched, online and offline. This wasn’t the first time Nazemi had been threatened in exile, and it wouldn’t be the last.
The week WIRED Middle East began reporting this story, in the closing days of 2025, massive antigovernment protests erupted across over 100 cities in Iran. By the first week of January, the Iranian government had shut down the internet across the country, plunging it into a digital blackout, shutting it off from the outside world and making it impossible to accurately report the number of people killed, though estimates range from 3,117 (according to government statements) to 30,000.
Iranian Foreign Minister Abbas Araghchi reiterated the 3,117 death toll in a 21 February post on X. “If anyone disputes [the] accuracy of our data, please share any evidence”, he added, attributing the deaths to “terrorist operations” in the country.
The regime applied similar tactics during protests in 2019, during which 1,500 protestors were reportedly killed in a weeklong blackout that became known as Bloody November. In 2022, during large-scale protests following the death of Mahsa Amini, who was arrested by the morality police for noncompliance with Iran’s hijab laws and was killed in their custody according to a UN report, internet access was regularly restricted in the country. In 2025, during the 12-day war with Israel, Iran used more advanced techniques to repress internet access, using a method of network filtering called deep packet inspection (DPI), dubbed as “digital CCTV”, that scrutinises data and content on a network, which then allows the operator to filter and block specific type of content and even tools like VPNs, consequently reducing citizens’ connectivity to the internet by about 90 per cent.
The UN and other human rights groups have documented increasing cases of transnational repression, including interrogation, threats and surveillance of families of Iranian journalists abroad. Increasingly in recent years, however, the government has also used digital tools of surveillance to monitor citizens, dissidents and allies alike.
Iran’s cyber-espionage operations are notorious, particularly among the community of dissidents living in exile. However, little was known about the details of the Iranian officials – often referred to as Department 40 – orchestrating digital spying networks.
Much of their activities were shrouded in mystery until a recent anonymous leak. A cache of files, linked to one of Iran’s cyber-espionage groups, known as APT35 (advanced persistent threat) and code-named Charming Kittens, was leaked in September 2025.
The leak, which was titled KittenBusters by the anonymous sources who carried out the breach, began releasing information in October 2025, exposing the complex nature of Iran’s cyber-espionage projects going as far back as 2007. The operation was also known under several other names, including Phosphorus, Ajax Security Team, ITG18 and Mint Sandstorm. The files were released over a period of several weeks on GitHub. The hack was reported by Nariman Gharib, a researcher and writer, on his blog.
The leak also contained, as a way to authenticate its credibility, the purported identities of several regime officials working on Charming Kitten, including their IDs, documents and receipts for services procured by this department.
A cursory analysis of the documents shows Iran’s coordinated efforts at intelligence gathering of not just geopolitical adversaries and dissidents, but also allied governments and citizens. “When it comes to espionage, not just cyber-espionage operations, what’s important is to collect as much information at all times. It doesn’t matter what the nature of the relationship exists; gathering as much as possible is the goal,” says Amir Rashidi, a cybersecurity expert with Miaan Group, which provides digital security support, among other services, to Iranian human rights defenders.
Files in the leak not only revealed the diversity of Iranian targets but also the entire attack workflow in granular detail. The cache of thousands of files, organised by countries targeted, as well as internal IRGC documents, letters, receipts and invoices, reveals a complex operation.
Documents encompassing attack targets provide evidence of attacks on Israel, Turkish government bodies, telecom groups and tech corporations, among several other countries.
Attackers often exploited existing vulnerabilities in government systems, but also conducted specific attacks on reconnaissance and credentials gathering, essentially attempts to steal or crack usernames and passwords to gain unauthorised access to systems.
A closer look, however, reveals the targeting of individuals and organisations, particularly Iranians living in exile. For instance, documents show several airlines and telecommunication services were targeted in what seems to be an attempt to trace individuals.
Cybersecurity analysts say that the Charming Kitten operations closely follow patterns from the Iranian espionage playbook previously seen in other similar leaks, using a combination of techniques involving spear-phishing, impersonation and malware to hack into victims’ devices and extract data that could be used against them.
“Digital transnational oppression is an easy method for these governments to monitor, control and threaten, intimidate people, activists, dissidents who somehow are perceived by these governments as political opponents or who cross the red line or raise awareness on rights violations in the country among international audiences,” explains Marcus Michaelson, senior researcher on authoritarianism at Vrije Universiteit in Brussels.
“It’s an especially easy way to keep track of the activities that are happening abroad and then to threaten and intimidate these people who are outside of the country,” he adds.
The leaked files, categorised by countries, show private and government entities from several places, including Canada, Australia, Belgium, Kuwait, as well as India, Türkiye and Azerbaijan. The files also include details on BellaCiao, a malware known to target energy and communication infrastructures in the US, UK, Israel and other countries.
Such randomised attacks aren’t uncommon, Rashidi says. “They usually start with some sort of OSINT [open-source intelligence], collecting information and data on their targets to decide on what kind of attacks they need to design for them,” he explains. This is then followed by multiple attacks, often wide-ranging and intense. “Their tools are not as sophisticated and advanced as the Western tools, but because they launch multiple attacks targeting one entity, even if one of them goes through, that’s sufficiently effective,” he says.
At first appearance, many of the leaked files seemed to follow the expected Iranian tactical espionage – government agencies, telecom companies, law firms, the energy industry, among others. However, some of the targets seemed out of place, if not entirely unusual.
For instance, the file for Türkiye revealed efforts to target certain municipalities of cities such as Mersin – the 10th largest Turkish city – and districts within cities such as the Bahçelievler municipality in Istanbul. Among other unusual suspected victims was also the office of the governor of Aydin, a city of 250,000 people located on the Aegean Sea.
The attacks seemed very specific, even if the target was a small coastal town, but Aydin, as it happened, is home to one of Türkiye’s over 30 “removal” centres, facilities where immigrants, including Iranians, are detained while their deportations are processed.
It was also the location where Nazemi was held for a little over two months in 2022 after she was detained by the Turkish authorities during demonstrations following the killing of Mahsa Amini in Iran, which triggered large-scale protests in and outside Iran.
In the days ahead of her detention in Türkiye, Nazemi worked closely with her sister and other fellow activists, coordinating demonstrations of women’s rights activists, verifying information on the crackdowns and amplifying voices from within Iran by facilitating media coverage of the historical movement.
“The whole time, I suspected that at least some of our conversations were being monitored by the regime, especially communication on the Iranian side since those living inside the country are under stricter surveillance,” she says. “Their access to the internet and presence on social media are scrutinised very minutely. Even using VPN and other ways to bypass government monitoring can get you caught and in trouble,” she adds.
The Charming Kitten exposé and Michaelson’s research confirmed this. “Among the most prevalent methods is phishing and attempts to hack into email and social media accounts, like to get hold of information of contacts inside Iran, to get better information on the activities of these people abroad,” he explains.
This is usually followed by online harassment and abuse on social media, and intimidation, particularly against women, journalists and human rights defenders, Michaelson adds. “Often the family members in Iran are threatened to escalate the digital threats into the real world, as a way to silence people from speaking.” Women, in particular, Michaelson says, face sexual abuse, harassment and gender-based violence on social media platforms – a fact that Nazemi attests to with her own experience.
A UN fact-finding report, released in March 2025, documented several instances of digital tracking and repression in Iran and among individuals and groups in exile.
“Victims abroad received threatening messages and/or calls from unknown individuals on their personal phones, due to their advocacy and activism in the context of the protests. Such threats were often gendered, accompanied by physical and online defamation campaigns,” a 2025 UN report noted.
Between 2023 and 2026, Miaan Group recorded 139 attacks in the US and 492 different types of attacks in Europe, of which 50 were from France. “[This is just] the number of incidents that we recorded on our Digital Security Helpdesk, which means the number of people affected is much larger,” Rashidi emphasises.
As Iran comes gradually back online, anecdotes are beginning to emerge, detailing how surveillance tools were used to track, identify and target those who joined the protests. The Iranian intelligence services, it was alleged in 2025, used a fake Starlink app to bait citizens using VPNs to circumvent internet blockages. And in the most recent wave of protests, they even used jammers, although fairly unsuccessfully, to block Starlink access.
But Iran’s digital battles go beyond disruption of internet and communication lines. Iran hasn’t shied away from using digital tools to target protestors, particularly those seen to be dissidents against the regime, including those violating the hijab laws that govern women’s modesty.
From drones that monitor women’s outfits and adherence to the strict dress code, to mobile phone applications that allow citizens loyal to the regime to report erring women and men, Iran has been using technology to control any form of dissidence, according to a 2025 UN report. Citizens have also been forced to use local apps for essential services, such as banking or education, which are often used as back doors to monitor their activities.
In one instance of digital surveillance, a UN report found that 8,000 vehicles had been confiscated because their drivers were reported, by fellow citizens, for not wearing the proper hijab, using the Nazer app, which was created for that purpose. “Users may add the location, date, time and the license plate number of the vehicle in which the alleged mandatory hijab infraction occurred, which then ‘flags’ the vehicle online, alerting the police,” the report explained. “It then triggers a text message (in real-time) to the registered owner of the vehicle, warning them that they had been found in violation of the mandatory hijab laws, and that their vehicles would be impounded for ignoring these warnings.”
Most women were sentenced to pay a fine and, at least in one case, a woman’s bank account was closed. In another instance, a 31-year-old woman, who had received such a text message, was shot by the police and left paralysed after trying to escape the seizure of her vehicle.
In another example, a new law was introduced in May 2024, called the Judicial Transformation and Excellence Law, which granted government access to citizens’ private data, including banking and SIM card records, the report noted. Within a few months, authorities had deactivated the SIM cards of journalists, activists and human rights defenders, restricting access to banking and essential services. “To regain access, victims were summoned for interrogation by security agencies, including the Cyber Police (FATA) and IRGC intelligence,” victims told the UN.
These attacks haven’t stopped even with the country under a near-complete digital blackout. If anything, the recent internet blackouts provided fertile ground for such attacks, digital rights groups documented.
Digital activists are already documenting online repressions, even as much of Iran remains offline. Activists and opposition voices are reporting phishing and malware attacks, and suspicious attempts to hack into their digital accounts. Several active opposition groups abroad reported receiving phishing links in their WhatsApp and Telegram messages, attempting to break into their devices.
“Iran state TV, for example, cannot be accessed outside Iran, so they send malicious links to journalists and other targets outside the country with messages telling them they can use that link to watch Iran state TV,” says Rashidi.
Thousands of Iranians abroad – if not more – who are disconnected from their families inside Iran and anxious for any updates, have clicked on these links, which were used to then deploy malware into their devices, Rashidi explains.
Meanwhile, Iranians in the country using Starlink and other mesh networking technologies were also being hunted for being online. The hackers who leaked the files kept a close tab on the cyberattacks and risks posed to the protestors, reported that the Iranian regime had been manually traversing neighbourhoods using vehicular scanners to detect wi-fi signals to capture those using Starlink to connect to the internet.
For Iranian dissidents who managed to flee the country, and even the region, the physical distance did not guarantee safety. Nazemi learnt this the hard way – she was released from the Aydin removal centre in 2023, following advocacy from human rights groups, and was granted asylum in France.
However, even in the seemingly safe European town she now calls home, she continues to receive threats, the perpetrators often identifying her location and activities, “things that they couldn’t have known.”
The Iranian regime, it seems to her, has been constantly fine-tuning its cyber-espionage efforts over the years, getting closer and closer. “There seems to be no escape,” she says, but adds in the same breath, “so maybe then we should just do what we need to do anyway.”
This story was updated on 18 May 2026, to clarify the charges Pouran Nazemi is currently facing the status of her medical furlough and that the video sent to Mahshid Nazemi showed the perpetrator infiltrating a protest she had attended.
Correction: The story was updated on 19 May 2026. It originally incorrectly identified Nariman Gharib as the hacker. This has now been rectified. Gharib is not the hacker. He is a researcher and writer who only covered the KittenBuster leaks on his blog, analysing publicly available material that KittenBusters posted to an anonymous GitHub account. The identity of whoever is behind KittenBusters is not publicly known, and the leak itself states this.
