Category: Uncategorized

  • Iran anti-government protests spread to majority of provinces, videos show

    Iran anti-government protests spread to majority of provinces, videos show


    EPA Demonstrators in Iran during anti-government protests. The image is imposed over the BBC Verify branding and colours. EPA

    Protests have broken out in at least 17 of Iran’s 31 provinces, presenting the largest challenge to the country’s clerical establishment since 2022, a BBC Verify and BBC Persian analysis has found.

    The BBC’s analysis of protests includes only those for which we have verified video footage – the true number is almost certainly far higher. There are reports of protests in a further 11 provinces.

    The wave of protests has spread rapidly across Iran since 28 December, when anger initially broke out in the capital Tehran following a fresh and sharp devaluation of the country’s currency against the dollar and other major foreign currencies.

    Verified footage from the last 10 days shows evidence of anti-government demonstrations and gatherings in more than 50 towns and cities across the country, including in several regions previously perceived as being highly loyal to the state.

    More than 100 videos which which we geolocated and checked for publication date paint a picture of the scale of the unrest, with people taking to the streets in many major cities in Iran and presenting the largest challenge to the state since the Women, Life and Freedom protests in 2022.

    Footage has also shown protests in Qom in central Iran and Mashhad in the north-east, both of which have traditionally hosted populations extremely loyal to the Islamic Republic.

    Prof Sina Azodi, Director of Middle East Studies Program at George Washington University, said that unrest in those cities was “very telling” and amounted to evidence that the government’s “base of support is also suffering under the economic hardship”.

    A BBC graphic showing locations of verified protests in Iran.

    Authorities have traditionally used violence to crush unrest. During the 2022 protests – sparked by the death in custody of Mahsa Amini, a young woman who had been detained in Tehran for wearing “improper hijab” – more than 550 people were allegedly killed by security forces, according to human rights groups.

    While the latest response by police and security forces initially appeared to be more restrained, verified footage has shown officers ramping up the use of force since Saturday. This change in approach coincided with Supreme Leader Ayatollah Ali Khamenei’s first public reaction to the protests on that day, in which he said that “rioters must be put in their place”.

    Since the supreme leader’s remarks, Iran’s judiciary chief, Gholamhossein Mohseni Ejei, said authorities would “listen to protesters and critics who legitimately and rightly have concerns about their livelihood and social and economic welfare”.

    But he added that they would “deal firmly with those who seek to exploit the situation, incite riots, and undermine the security of the country and the people”. The powerful Islamic Revolutionary Guards Corps (IRGC) has also issued warnings to protesters in Lorestan province that they will no longer tolerate street gatherings.

    BBC Persian has so far confirmed the identities of at least 11 people reported dead since 28 December using a combination of verified funeral videos and interviews with family members and friends.

    Foreign-based human rights group HRANA says at least 35 people have so far been killed in the unrest, including two affiliated with security forces.

    A BBC graphic showing the locations of clashes with security forces across Iran.

    One of the most violent crackdowns happened in Malekshahi, a small town in the western province of Ilam, on Saturday. Verified footage showed a small demonstration taking place at Commandery Boulevard, where the officers of several state institutions are located, before gunfire appeared to break out. Human rights groups said four people were killed in the incident, with the semi-official Mehr and Tasnim news agencies putting the figure at three dead.

    Later footage showed a number of people being transported to hospital. It was unclear from the footage what condition those seen in the footage were in.

    Multiple verified videos filmed in the nearby Ilam city show security forces firing shots towards Imam Khomeini Hospital in the centre of the city later on Saturday. Iran’s president has ordered an investigation into the incident.

    Experts warned that the security forces heavy-handed response could exacerbate the challenges facing the government.

    “Escalating repression is likely to deepen popular resentment toward the political system while risking fatigue and demoralisation within the police and security forces – who, at some point, may cease to comply with orders,” Peyman Jafari, assistant professor of international relations at the US-based College of William and Mary, told BBC Verify.

    While most of the footage featuring violence seen by the BBC was carried out by security forces, a few clips have also shown demonstrators attacking government forces. In Qom, one video showed officers riding motorbikes being pelted with rocks as they sped past a small gathering.

    Another dramatic clip showed a security officer on a motorbike set ablaze by a demonstrator wielding an improvised flamethrower after security forces violently detained and beat up a protester. It is unclear what happened to the officer, as the footage cut off, while other officers gave chase to the demonstrator who fled on foot.

    And in the western city of Azna, demonstrators appeared to start a fire outside a police station after security forces opened fire on protesters earlier. BBC Persian has identified at least three demonstrators killed in Azna by verifying footage of funerals and speaking to family members.

    Demonstrators appear to start a fire outside a police station in Azna, Iran

    The demonstrations initially began as a backlash against what they say is the government’s mismanagement of the country’s struggling economy, which has increasingly floundered under the weight of international sanctions. Officials have also been accused of widespread corruption.

    But in recent days the demonstrations have taken an anti-state tone, with protesters in numerous locations chanting slogans against Supreme Leader Ayatollah Ali Khamenei and the clerical establishment that has been ruling the country since the 1979 Islamic revolution. Verified videos have also shown chants in support of Reza Pahlavi, the exiled son of the Shah of Iran, and the pre-1979 revolution Pahlavi dynasty.

    At the University of Tehran, some protesters chanted “death to the dictator” – a reference to Khamenei – as dozens of demonstrators flooded through the institution’s main gate on 30 December.

    And in the city of Iranshahr in the coastal Sistan and Baluchestan province, protesters set fire to a statue of Khamenei and the leader of the 1979 revolution, Ayatollah Ruhollah Khomeini.

    Protestors set fire to pro-government statue in in Iranshahr, Iran

    Holly Dagres, senior fellow at the Washington Institute and curator of the Iranist newsletter, said the Tehran government had learned few lessons from the 2022 protests which raged across Iran for more than four months.

    “While the catalysts differ… the problems remain the same: systemic mismanagement, corruption, and repression,” she said. “The countless anti-regime chants make clear that many Iranians are calling for the ouster of the Islamic Republic.”

    Despite the extent of the demonstrations, most of the experts who spoke to the BBC said they do not yet amount to an existential threat to the state.

    “Security forces are loyal – there are no defections at this point and law enforcement forces are carrying out the orders,” Azodi said.

    “Furthermore, while the protests are widespread we are not seeing a clear strategy [or] attempt by the protesters to bring down the Islamic Republic.”

    Reporting by Shayan Sardarizadeh, Ghoncheh Habibiazad, Matt Murphy, Farzad Seifikaran, Emma Pengelly, Sherie Ryder, Yi Ma, Christine Jeavans, Jess Carr and Paul Brown

    The BBC Verify banner.



    Source link

  • Israel foreign minister visits Somaliland after recognising its sovereignty

    Israel foreign minister visits Somaliland after recognising its sovereignty


    Israel’s foreign minister has arrived in the breakaway state of Somaliland, marking the first official visit since Israel controversially recognised Somaliland as an independent country.

    Gideon Saar landed in capital city Hargeisa on Tuesday and met with Somaliland President Abdirahman Mohamed Abdullahi, government sources there told the BBC.

    Last month Israel became the first country in the world to recognise Somaliland, which declared independence from Somalia more than 30 years ago.

    Somaliland’s president called Israel’s move “a historic moment”, but Somalia furiously rejected the development as an attack on its sovereignty.

    The Israeli foreign ministry has not publicly commented on Saar’s trip, but a diplomatic source in Somaliland told the BBC that the visit is intended to advance political and strategic partnerships.

    The Somaliland government confirmed Saar’s arrival in a post on X.

    Somaliland declared independence from Somalia in 1991, after the overthrow of Somali military dictator Siad Barre.

    However, the region has remained largely unrecognised on the global stage and Somalia considers Somaliland to be an integral part of its territory.

    Israel’s recognition of Somaliland last month came as a surprise, with Israeli President Benjamin Netanyahu citing Somaliland’s “right to self-determination”.

    This move sparked international condemnation and prompted an emergency meeting of the UN Security Council. China, Turkey and the African Union were among those criticising Israel’s step. The US defended Israel, accusing its critics of double standards.

    In a statement following Israel’s announcement, Saar said: “Somaliland was not created this past weekend. It has existed as a functioning state for more than 34 years.

    “The attacks on Israel’s recognition of Somaliland are hypocritical. Only Israel will decide who to recognise and with who to maintain diplomatic relations.”



    Source link

  • Fake Booking Emails Redirect Hotel Staff to Fake BSoD Pages Delivering DCRat

    Fake Booking Emails Redirect Hotel Staff to Fake BSoD Pages Delivering DCRat


    Jan 06, 2026Ravie LakshmananMalware / Endpoint Security

    Source: Securonix

    Cybersecurity researchers have disclosed details of a new campaign dubbed PHALT#BLYX that has leveraged ClickFix-style lures to display fixes for fake blue screen of death (BSoD) errors in attacks targeting the European hospitality sector.

    The end goal of the multi-stage campaign is to deliver a remote access trojan known as DCRat, according to cybersecurity company Securonix. The activity was detected in late December 2025.

    “For initial access, the threat actors utilize a fake Booking.com reservation cancellation lure to trick victims into executing malicious PowerShell commands, which silently fetch and execute remote code,” researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee said.

    Cybersecurity

    The starting point of the attack chain is a phishing email impersonating Booking.com that contains a link to a fake website (e.g., “low-house[.]com”). The messages warn recipients of unexpected reservation cancellations, urging them to click the link to confirm the cancellation.

    The website to which the victim is redirected masquerades as Booking.com, and serves a fake CAPTCHA page that leads them to a bogus BSoD page with “recovery instructions” to open the Windows Run dialog, paste a command, and press the Enter key. In reality, this results in the execution of a PowerShell command that ultimately deploys DCRat.

    Specifically, this entails a multi-step process that commences with the PowerShell dropper downloading an MSBuild project file (“v.proj”) from “2fa-bns[.]com”, which is then executed using “MSBuild.exe” to run an embedded payload responsible for configuring Microsoft Defender Antivirus exclusions to evade detection, setting up persistence on the host in the Startup folder, and launching the RAT malware after downloads it from the same location as the MSBuild project.

    It’s also capable of disabling the security program altogether if found to be running with administrator privileges. If it doesn’t have elevated rights, the malware enters a loop that triggers a Windows User Account Control (UAC) prompt every two seconds for three times in hopes that the victim will grant it the necessary permissions out of sheer frustration.

    In tandem, the PowerShell code takes steps to open the legitimate Booking.com admin page in the default browser as a distraction mechanism and to give an impression to the victim that the action was legitimate.

    DCRat, also called Dark Crystal RAT, is an off-the-shell .NET trojan that can harvest sensitive information and expand its functionality by means of a plugin-based architecture. It’s equipped to connect to an external server, profile the infected system, and await incoming commands from the server, enabling the attackers to log keystrokes, run arbitrary commands, and deliver additional payloads like a cryptocurrency miner.

    Cybersecurity

    The campaign is an example of how threat actors are leveraging living-off-the-land (LotL) techniques, such as abusing trusted system binaries like “MSBuild.exe,” to move the attack to the next stage, establish a deeper foothold, and maintain persistence within compromised hosts.

    “The phishing emails notably feature room charge details in Euros, suggesting the campaign is actively targeting European organizations,” Securonix said. “The use of the Russian language within the ‘v.proj’ MSBuild file links this activity to Russian threat factors using DCRat.”

    “The use of a customized MSBuild project file to proxy execution, coupled with aggressive tampering of Windows Defender exclusions, demonstrates a deep understanding of modern endpoint protection mechanisms.”



    Source link