Sending Thoughts, Prayers, and Your Live Location:
How We Followed an APT35 Operator Into Iran's Domestic Repression Platform
What do state cyber capabilities look like when they're turned inward? Starting with an indicted Iranian APT35 operator, we followed a trail of digital breadcrumbs, forgotten online identities, and unexpected infrastructure connections to a mysterious piece of software. What began as a conventional threat hunting investigation took us through a series of surprising discoveries, eventually leading somewhere far beyond our original hypothesis. Ethan Fecht and Ruarigh Thornton walk through the investigative techniques, the breakthroughs that changed our understanding of what we'd found, and what this case reveals about a largely overlooked dimension of modern conflict: the cyber capabilities states deploy against their own populations.