{ "id": "eac7b7ed-c71d-4c7c-8eb8-1b965d8b5b32", "created_at": "2026-04-06T00:13:50.214537Z", "updated_at": "2026-04-10T03:25:32.29429Z", "deleted_at": null, "sha1_hash": "23ea8ec5955a9b3064c638ed74514f4ee08080e8", "title": "KromSec outs AnonOpsSE as Iranian regime – Makes statement", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1963737, "plain_text": "KromSec outs AnonOpsSE as Iranian regime – Makes statement\r\nPublished: 2022-11-18 · Archived: 2026-04-05 14:05:27 UTC\r\nTeam also takes down several Itanian sites\r\nGreetings dear citizens of the world, As KromSec, we thought that it is the right of people to make a statement\r\nagainst the lies told about us and those who try to make us look bad to the Iranian people, and we have prepared\r\nan announcement for you.\r\nFirst, we’ll list the things they accuse us of doing.\r\n1- Accusing us of attacking the Ukrainian government.\r\n2- Accusing us of making money and profits using the name Anonymous\r\n3- Accusing us of doing fake hacks.\r\n4- Accuse of being kicked off Anonymous.\r\n5- Accusing people of stealing money.\r\nSo why are these accusations against us?\r\nBecause dear citizens of the world, we are doing something for you. And we do this without any gain.\r\nLet’s examine how absurd and meaningless the accusations are with our answers.\r\n1- We have provided access to the websites of the Ukrainian government, we accept this. We even shared\r\nscreenshots of ourselves that we provided access. During OpRussia, we exploited the websites of the Ukrainian\r\ngovernment by gaining access before russian hackers just to protect its people.\r\nAnd the thought of Anonymous is anarchist. There is no privilege of any government or authority. It won’t. People\r\nwho join the idea of ??Anonymous together with OpRussia think that we support the Ukrainian government, but\r\nthis is wrong. We have only taken steps to stop the war. And the idea that the Ukrainian government is unhackable\r\nis wrong. Therefore, no one can even deign to accuse us of this.\r\n2- No one can collect donations under an anonymous name. Because the idea demands it. Today, those who collect\r\ndonations under the name Anonymous cannot use the name Anonymous. We have not asked for donations from\r\nanyone and we will not.\r\n3- When we first examine the old tweets of the accounts accusing us of fake hacking, it is not difficult to realize\r\nthat they are our supporters. So why are these accounts calling us fake hackers today? Our followers know very\r\nwell what we are doing, and we will follow the path we know is right.\r\n4- Kicked out of Anoymous? They must be kidding. Anonymous Is not an club or group so we can get kicked out.\r\nIn addition, the expulsion of our leader, Spid3r from DoomSec, is due to misunderstandings and the hatred that the\r\nhttps://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/\r\nPage 1 of 10\n\nDoomSec leader has for himself. Today, neither the DoomSec team nor those who hold a grudge against Spid3r\r\nare in the place. They’re all gone…\r\n5- Accusations that we are stealing people’s money by carding. This is because we do not want people with\r\n‘carding’ skills to write to us in our team’s message for recruits. No, we do not do carding as a team. We haven’t\r\ndone it before. The reason we published it in that message is to learn about the existence of cardable sites. Those\r\nwho accuse us of stealing people’s money should be concerned with how they make their own money.\r\nAbout the screenshots directed to us :\r\n1- The message that the DoomSec group has cut off ties with its spider.\r\n2- The image of the post that we want those with carding skills in KromSec channel to write to us.\r\nStatement that we hacked the domain we bought ourselves (Mentioned domain [putin-vladimir.ru]) : ;\r\n1- As you can see, there is a page made by the ‘1877 Team’ on the site. 1877 Team stated that the Russian hosting\r\nand domain company had vulnerabilities in their website. And share proof from their telegram accounts and that\r\nthey could receive service free of charge and proved this by purchasing this domain. However, he shared two\r\nmessages separately on his channels and later explained that this was not a hack but a proof of that vuln. Spid3r\r\nshared this domain like many previous hacks of 1877 Team. Upon receiving the message ‘the domain was\r\npurchased on the day it was hacked’, he asked 1877 Team about the situation and deleted the tweet after learning\r\nthe right incident.\r\n2- This domain name has nothing to do with the KromSec team and is the only false basis for the accusation that\r\nthey are buying domains that refer to us. Therefore, the claim that our team bought a fake domain has been denied.\r\n3- As an extra: You can access the defaces of the KromSec team on its channel and archive registration sites.\r\nHacking of Iranian forensic institute :\r\nhttps://i.hizliresim.com/pe8hsmy.jpg\r\nhttps://web.archive.org/web/20220921201507/http://lmrc.ir/\r\nTherefore, any accusation leveled against us is false and distorted. As we started OpIran, we will bring it to an\r\nend. We will not stop being with people. The attacks against us have proven that we are on the right path.\r\nLong live the free peoples of the world! Fear has no place in freedom!\r\nDon’t contact with Anonymous. Don’t give your name, voice, picture. Don’t give your city.\r\nIran police act like Anonymous and get your personal informations!\r\nhttps://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/\r\nPage 2 of 10\n\nhttps://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/\r\nPage 3 of 10\n\nhttps://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/\r\nPage 4 of 10\n\nhttps://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/\r\nPage 5 of 10\n\nAnonymous never need your informations! Don’t give it.\r\nWe declared that he supports the Iranian regime.\r\nThis scum has been attacking us since the first time we hacked the regime’s systems, he is not a hacker and has\r\nnothing to do with Anonymous.\r\nBy sharing the Iranian parliament hack that we did on September 25, he is gaining fans (followers) as if he did it\r\nhimself. This is a fake account.\r\nOpIran\r\nhttps://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/\r\nPage 6 of 10\n\nhttps://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/\r\nPage 7 of 10\n\nhttps://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/\r\nPage 8 of 10\n\nhttps://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/\r\nPage 9 of 10\n\nSource: https://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/\r\nhttps://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/\r\nPage 10 of 10", "extraction_quality": 1, "language": "EN", "sources": [ "MISPGALAXY", "Malpedia" ], "references": [ "https://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/" ], "report_names": [ "kromsec-outs-anonopsse-as-iranian-regime-makes-statement" ], "threat_actors": [ { "id": "763f2092-2b32-4579-baf0-ada8c8bc7b43", "created_at": "2023-11-08T02:00:07.117517Z", "updated_at": "2026-04-10T02:00:03.418144Z", "deleted_at": null, "main_name": "KromSec", "aliases": [], "source_name": "MISPGALAXY:KromSec", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434430, "ts_updated_at": 1775791532, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/23ea8ec5955a9b3064c638ed74514f4ee08080e8.pdf", "text": "https://archive.orkl.eu/23ea8ec5955a9b3064c638ed74514f4ee08080e8.txt", "img": "https://archive.orkl.eu/23ea8ec5955a9b3064c638ed74514f4ee08080e8.jpg" } }