Hacktivist organization GhostSec recently distributed critical information and source code for FANAP Group’s surveillance software, which targets the citizens of Iran. GhostSec is a self-proclaimed vigilante group known for their exploitation of ISIS and other terrorist organizations. Over the past few years, GhostSec shifted its focus to activities surrounding the Russia/Ukraine conflict. GhostSec actors disclosed around 26GB of data from FANAP Group thus far, revealing information about their core components such as code snippets, configuration files, and API data. The surveillance tool that the threat actors targeted has facial recognition capabilities among “various other privacy invading features and tools”. Overall, the FANAP software, which was deployed throughout the region and in several financial institutions, has the ability for video surveillance with facial recognition, vehicle tracking, license plate recognition, and additional facial recognition systems for ID card distribution. GhostSec’s claimed their reasoning for compromising and disclosing the information was in the name of human rights, one of the core motivations of the group. CTIX continues to monitor threat activity worldwide and will provide additional updates accordingly.