Mahan Air cyberattack – Exposing dirty secrets of IRGC QF and further technical analysis

According to Salam No, quoting Shargh, the Telegram channel webnews recently announced in a news item that a significant part of the personnel and crew information and more than five thousand information of Homa Airlines database have been disclosed.

At the same time, Mahan Airlines پرواز Flight Information System نیز has been hacked and its information is being sold in foreign forums, but the value of its information is still unclear.

The news came as Mahan Airlines’ public relations department confirmed the hacking attack in an interview with Sharq, but said the matter was being investigated and it was not yet clear whether it had led

The passengers of this plane also received a warning and hacking message from this group. This text message was sent to the members of the customer club and the ticket buyers of this airline.On May 1, 2016, the webnews telegram channel recently announced in a news item that a significant part of the personnel and crew information and more than five thousand information of Homa Airlines database have been disclosed.

At the same time, Mahan Airlines پرواز Flight Information System. Has also been hacked and its information is being sold in foreign forums, but the value of its information is still unclear.

The news came as Mahan Airlines’ public relations department confirmed the hacking attack in an interview with Sharq, but said the matter was being investigated and it was not yet clear whether it had led to an information leak.

It turned out that the hacker group responsible for this cyberattack Hooshyarane Vatan had succeeded in accessing Mahan air systems due to the fact that all sensitive information was not encrypted. It was also revealed that Mahan Airs IT department had actually identified the hackers on the network and had not yet been able to remove them. How bad are the security measures in Mahan Air?

The first revelation that came out of this cyber attack was evidence that multiple passengers called MR Hamrah Hamrah had boarded flights more than 70000 times on Iranian flights to Syria !! All are booked using the same travel agency called Utab Gasht. Utab Gasht seems to be a legitimate company but it turned out that they regularly transfer funds to a company called Hamrah or Hamrah SYR. Hamrah Company was rarely mentioned by Mahan Air employees, but a number of employees accidently leaked this information and wrote letters to the esteemed CEO of the company Mr. Golparast. Mr. Golparast is an exposed officer of the IRGC and the owner of Qeshm Fars Company which is a front for IRGC!! Mahan air is making dirty deals with IRGC officers !! Incredible!

Leaked Letter

Further analysis of this cyber attack also reveals numerous receipts for charter flights fully booked by the Hamrah company along with hundreds of illegal passengers traveling between Tehran, Damascus and Beruit. This evidence as well as further evidence indicating that passenger load exceeds limits over hundreds of kilograms shows that Mahan Air is actively facilitating the IRGCs QF activities and arms deals in Syria and Hezbollah in Lebanon. There is also a big difference with passengers who board flights and who are registered in the flight system. More than 400 passengers are lost every month under this name. Who knows what other dangerous personnel and cargo the Islamic Revolutionary Guard Corps carries on these flights alongside innocent civilians on flights? Absolutely embarrassing!!

Leaked Invoice for hidden chartered flights

It was also revealed that all these flights are booked with only 15 phone numbers and also certain people with special privilege are mentioned to board Mahan Air flights. Most likely these are QF IRGC officials. These are listed below:

Phone Numbers and Names used for IRGC QF flight bookings at Mahan Air

After the technical analysis of this cyber attack it is revealed that Mahan Air has sold its soul to the IRGC and QF. How can Mahan Air do this to the Iranian people? A catastrophe could easily have happened when all these covert and evil deals and trips were completed. The Hamrah company are accompanying Utab Gasht and Qeshm Fars as front companies of the IRGC and its sinister motives and Mahan Air is in bed with them. disgusting! Friends, please do not travel with this airline anymore.

For years the “Mahan Air” airline has been publicly scrutinized and investigated for cooperation with the Iranian Revolutionary Guard Corps’ Quds Force, however the specifics of this cooperation have never been uncovered.

We believe the public deserves to know the truth behind this cooperation and the money wasted on IRGC activities abroad while Iranian people suffer at home. Mahan Air documents that the public deserves to know, this brought us to hack into Mahan’s network. In the following posts, we’ll be exposing and explaining the crucial information we found from within the Mahan Air network.

When looking through Mahan Air’s internal passenger lists, we found extremely large quantities of passengers listed with the full name “MR. Hamrah Hamrah”. These passengers repeated themselves over the course of years, about 70 thousand on the IKA (Tehran) to DAM (Damascus) route alone since 2017, sometimes even hundreds of these passengers appearing simultaneously on the same flight. All the duplicate “Hamrah” passengers we saw were booked by the same travel agency: an Iranian agency by the name of “Utab Gasht”.

This seemed very peculiar, as nowadays airlines are required to pay close attention to passenger information for air-safety reasons, this is quite evident to anyone who has dealt with a typo on a plane ticket.

When checking online, Utab Gasht seems to be a normal Tehran based travel agency. However, once we looked into Mahan data regarding Utab Gasht, we found Utab regularly transfer funds on behalf of a company named “Hamrah” (sometimes “Hamrah SYR”).

Travel Agency Utab Gasht.

Respected management of the Middle East region of Mahan Airlines

Sarkar Khanum Bani Imam

Servant of Hamrah Mahmoud Kanki Company

Copy: Commercial Representative in occ

Shahid Beheshti St.

Between Mofteh and Mir Emad

Pine Building, No. 14.05

First layer, one 24

88511300 88747005 09037124272

@utabgasht

Unit 26, First Floor, No 14. Berween Mofattch & Miremad Beheshti Avenue, Tehran, Iran.

(0) utabgasht_com www.utabgasht.com

Hamrah Today Telecommunications

Moreover, we have also found official letters sent from the Hamrah company to third parties (not mentioning Utab Gasht) printed with the Utab Gasht letterhead and format.

It seems “Hamrah” is also the name of a company which is closely affiliated with the Utab Gasht travel agency.

We’ve also seen seemingly close connections between the Hamrah company and Mahan Air themselves, so close in fact that Hamrah can get away with booking large numbers of tickets for anonymous passengers using the name “Hamrah Hamrah” without any prior notice to Mahan Air themselves.

Weekly delay report from 1400/02/04 to 1400/02/10

The solution has been taken not to repeat the action and the result is the reason for the delay of the date number path
(Minutes) Flight
In case of repetition, it will be shared with Sardar Golparast. A warning will be given to the new person accompanying him.
Due to the previous 25 Damascus-Imam 0143 “”
In case of repetition, it will be discussed with the esteemed CEO by the Deputy Minister of Commerce. Written letter to remove the cabin load or reduce it in light loaded packages 9300 kg cabin load 115 Imam-Soleimani 5058 “”
In case of repetition, a written warning will be given to the contracting party. Verbal warning to the station manager to monitor further reloading due to non-standard load arrangement on trays 25 Guangzhou-Imam 0090 27-Apr-21
It should be put aside if a written warning is repeated. It is currently being monitored by business associates. The station was asked to explain why this was due to a flight peak in Guangzhou and a lack of manpower. Mahan flights have been scheduled to provide maximum assistance. Extension of 6700 kg load of cabin due to lack of force 105 “” 0080 29-Apr-21
Prolonged load of 7740 kg cabin load due to lack of force 100 “” 0080 30-Apr-21

Meeting result;
Previous session: There was no delay.
Current meeting: The representative of Hamrah company is obliged to cooperate in order to make the flight on time and only in special cases with prior coordination will there be a possibility of delay. Regarding the cabin load and its load, which is sometimes delayed due to non-standard packaging, in a written letter from the Deputy Minister of Commerce, it was decided that the packages should be packed in a volume and size of 25 to 30 kg to make it easier to carry, faster loading, And to reduce the damage to the seats. Also, during the decision made in the mentioned cases (cargo flights only), delays that are not due to personal error will be recorded in the EXT section.
Asghari-Babaei

Minutes of bills of lading issued for defense industries (Hamreh Company)
February 2020
Row of bill of lading Date of issue Date of issue Date of issue Hijri Path Weight (kg) Weight (Discount) Rate of dollar Amount (USD)
1 540 3204 1155 01/01/2020 1398/10/11 Damascus – Tehran 250.00 125 2 250
2 537 3204 1144 01/02/2020 1398/11/01 Damascus – Tehran 170.00 85 2 170
3 538 3336 0880 20/02/2020 1398/12/01 Damascus – Tehran 155.00 78 2 155
4 537 3336 0725 20/02/2020 1398/12/01 Damascus – Tehran 1,135.00 568 2 1,135
5 537 3335 4915 01/02/2020 1398/11/12 Tehran – Damascus 2,436.00 1,218 2 2,436
6 537 3335 5000 01/02/2020 1398/11/12 Tehran – Damascus 0.50 0 2 1
7 537 3336 0154 04/02/2020 1398/11/15 Tehran – Damascus 230.00 115 2 230
8 537 3336 0165 04/02/2020 1398/11/15 Tehran – Damascus 2,090.00 1,045 2 2,090
9 537 3336 0176 04/02/2020 1398/11/15 Tehran – Damascus 3,200.00 1,600 2 3,200
10 537 3336 0515 04/02/2020 1398/11/15 Tehran – Damascus 250.00 125 2 250
11 537 3336 0692 13/02/2020 1398/11/24 Tehran – Damascus 108.00 54 2 108
12 537 3336 0773 13/02/2020 1398/11/24 Tehran – Damascus 4,321.00 2,161 2 4,321
13 537 3336 1215 13/02/2020 1398/11/24 Tehran – Damascus 6,636.00 3,318 2 6,636
14 537 3336 0806 15/02/2020 1398/11/26 Tehran – Damascus 1,100.00 550 2 1,100
15 537 3336 0891 15/02/2020 1398/11/26 Tehran – Damascus 5,140.00 2,570 2 5,140
16 537 3336 1171 15/02/2020 1398/11/26 Tehran – Damascus 290.00 145 2 290
17 537 3336 1230 15/02/2020 1398/11/26 Tehran – Damascus 190.00 95 2 190
18 537 3336 0935 16/02/2020 1398/11/27 Tehran – Damascus 120.00 60 2 120
19 537 3398 1146 18/02/2020 1398/11/29 Tehran – Damascus 100.00 50 2 100
20 537 3336 1090 18/02/2020 1398/11/29 Tehran – Damascus 13.00 7 2 13
21 537 3336 1123 18/02/2020 1398/11/29 Tehran – Damascus 581.00 291 2 581
22 537 3336 1145 18/02/2020 1398/11/29 Tehran – Damascus 8.00 4 2 8
23 537 3336 1263 21/02/2020 1398/12/02 Tehran – Damascus 21.00 11 2 21
24 537 3336 1134 23/02/2020 1398/12/04 Tehran – Damascus 326.00 163 2 326
25 537 3336 1672 26/02/2020 1398/12/07 Tehran – Damascus 500.00 250 2 500
26 537 3336 1764 27/02/2020 1398/12/08 Tehran – Damascus 1,080.00 540 2 1,080
27 537 3336 1775 27/02/2020 1398/12/08 Tehran – Damascus 1,000.00 500 2 1,000
28 537 3336 1753 27/02/2020 1398/12/08 Tehran – Damascus 1,010.00 505 2 1,010
29 537 3336 1742 27/02/2020 1398/12/08 Tehran – Damascus 1,090.00 545 2 1,090
30 537 3398 1942 27/02/2020 1398/12/08 Tehran – Damascus 426.00 213 2 426
Total 33,976.50 16,988 33,977

PROVIDER: COMMERCIAL REVENUE

It seems as if we’ve found a company (the Hamrah company) that must be quite reputable, seeing as Mahan Air – a IATA listed airline – has granted them full autonomy and direct access to crucial airport systems.

However, when checking online it seems there is nothing listed as “The Hamrah Company” at all, even when searching for the many different spelling variations of the Hamrah company’s name that we’ve seen used in internal Mahan Air documentations.

This had left us questioning as to what this “Hamrah company” really is, and why exactly have they seemingly been ordering tens of thousands of anonymous tickets?

That confusion is what drove us to thoroughly pursue the “Hamrah company” lead through Mahan Air’s systems.

In large, it looked like Mahan employees rarely referenced details of the Hamrah company in spite of their widespread business with the airline. However, handily, we found some slips where informed employees let a few details go.

We knew Hamrah was suspicious, but once we found a document with the Hamrah company referred to as “The Defense Industries”, we started to suspect direct IRGC involvement.

Further assuring our suspicions were formal Hamrah Company documents addressed to “the respectable CEO, Mr. Golparast”, also referred to as sradar Golparast – a military rank used in the IRGC.

This ranked official, known to us only as “sradar Golparast”, was our next clue to the nature of Mahan’s unusual “Hamrah” business.

When searching online, we easily identified Golparast as a previously exposed IRGC member who is also listed as the owner of the notorious Qeshm Fars Air in the Iranian Registrar of Companies. Qeshm Fars is a known QF cover company, frequently used to transport munitions throughout the Middle East.
By this point it is clear to us that the Hamrah company is in fact another cover company used by the IRGC-QF to freely transport supplies and personnel under a civilian cover.

As we’ve seen, Mahan Air has security standards that are unconventional to say the least. We’ve found Mahan does keep records of its suspicious business with QF under the name “Hamrah”, and that this business is managed by sradar Golparast.
There was still a lot that we didn’t yet know, for example: what cargo exactly QF transports on these flights, how much of it, and where this cargo is transported to. Nor did we know who was involved in this cooperation, or what else it was used for.
These questions directed our research of the Mahan Air materials, and led us to the shocking findings we’ll be sharing with you over the coming days.

We found receipts for fully booked charter flights billed to The Hamrah company, which we’ve established is operated by Quds Force. These charter flights were booked with hundreds of unlisted passengers and operated on a weekly basis between Tehran, Damascus and Beirut.
Based on the destinations, these hundreds of passengers are most likely QF combatants sent to aid the Assad regime in Syria and Hizballah in Lebanon and waste more stolen wealth on funding terrorists and criminals.

We’ve referenced the unsupervised “free hand” granted to the Hamrah company by Mahan Air, this apparently extends also to the Utab Gasht travel agency as we found documentation of their passengers repeatedly being permitted excess baggage by hundreds of Kilograms.

The organized and routine nature of Hamrah company excess baggage brings us to believe that QF are using these passengers to transport all sorts of cargo in their personal baggage.

It is obvious that IRGC passengers travelling to QF dominant regions would use that exception with malicious intent.

——

If you hold any doubt to the nature of those extra pounds, take a look at what we found when searching for more QF cargo. These internal Mahan Air shipment bills detail dozens of tons of cargo shipped to Damascus and Lebanon by the Hamrah company every month.

This correspondence is from Mahan Air’s CEO and founder, Hamid Arab-Nejad, to the commander of the Iranian Military’s Air Force. In its content, Arab-Nejad opens by reminding that his company (Mahan Air) operates according to the highest ideals and goals of the Islamic Republic, and that his company has been able to keep operating despite the American sanctions.

This second correspondence from a Mahan Air employee to the Iranian Ministry of Foreign Affairs states that Mahan Air’s flights to Afghanistan were halted because of their cooperation with QF and the sanctions this entailed. The Mahan Air employee goes as far as asking the Ministry for their help in evading these sanctions!

These two documents are prime examples of the deep cooperation between Mahan Air and QF and their efforts in evading financial sanctions.

One can only imagine, considering the numbers, what sort of supplies or ammunition QF are loading on these flights.

Keep in mind, all these illicit activities are performed under a civilian cover and within close proximity to civilian population and vulnerable facilities, doubtlessly jeopardizing air safety.

For those of you who are questioning QF’s motives in working with Mahan, take into account that, as is already known publicly, when QF operates similar transfers through known military affiliated aircraft (like with Fars Qeshm), their shipments are often targeted and attacked.

Through the process we’ve just exposed, it seems QF are avoiding direct attacks against their shipments by hiding them amongst airline passengers. And in doing so, along with Mahan Air, QF are constantly putting civilian lives at risk.

We have much more to expose on this story, including the names, the numbers, and much more proof of the malicious activities directed by Quds Force and Mahan Air.

Gold and weapons being sent out of Iran to foreign militias. The regime tells us there is no money, it shoots protesters and at same time #IRGC Quds Force sends our wealth to Syria, Yemen and Afghanistan to kill others

Source » 0x7c3.blogspot

Source » cybershafarat