Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities

# Executive summary Kaspersky analyzed an active Chafer APT campaign using an updated Remexi Trojan to spy on foreign diplomatic entities in Iran: Remexi collects keystrokes, screenshots, browser credentials and history, uses BITS and IIS/ASP for C2 and exfiltration, employs multiple persistence mechanisms (scheduled tasks, Run/Userinit registry entries), and the report includes compilation artifacts and extensive IoCs (file hashes, IP 108.61.189.174, mutexes, registry keys, scheduled task names).