iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
GhostSec claimed in 2023 that it breached Iranian company FANAP’s surveillance software and released parts of its source code on Telegram. Reporting confirms that the claim and Telegram posts circulated; it does not independently prove that FANAP was breached or that the posted code came from FANAP.
What GhostSec said it leaked
GhostSec’s allegation concerned software associated with FANAP, an Iranian technology company. Secureworks’ State of the Threat: A Year in Review, 8th Edition (2024) says GhostSec created an “Iran_Exposed” Telegram channel in August 2023 to publicize an alleged breach of “FANAP71” surveillance software.
An October 2023 Consortium Networks newsletter separately reported that GhostSec claimed to possess FANAP source code and that code components had appeared on Telegram. Those accounts establish when and where the allegation was publicized, not that the intrusion occurred.
FANAP71 and FANAP Behnama are not clearly resolved
Different coverage uses different names. Secureworks and Consortium Networks refer to FANAP or FANAP71, while a Cyberint search-result excerpt describes “FANAP Behnama” and mentions exposed code. The available material does not establish whether FANAP71 and FANAP Behnama are the same product, related systems, or labels applied differently by separate reports.
#1 Best Overall
| Label | Where it appears | What can be concluded |
|---|---|---|
| FANAP71 | Secureworks’ 2024 retrospective | Presented as the name of the surveillance software in GhostSec’s alleged-breach claim; the report does not authenticate the breach. |
| FANAP | Consortium Networks’ October 2023 newsletter | Used for the company or its source code in a contemporaneous report of GhostSec’s claim. |
| FANAP Behnama | Cyberint search-result excerpt | Appears in the excerpt’s description; the underlying page was unavailable, so the label and any technical details should be treated cautiously. |
Was the source code verified?
No independent verification is established in the accessible reporting. The reports say that components were released on Telegram, but they do not document a forensic examination proving that the files originated inside FANAP, were complete, or belonged to the named surveillance product.
A Cyberint search excerpt mentions 20GB of exposed code. Because the page could not be accessed and the figure is not independently confirmed, it should not be treated as a verified leak size.
Did GhostSec really hack Iranian surveillance software?
The strongest accurate answer is that GhostSec alleged it did, and multiple reports documented the allegation. The available sources do not independently establish the compromise, identify a confirmed attack path, or authenticate the Telegram material. Claims about a successful hack therefore remain unverified rather than proven or disproven by these reports.
Recommended Free Tools
Why the allegation received attention
The claim appeared amid GhostSec’s broader activity against Iranian targets and other organizations. Secureworks reports that GhostSec became part of the Five Families collective, formed in August 2023, and that GhostSec said it stepped back from ransomware activity in May 2024. That organizational context helps explain the group’s public messaging but does not validate the FANAP allegation.
Rank #3
What readers should take away
- The claim was attributed to GhostSec and reported between August and October 2023.
- Coverage describes the target with the labels FANAP, FANAP71 and FANAP Behnama; their exact relationship is unresolved here.
- Code components were reportedly posted on Telegram, but their origin and completeness were not independently authenticated.
- The often-repeated 20GB figure comes from an inaccessible Cyberint search excerpt and is not a verified measurement.
The Bottom Line
GhostSec’s alleged FANAP surveillance-software breach was a reported claim, not a confirmed incident. Public reporting supports that the group said it released code on Telegram, while the breach, the software identity and the code’s provenance remain independently unverified.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
