According to Salam No, quoting Shargh, the Telegram channel webnews recently announced in a news item that a significant part of the personnel and crew information and more than five thousand information of Homa Airlines database have been disclosed.

At the same time, Mahan Airlines پرواز Flight Information System نیز has been hacked and its information is being sold in foreign forums, but the value of its information is still unclear.

The news came as Mahan Airlines’ public relations department confirmed the hacking attack in an interview with Sharq, but said the matter was being investigated and it was not yet clear whether it had led

The passengers of this plane also received a warning and hacking message from this group. This text message was sent to the members of the customer club and the ticket buyers of this airline.On May 1, 2016, the webnews telegram channel recently announced in a news item that a significant part of the personnel and crew information and more than five thousand information of Homa Airlines database have been disclosed.

At the same time, Mahan Airlines پرواز Flight Information System. Has also been hacked and its information is being sold in foreign forums, but the value of its information is still unclear.

The news came as Mahan Airlines’ public relations department confirmed the hacking attack in an interview with Sharq, but said the matter was being investigated and it was not yet clear whether it had led to an information leak.

It turned out that the hacker group responsible for this cyberattack Hooshyarane Vatan had succeeded in accessing Mahan air systems due to the fact that all sensitive information was not encrypted. It was also revealed that Mahan Airs IT department had actually identified the hackers on the network and had not yet been able to remove them. How bad are the security measures in Mahan Air?

The first revelation that came out of this cyber attack was evidence that multiple passengers called MR Hamrah Hamrah had boarded flights more than 70000 times on Iranian flights to Syria !! All are booked using the same travel agency called Utab Gasht. Utab Gasht seems to be a legitimate company but it turned out that they regularly transfer funds to a company called Hamrah or Hamrah SYR. Hamrah Company was rarely mentioned by Mahan Air employees, but a number of employees accidently leaked this information and wrote letters to the esteemed CEO of the company Mr. Golparast. Mr. Golparast is an exposed officer of the IRGC and the owner of Qeshm Fars Company which is a front for IRGC!! Mahan air is making dirty deals with IRGC officers !! Incredible!

ifmat - Mahan Air cyberattack - Exposing dirty secrets of IRGC QF and further technical analysis

Leaked Letter

Further analysis of this cyber attack also reveals numerous receipts for charter flights fully booked by the Hamrah company along with hundreds of illegal passengers traveling between Tehran, Damascus and Beruit. This evidence as well as further evidence indicating that passenger load exceeds limits over hundreds of kilograms shows that Mahan Air is actively facilitating the IRGCs QF activities and arms deals in Syria and Hezbollah in Lebanon. There is also a big difference with passengers who board flights and who are registered in the flight system. More than 400 passengers are lost every month under this name. Who knows what other dangerous personnel and cargo the Islamic Revolutionary Guard Corps carries on these flights alongside innocent civilians on flights? Absolutely embarrassing!!

ifmat - Mahan Air cyberattack - Exposing dirty secrets of IRGC QF and further technical analysis2

Leaked Invoice for hidden chartered flights

It was also revealed that all these flights are booked with only 15 phone numbers and also certain people with special privilege are mentioned to board Mahan Air flights. Most likely these are QF IRGC officials. These are listed below:

Phone Numbers and Names used for IRGC QF flight bookings at Mahan Air

After the technical analysis of this cyber attack it is revealed that Mahan Air has sold its soul to the IRGC and QF. How can Mahan Air do this to the Iranian people? A catastrophe could easily have happened when all these covert and evil deals and trips were completed. The Hamrah company are accompanying Utab Gasht and Qeshm Fars as front companies of the IRGC and its sinister motives and Mahan Air is in bed with them. disgusting! Friends, please do not travel with this airline anymore.

For years the “Mahan Air” airline has been publicly scrutinized and investigated for cooperation with the Iranian Revolutionary Guard Corps’ Quds Force, however the specifics of this cooperation have never been uncovered.

We believe the public deserves to know the truth behind this cooperation and the money wasted on IRGC activities abroad while Iranian people suffer at home. Mahan Air documents that the public deserves to know, this brought us to hack into Mahan’s network. In the following posts, we’ll be exposing and explaining the crucial information we found from within the Mahan Air network.

When looking through Mahan Air’s internal passenger lists, we found extremely large quantities of passengers listed with the full name “MR. Hamrah Hamrah”. These passengers repeated themselves over the course of years, about 70 thousand on the IKA (Tehran) to DAM (Damascus) route alone since 2017, sometimes even hundreds of these passengers appearing simultaneously on the same flight. All the duplicate “Hamrah” passengers we saw were booked by the same travel agency: an Iranian agency by the name of “Utab Gasht”.

ifmat - Mahan Air cyberattack - Exposing dirty secrets of IRGC QF and further technical analysis5

This seemed very peculiar, as nowadays airlines are required to pay close attention to passenger information for air-safety reasons, this is quite evident to anyone who has dealt with a typo on a plane ticket.

When checking online, Utab Gasht seems to be a normal Tehran based travel agency. However, once we looked into Mahan data regarding Utab Gasht, we found Utab regularly transfer funds on behalf of a company named “Hamrah” (sometimes “Hamrah SYR”).

ifmat - Mahan Air cyberattack - Exposing dirty secrets of IRGC QF and further technical analysis6

Travel Agency Utab Gasht.

Respected management of the Middle East region of Mahan Airlines

Sarkar Khanum Bani Imam

Servant of Hamrah Mahmoud Kanki Company

Copy: Commercial Representative in occ

Shahid Beheshti St.

Between Mofteh and Mir Emad

Pine Building, No. 14.05

First layer, one 24

88511300 88747005 09037124272


Unit 26, First Floor, No 14. Berween Mofattch & Miremad Beheshti Avenue, Tehran, Iran.

(0) utabgasht_com

Hamrah Today Telecommunications

Moreover, we have also found official letters sent from the Hamrah company to third parties (not mentioning Utab Gasht) printed with the Utab Gasht letterhead and format.

It seems “Hamrah” is also the name of a company which is closely affiliated with the Utab Gasht travel agency.

We’ve also seen seemingly close connections between the Hamrah company and Mahan Air themselves, so close in fact that Hamrah can get away with booking large numbers of tickets for anonymous passengers using the name “Hamrah Hamrah” without any prior notice to Mahan Air themselves.

ifmat - Mahan Air cyberattack - Exposing dirty secrets of IRGC QF and further technical analysis7

Weekly delay report from 1400/02/04 to 1400/02/10

The solution has been taken not to repeat the action and the result is the reason for the delay of the date number path
(Minutes) Flight
In case of repetition, it will be shared with Sardar Golparast. A warning will be given to the new person accompanying him.
Due to the previous 25 Damascus-Imam 0143 “”
In case of repetition, it will be discussed with the esteemed CEO by the Deputy Minister of Commerce. Written letter to remove the cabin load or reduce it in light loaded packages 9300 kg cabin load 115 Imam-Soleimani 5058 “”
In case of repetition, a written warning will be given to the contracting party. Verbal warning to the station manager to monitor further reloading due to non-standard load arrangement on trays 25 Guangzhou-Imam 0090 27-Apr-21
It should be put aside if a written warning is repeated. It is currently being monitored by business associates. The station was asked to explain why this was due to a flight peak in Guangzhou and a lack of manpower. Mahan flights have been scheduled to provide maximum assistance. Extension of 6700 kg load of cabin due to lack of force 105 “” 0080 29-Apr-21
Prolonged load of 7740 kg cabin load due to lack of force 100 “” 0080 30-Apr-21

Meeting result;
Previous session: There was no delay.
Current meeting: The representative of Hamrah company is obliged to cooperate in order to make the flight on time and only in special cases with prior coordination will there be a possibility of delay. Regarding the cabin load and its load, which is sometimes delayed due to non-standard packaging, in a written letter from the Deputy Minister of Commerce, it was decided that the packages should be packed in a volume and size of 25 to 30 kg to make it easier to carry, faster loading, And to reduce the damage to the seats. Also, during the decision made in the mentioned cases (cargo flights only), delays that are not due to personal error will be recorded in the EXT section.

Minutes of bills of lading issued for defense industries (Hamreh Company)
February 2020
Row of bill of lading Date of issue Date of issue Date of issue Hijri Path Weight (kg) Weight (Discount) Rate of dollar Amount (USD)
1 540 3204 1155 01/01/2020 1398/10/11 Damascus – Tehran 250.00 125 2 250
2 537 3204 1144 01/02/2020 1398/11/01 Damascus – Tehran 170.00 85 2 170
3 538 3336 0880 20/02/2020 1398/12/01 Damascus – Tehran 155.00 78 2 155
4 537 3336 0725 20/02/2020 1398/12/01 Damascus – Tehran 1,135.00 568 2 1,135
5 537 3335 4915 01/02/2020 1398/11/12 Tehran – Damascus 2,436.00 1,218 2 2,436
6 537 3335 5000 01/02/2020 1398/11/12 Tehran – Damascus 0.50 0 2 1
7 537 3336 0154 04/02/2020 1398/11/15 Tehran – Damascus 230.00 115 2 230
8 537 3336 0165 04/02/2020 1398/11/15 Tehran – Damascus 2,090.00 1,045 2 2,090
9 537 3336 0176 04/02/2020 1398/11/15 Tehran – Damascus 3,200.00 1,600 2 3,200
10 537 3336 0515 04/02/2020 1398/11/15 Tehran – Damascus 250.00 125 2 250
11 537 3336 0692 13/02/2020 1398/11/24 Tehran – Damascus 108.00 54 2 108
12 537 3336 0773 13/02/2020 1398/11/24 Tehran – Damascus 4,321.00 2,161 2 4,321
13 537 3336 1215 13/02/2020 1398/11/24 Tehran – Damascus 6,636.00 3,318 2 6,636
14 537 3336 0806 15/02/2020 1398/11/26 Tehran – Damascus 1,100.00 550 2 1,100
15 537 3336 0891 15/02/2020 1398/11/26 Tehran – Damascus 5,140.00 2,570 2 5,140
16 537 3336 1171 15/02/2020 1398/11/26 Tehran – Damascus 290.00 145 2 290
17 537 3336 1230 15/02/2020 1398/11/26 Tehran – Damascus 190.00 95 2 190
18 537 3336 0935 16/02/2020 1398/11/27 Tehran – Damascus 120.00 60 2 120
19 537 3398 1146 18/02/2020 1398/11/29 Tehran – Damascus 100.00 50 2 100
20 537 3336 1090 18/02/2020 1398/11/29 Tehran – Damascus 13.00 7 2 13
21 537 3336 1123 18/02/2020 1398/11/29 Tehran – Damascus 581.00 291 2 581
22 537 3336 1145 18/02/2020 1398/11/29 Tehran – Damascus 8.00 4 2 8
23 537 3336 1263 21/02/2020 1398/12/02 Tehran – Damascus 21.00 11 2 21
24 537 3336 1134 23/02/2020 1398/12/04 Tehran – Damascus 326.00 163 2 326
25 537 3336 1672 26/02/2020 1398/12/07 Tehran – Damascus 500.00 250 2 500
26 537 3336 1764 27/02/2020 1398/12/08 Tehran – Damascus 1,080.00 540 2 1,080
27 537 3336 1775 27/02/2020 1398/12/08 Tehran – Damascus 1,000.00 500 2 1,000
28 537 3336 1753 27/02/2020 1398/12/08 Tehran – Damascus 1,010.00 505 2 1,010
29 537 3336 1742 27/02/2020 1398/12/08 Tehran – Damascus 1,090.00 545 2 1,090
30 537 3398 1942 27/02/2020 1398/12/08 Tehran – Damascus 426.00 213 2 426
Total 33,976.50 16,988 33,977


It seems as if we’ve found a company (the Hamrah company) that must be quite reputable, seeing as Mahan Air – a IATA listed airline – has granted them full autonomy and direct access to crucial airport systems.

However, when checking online it seems there is nothing listed as “The Hamrah Company” at all, even when searching for the many different spelling variations of the Hamrah company’s name that we’ve seen used in internal Mahan Air documentations.

This had left us questioning as to what this “Hamrah company” really is, and why exactly have they seemingly been ordering tens of thousands of anonymous tickets?

That confusion is what drove us to thoroughly pursue the “Hamrah company” lead through Mahan Air’s systems.

In large, it looked like Mahan employees rarely referenced details of the Hamrah company in spite of their widespread business with the airline. However, handily, we found some slips where informed employees let a few details go.

We knew Hamrah was suspicious, but once we found a document with the Hamrah company referred to as “The Defense Industries”, we started to suspect direct IRGC involvement.

Further assuring our suspicions were formal Hamrah Company documents addressed to “the respectable CEO, Mr. Golparast”, also referred to as sradar Golparast – a military rank used in the IRGC.

This ranked official, known to us only as “sradar Golparast”, was our next clue to the nature of Mahan’s unusual “Hamrah” business.

When searching online, we easily identified Golparast as a previously exposed IRGC member who is also listed as the owner of the notorious Qeshm Fars Air in the Iranian Registrar of Companies. Qeshm Fars is a known QF cover company, frequently used to transport munitions throughout the Middle East.
By this point it is clear to us that the Hamrah company is in fact another cover company used by the IRGC-QF to freely transport supplies and personnel under a civilian cover.

ifmat - Mahan Air cyberattack - Exposing dirty secrets of IRGC QF and further technical analysis

As we’ve seen, Mahan Air has security standards that are unconventional to say the least. We’ve found Mahan does keep records of its suspicious business with QF under the name “Hamrah”, and that this business is managed by sradar Golparast.
There was still a lot that we didn’t yet know, for example: what cargo exactly QF transports on these flights, how much of it, and where this cargo is transported to. Nor did we know who was involved in this cooperation, or what else it was used for.
These questions directed our research of the Mahan Air materials, and led us to the shocking findings we’ll be sharing with you over the coming days.

We found receipts for fully booked charter flights billed to The Hamrah company, which we’ve established is operated by Quds Force. These charter flights were booked with hundreds of unlisted passengers and operated on a weekly basis between Tehran, Damascus and Beirut.
Based on the destinations, these hundreds of passengers are most likely QF combatants sent to aid the Assad regime in Syria and Hizballah in Lebanon and waste more stolen wealth on funding terrorists and criminals.

ifmat - Mahan Air cyberattack - Exposing dirty secrets of IRGC QF and further technical analysis8

We’ve referenced the unsupervised “free hand” granted to the Hamrah company by Mahan Air, this apparently extends also to the Utab Gasht travel agency as we found documentation of their passengers repeatedly being permitted excess baggage by hundreds of Kilograms.

The organized and routine nature of Hamrah company excess baggage brings us to believe that QF are using these passengers to transport all sorts of cargo in their personal baggage.

It is obvious that IRGC passengers travelling to QF dominant regions would use that exception with malicious intent.


Name of God

Dear Mr. Seyed Hassani


Respectfully, an additional 200 kilos will be coordinated for free for Hojjat al-Islam and Muslims, Mr. Haj Agha Abdul Hussein Shukr and his esteemed deputy, Mr. Sheikh Hassan Awadha.

Please also send the ticket of Mr. Sheikh Hassan Awazeh.

Thanks – workers

From: fadak alzahraa [mailto:]

Sent: Wednesday, November 04, 2020 3:05 PM

To: Majid Kargaran;; fadak alzahraa

Subject: Re: To mr kargaran

In the name of God

Dear Mr. Workers


Regards for the extra burden of the name

1. Hojjatul Islam and Muslims Hajj Mr. Abdul Hussein Shukr 100 kg free

2. His deputy, Sheikh Hassan, free extra 100 kilos

Haj Agha’s plate and his deputy’s passport photo are emailed

Thanks for your cooperation

Fadak Al-Zahra Charity Cultural Institute, peace be upon him

On Wed, Nov 4, 2020, 8:27 AM Majid Kargaran – wrote:

Name of God

Dear Mr. Seyed Hassani


Yours sincerely, The flight to Beirut is scheduled for Thursday, November 5, 2020.

Please purchase the tickets from YouTube Patrol Company and send the picture of the tickets to coordinate the acceptance of 100 kg free for each passenger.

Thanks – workers

From: Majid Kargaran [mailto:]

Sent: Saturday, October 31, 2020 2:04 PM

To: ‘fadak fatimia’; ‘’

Subject: RE: To mr kargaran

Name of God

Dear Mr. Seyed Hassani


Respectfully, in case of flight, coordination will be done.

Thanks – workers

From: fadak fatimia [mailto:]

Sent: Saturday, October 31, 2020 1:31 PM

To: Majid Kargaran; fadak fatimia;

Subject: To mr kargaran

In the name of God, Most Gracious, Most Merciful

Dear Mr. Workers


Respectfully, we are waiting for the plate of Hajj Mr. Seyyed Abdolhossein Shokr to prepare the meeting schedule of the institute and settle the cost with the agency with a discount of 40% and an additional 200 kg.

Thanks for your cooperation

Fadak Al-Zahra Charity Cultural Institute, peace be upon him

Name of God

Dear Mr. Seyed Hassani


Respectfully, the flight is not scheduled for Thursday, if necessary, the necessary arrangements will be made for next week.

Please announce the names of the passengers.

Thanks – workers

From: fadak fatimia [mailto:]

Sent: Wednesday, October 28, 2020 9:43 AM

To: Majid Kargaran; fadak fatimia;

Subject: To mr kargaran

Dear Mr. Workers



Plate Tehran Beirut Tehran with Mahan flight on Thursday 5 November for Hajj Mr. Abdolhossein Shokr with a 40% discount and an additional 200 kg


Fadak Al-Zahra Charity Cultural Institute

ifmat - Mahan Air cyberattack - Exposing dirty secrets of IRGC QF and further technical analysis9

ifmat - Mahan Air cyberattack - Exposing dirty secrets of IRGC QF and further technical analysis10

If you hold any doubt to the nature of those extra pounds, take a look at what we found when searching for more QF cargo. These internal Mahan Air shipment bills detail dozens of tons of cargo shipped to Damascus and Lebanon by the Hamrah company every month.

Tourist and Travel Aviation Office


Travel Agency Utab Gasht.

Honorable Vice President of Mahan Airlines, Mr. Kargaran


Respectfully yours, During the previous negotiations and sending a letter regarding the increase of cargo on the route Tehran Beirut Tehran, while thanking you for confirming the increase of cargo on this route, please, considering the approaching end of the year, if possible, give the necessary orders to increase Load to the end

(Economy 40 kg – Business 50 kg)

Thank you in advance for your cooperation and assistance


Thanks and thanks 3 2 YouTube Patrol TEHRAN

ifmat - Mahan Air cyberattack - Exposing dirty secrets of IRGC QF and further technical analysis11

This correspondence is from Mahan Air’s CEO and founder, Hamid Arab-Nejad, to the commander of the Iranian Military’s Air Force. In its content, Arab-Nejad opens by reminding that his company (Mahan Air) operates according to the highest ideals and goals of the Islamic Republic, and that his company has been able to keep operating despite the American sanctions.

This second correspondence from a Mahan Air employee to the Iranian Ministry of Foreign Affairs states that Mahan Air’s flights to Afghanistan were halted because of their cooperation with QF and the sanctions this entailed. The Mahan Air employee goes as far as asking the Ministry for their help in evading these sanctions!

These two documents are prime examples of the deep cooperation between Mahan Air and QF and their efforts in evading financial sanctions.

One can only imagine, considering the numbers, what sort of supplies or ammunition QF are loading on these flights.

Keep in mind, all these illicit activities are performed under a civilian cover and within close proximity to civilian population and vulnerable facilities, doubtlessly jeopardizing air safety.

For those of you who are questioning QF’s motives in working with Mahan, take into account that, as is already known publicly, when QF operates similar transfers through known military affiliated aircraft (like with Fars Qeshm), their shipments are often targeted and attacked.

Through the process we’ve just exposed, it seems QF are avoiding direct attacks against their shipments by hiding them amongst airline passengers. And in doing so, along with Mahan Air, QF are constantly putting civilian lives at risk.

Amir Brigadier General Nasirzadeh – Honorable Commander of the Air Force of the Army of the Islamic Republic of Iran
Subject: Request for assistance in adjusting the price of services of Shahid Lashgari hunting base


Respectfully, as you are aware, Mahan Airlines, based on its inherent duty and with firm belief in the lofty goals of the Islamic Republic, has served the honorable people of Iran in the aviation industry and as a company that plays a key and strategic role. In domestic and international air transport, the country has always been at the forefront of US sanctions and destructive programs, but despite the oppressive sanctions and the consequent problems caused by incurring costs and material losses and There has been a lot of morale for this company and its managers, it has established domestic and international flight routes, which in some cases, it was not possible for other airlines to perform these operations, or for economic reasons in economically deprived areas. Is.
In order to serve and perform operational duties and due to sanctions and technical and operational restrictions, thanks to God and based on the knowledge and efforts of the youth of this border and the web, to perform their repair work within the standards approved by international organizations Inside the country, following the important capacity of the centers under its supervision, the esteemed command at Mehrabad Airport in order to meet the technical needs, including repairs and engine management and aircraft parking in the places belonging to the hunting hunting base of Martyr Major General Pilot Hussein Lashgari uses that this issue has been done between the parties during the relevant annual agreements, and to date, the sincere cooperation and assistance of that respected base has been the key to the interactions between the parties.
Since the costs related to the lease of the aircraft park in the area of Shahid Transportation Hunting Base, Pilot Hossein Lashgari, Mehrabad Airport (through the acquisition of land benefits in the country and not foreign resources, equipment and facilities) are reviewed every year. And is announced in dollars, regardless of the current monetary and banking laws of the country (paragraph c of Article 2 of the Monetary and Banking Law of the country, letter No. 249936/97 dated 07/18/1397 of the Public Relations Office of the Central Bank of the Islamic Republic of Iran and other financial regulations) Explicitly considering the country’s currency as the basis of the country’s financial exchanges, the significant increase in the value of the dollar in the last year also multiplies the costs associated with these contracts for the company. Now, this issue has multiplied by increasing the tariff (dollar) for providing services as described in the annual contracts, so that the company is committed to pay the costs of increasing the annual dollar tariff of contracts and also suffers from financial pressure due to multiplication. The rial value of each dollar. Also, regarding the agreement to provide services related to the transfer of location for motorcycling, the increase in tariffs and the amount of Rials in the contract compared to previous years has been significant.
Given the above and taking into account the fact that Mahan Airlines in addition to foreign sanctions, at the present time the economic situation of the whole world and consequently our beloved country Iran and especially the aviation industry due to the Corona virus to Severely affected, the sympathetic support of the esteemed Command and other relevant bodies in this field will significantly contribute to the implementation process and solve the problems of this complex.
Therefore, the esteemed command requests that, if possible, in order to adjust the service rates that can be provided by the groups under the command of that official, including the transport hunting base of Martyr Major General Pilot Hossein Lashgari, the US dollar should not be used as a basis for domestic airlines. Provide services to this company, according to the specific conditions ahead, order the necessary orders.
I thank the esteemed commander in advance for his attention and good management, and I ask God Almighty for the increasing success and forgiveness of that group of servants.

with respect
Hamid Arabnejad
Managing Director

Dear Ministry of Foreign Affairs
While respecting the memory of General Haj Qassem Soleimani and his comrades, on January 19, 2017, a delegation from the US Embassy in Afghanistan referred to the Afghan Ministry of Aviation and during a meeting stated that due to the cooperation of the airlines With the Islamic Revolutionary Guard Corps and the Quds Force regarding the supply of weapons and ammunition as well as sending troops from Afghanistan to Syria, necessary measures should be taken to prevent the flights of this airline and other Iranian companies to Afghanistan and the licenses of these companies should be revoked. The matter has been reported to the National Security Council of Afghanistan, at which time the company has resolved the issue through its consultations with the National Security Council and the relevant committee. The US Embassy in Afghanistan is following up.
Due to the cowardly sanctions imposed by the United States and the problems caused by this, the company is operating and providing services with many problems, but unfortunately we have had to cancel some of our flights, which has led to the revocation of the flight license of this company. It is no longer possible to retake it, so it seems that we have self-imposed sanctions, which is exactly what the United States is looking for.
In these circumstances, and in view of the above, we need more support and cooperation from the Ministry of Foreign Affairs, as well as the Iranian Embassy in Afghanistan, to take appropriate decisions to prevent the reduction of flights and subsequent issues.
The steps will be announced in the presence for information and appropriate actions.

We have much more to expose on this story, including the names, the numbers, and much more proof of the malicious activities directed by Quds Force and Mahan Air.

Gold and weapons being sent out of Iran to foreign militias. The regime tells us there is no money, it shoots protesters and at same time #IRGC Quds Force sends our wealth to Syria, Yemen and Afghanistan to kill others

ifmat - Mahan Air cyberattack - Exposing dirty secrets of IRGC QF and further technical analysis12

Source » 0x7c3.blogspot

Source » cybershafarat