The Middle East Media Research Institute (MEMRI) Cyber & Jihad Lab (CJL) project published a new report on July 20, 2026 about an Iran-aligned Iraqi hacking team promoting cybercrime services.
On July 20, 2026, a Telegram channel associated with a hacking group frequently linked to Iraq’s so-called Islamic Resistance shared a promotional post advertising an affiliate program for a cybercrime-related service known as “Cypher Services.”
The post, forwarded from another Telegram account, showcases the Cypher AutoBuy Bot, an automated Telegram-based sales platform that appears to facilitate the purchase, renewal, and management of subscription-based cyber services.
The decision by the channel to share the Cypher Services advertisement is noteworthy because it demonstrates continued interaction between ideologically motivated hacking groups and the broader cybercriminal services marketplace.
According to post, the bot includes options labeled “Purchase Plan,” “Purchase Addons,” “Renew Plan,” and “View Plan.” The images also highlight a referral system that provides users with commission payments to recruit new customers.
The promotional message states that participants can earn 15% commission on every purchase made through their referral link. The post displays referral statistics showing one referral, €1.50 in earnings, and a €1.50 account balance, suggesting that commissions are paid in euros or euro-equivalent cryptocurrency value.
The advertisement specifically targets prospective promoters, stating:
“Cypher AutoBuy Bot now allows you to invite people, and if they buy, you get commission.”
The message further claims that commissions are paid in cryptocurrency rather than being credited toward future service subscriptions. The operators also offer incentives for new promoters, including free service plans after their first successful sale.
The post includes links to several Telegram resources associated with Cypher Services, including a main channel, purchasing portal, AutoBuy bot, support resources, and a website.
