Sitting in the archives of the cybersecurity service VirusTotal is an artifact of a piece of malware sent in late 2012 to the Iranian journalist Vahid Pour Ostad. Pour Ostad’s history is emblematic of many prominent journalists of his generation. After a brief period of relative openness that allowed a vibrant press to flourish at the turn of the century, hardline elements of the Iranian government responded to these changes by prosecuting journalists and closing newspapers. Pour Ostad paid a high cost for his critical investigations of the country’s legal system: he was arrested multiple times, fired from newspapers, and ultimately forced to leave Iran.
The malware in question was sent by a Ministry of Intelligence agent that had interrogated Pour Ostad, attached as a threat and leveraging private records that would have been available only to someone collaborating with the government. By that time, Pour Ostad