I'm the ZDNet reporter who wrote the story.

What in God's green earth are you talking about?

The article says the hacker's server is rented from an Iranian company. And yes, despite your ignorant claims, the IP address is the C2 server.

What imagined propaganda are you talking about?

So yeah, factually correct maybe, but very biased by selective editing. That's textbook propaganda. If you don't see that you're part of it.

I read the article a few times and I don't think there is any anti-Iran sentiment in it at all.

Anyway, my immediate thought (before the article got to the teen) was that this attack might have be spillover from an attack by the US on Iranian systems. Or at least an hint at how exposed Iran's digital infrastructure might be to future attack from the US in light of recent events. Or maybe how this will get Iran to tighten up it's digital infrastructure before such an attack from the US could happen.

I also immediately didn't think that the origin of Cashdollar's attack had anything to do with the origin of the creator or perpetrator.

But maybe like me they turn on a VPN and are now operating out of "China" or "Turkey" or, gasp, "San Francisco".

I think SF would be a good look to potential investors.

Probably just a typo but in case not: interpreted.