Iranian Cyber Actors Targeting Personal Accounts to Support Operations
Essential information
- Published
- 30/09/2024 10:45
- Modified
- 30/09/2024 10:52
- Tags
- 2024-09-30 credential-theft impersonation iran phishing political campaigns social engineering two-factor authentication
- Related entities
- 65 observables, 1 intrusion sets (apt), 11 techniques (mitre), 5 others
Description
Cyber actors working for Iran's Islamic Revolutionary Guard Corps (IRGC) are targeting individuals connected to Iranian and Middle Eastern affairs, including government officials, think tank personnel, journalists, activists, and lobbyists. They use social engineering techniques, impersonating contacts or email providers to gain access to personal and business accounts. The actors attempt to build rapport before sending malicious links to capture credentials. Targets may be prompted to provide two-factor authentication codes or interact with phone notifications. Recent activity has also focused on persons associated with US political campaigns. The cyber actors tailor their approach to include areas relevant to the target, such as interview requests, conference invitations, or foreign policy discussions. Indicators of compromise include suspicious logins, creation of message forwarding rules, and exfiltration of messages.