{"id":4794,"date":"2024-04-02T12:53:14","date_gmt":"2024-04-02T12:53:14","guid":{"rendered":"https:\/\/filter.watch\/en\/?p=4794"},"modified":"2024-04-02T12:59:53","modified_gmt":"2024-04-02T12:59:53","slug":"hacker-watch-feb-2024-art-of-deception","status":"publish","type":"post","link":"https:\/\/filter.watch\/english\/2024\/04\/02\/hacker-watch-feb-2024-art-of-deception\/","title":{"rendered":"The Art of Deception:"},"content":{"rendered":"

More than a year since the \u201cWomen, Life, Freedom\u201d protests, the Miaan Group has uncovered that hackers, with ties to Iran, are conducting an unprecedentedly broad and coordinated campaign of impersonation and phishing. This campaign is aimed at civil society targets, affecting individuals both within and beyond Iran\u2019s borders.\u00a0<\/span><\/p>\n

In 2023, Miaan <\/span>released<\/span><\/a> a report that investigated and documented more than a hundred cyberattacks targeting journalists, civil society activists, and advocates for the rights of ethnic and religious minorities..<\/span><\/p>\n

While conducting this research, Miaan Group <\/span>observed<\/span><\/a> that the effectiveness of the impersonation and phishing campaign targeting civil society figures and organizations, as outlined in our November 30 report, has encouraged cyber operatives aligned with Iran to adopt these tactics on a broader scale.<\/span><\/p>\n

Miaan\u2019s findings show that the hacker groups engaging in impersonation and phishing are backed by the Iranian government. These actors impersonate real people employed at credible international think tanks and institutions to communicate with their victims. A report by Microsoft <\/span>refers<\/span><\/a> to this same tactic.\u00a0<\/span><\/p>\n

Executive Summary<\/span><\/h4>\n

The tactic employed by the attackers consisted of impersonating a real person working at a credible organization to start a conversation about a fabricated event, closely resembling a real, documented case. After winning the subject\u2019s trust, the attackers sent them a phishing link with a manipulated name.<\/span><\/p>\n

The attackers did not rest with the target\u2019s personal information. After gaining control of the victim\u2019s email account, they sent emails with a phishing link to others in their network to access those contacts\u2019 information in turn.<\/span><\/p>\n

Key Findings<\/span><\/h4>\n
    \n
  1. The cyberattacks were directed at a human rights and education group. This group is known for conducting classes on civil, labor, and human rights, catering to the general populace and civil activists, some of whom may be located in Iran.<\/span><\/li>\n
  2. The attackers made use of social engineering. They sent convincing and meticulous messages in English to lure victims. The individuals they impersonated were real, and discoverable through internet searches. The references made in their messages were accurate, and the events in Iran they referred to were relevant, understandable, and convincing for targets.<\/span><\/li>\n
  3. The attackers timed their actions carefully. They sent similar messages to every member of the organization on a Saturday, a day when victims were less likely to communicate during typical business hours to collectively devise a response.. This timing allowed the attackers to exert emotional pressure about the false scenario they depicted to convince the victim to click the phishing link (presented as, for example, \u201ca Google Drive containing information\u201d).\u00a0<\/span><\/li>\n
  4. These attacks confirm previous findings that Iran has improved its open-source intelligence operations. The attackers researched their targets and found information such as names, institutional affiliations, activities, and interests. They then used this to craft more effective and convincing attacks. In Microsoft\u2019s recent report, Iran was named as one the countries (beside Russia, China, and North Korea) <\/span>accused<\/span><\/a> of using LLM artificial intelligence to identify the jobs, locations, and relationships of dissidents.<\/span><\/li>\n
  5. The attackers first used WhatsApp to initiate communication with the victim. After this victim was hacked, they followed up with others in their contact network by way of email.\u00a0<\/span><\/li>\n
  6. After hacking the victim\u2019s account, the attacks attempted to access other accounts connected to it. They were thus able to access the victim\u2019s LinkedIn profile.<\/span><\/li>\n<\/ol>\n

    Incident Analysis<\/span><\/h4>\n

    On January 9, 2024, an individual purporting to be \u201cJennifer Gould\u201d sent a message to most of the members of an educational organization. They claimed to have received medical information from sources in Iran about a 21-year-old girl who had been seriously physically abused by Islamic Republic forces. The individual introduced themselves as a member of RAND, and said they wanted to share the information with the recipients.<\/span><\/p>\n

    \"\"<\/a><\/p>\n

    When we <\/span>searched<\/span><\/a> \u201cJennifer Gould\u201d online, we found the details of a real individual <\/span>employed<\/span><\/a> by RAND (a non-profit research organization based in the US).\u00a0 Available information indicates Ms. Gould is Vice President, Chief of Staff at RAND.<\/span>\"\"<\/a><\/p>\n

    In their fabricated account of the physically abused girl, the attackers <\/span>borrowed<\/span><\/a> from the story of Armita Geravand, implying an association without referring to her directly.<\/span><\/p>\n

    The attackers used a phishing link that appeared to belong to a Google Doc to show that it was safe. In this way, they were able to deceive their victim and gain access to their email.\u00a0<\/span><\/p>\n

    After accessing the victim\u2019s email, the attackers tried to gain entry into accounts associated with it. They were able to hack the victim\u2019s LinkedIn page in this way.<\/span><\/p>\n

    An investigation of the device connected to the LinkedIn account before it was secured, as well as an investigation of the phishing link, showed that the attackers used a shared \u201cIP range\u201d \u2013 a common location and device \u2013 to access and hack the victim.<\/span><\/p>\n

    After gaining access to the victim\u2019s email account, the attackers sent similar messages to everyone in their network. The messages told of an injured 21-year-old girl, and the attackers claimed to have documents pertaining to her hospitalization.<\/span><\/p>\n

    A phishing link accompanied the message. In this round, the attackers impersonated the initial hack victim, whose familiarity to the second set of targets increased chances of success.<\/span>\"\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    More than a year since the \u201cWomen, Life, Freedom\u201d protests, the Miaan Group has uncovered that hackers, with ties to Iran, are conducting an unprecedentedly broad and coordinated campaign of impersonation and phishing. This campaign is aimed at civil society targets, affecting individuals both within and beyond Iran\u2019s borders.\u00a0 In 2023, Miaan released a reportContinue reading \"The Art of Deception:\"<\/span><\/a><\/p>\n","protected":false},"author":23,"featured_media":4805,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[113],"tags":[163,161,162,159,145,143],"class_list":["post-4794","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-threat-reports","tag-art-of-deception","tag-cybersecurity","tag-fishing","tag-internet","tag-iran-cyber-hack","tag-iran-hacks","entry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t