Iranian Cyber Espionage Group Targets High-Profile Users in Israel and the U.S., New Google Report Reveals
The targets included current and former and military government officials, political campaigns, diplomats, think tank employees, NGOs, and academic institutes
REUTERS/Dado Ruvic/Illustration
Iran targeted high-profile users in Israel and the US, including current and former and military government officials, political campaigns, diplomats, think tank employees, NGOs, and academic institutes. This, according to a new report by Google’s Threat Analysis Group (TAG).
TAG researched APT42, associated with Iran’s Islamic Revolutionary Guard Corps (IRGC), which launched targeted phishing campaigns against Israel and Israeli targets, as well as accounts associated with the U.S. presidential election.
The report notes that In April, APT42 intensified their targeting of users based in Israel, seeking out people with connections to the Israeli military and defense sector, as well as diplomats, academics, and NGOs. Some of the tactics used by the group as part of their email phishing campaigns, according to TAG, are hosting malware, phishing pages, and malicious redirects, while trying to abuse services like Google, Dropbox and others.
For example, the TAG team reports that it took down multiple APT42-created Google Sites pages that masqueraded as a petition from the legitimate Jewish Agency for Israel calling on the Israeli government to enter into mediation to end the conflict. In other cases, the malicious group attempted to use social engineering to target former senior Israeli military officials and an aerospace executive by sending emails masquerading as a journalist requesting comment on the recent air strikes.
The targets included current and former and military government officials, political campaigns, diplomats, think tank employees, NGOs, and academic institutes
REUTERS/Dado Ruvic/Illustration
Iran targeted high-profile users in Israel and the US, including current and former and military government officials, political campaigns, diplomats, think tank employees, NGOs, and academic institutes. This, according to a new report by Google’s Threat Analysis Group (TAG).
TAG researched APT42, associated with Iran’s Islamic Revolutionary Guard Corps (IRGC), which launched targeted phishing campaigns against Israel and Israeli targets, as well as accounts associated with the U.S. presidential election.
The report notes that In April, APT42 intensified their targeting of users based in Israel, seeking out people with connections to the Israeli military and defense sector, as well as diplomats, academics, and NGOs. Some of the tactics used by the group as part of their email phishing campaigns, according to TAG, are hosting malware, phishing pages, and malicious redirects, while trying to abuse services like Google, Dropbox and others.
For example, the TAG team reports that it took down multiple APT42-created Google Sites pages that masqueraded as a petition from the legitimate Jewish Agency for Israel calling on the Israeli government to enter into mediation to end the conflict. In other cases, the malicious group attempted to use social engineering to target former senior Israeli military officials and an aerospace executive by sending emails masquerading as a journalist requesting comment on the recent air strikes.
