British Cyber Agency Warns of Russian and Iranian Hackers Targeting Key Industries

Cyber Security

Jan 27, 2023Ravie LakshmananNation-State-Sponsored Attacks

The U.K. National Cyber Security Centre (NCSC) on Thursday warned of spear-phishing attacks mounted by Russian and Iranian state-sponsored actors for information-gathering operations.

“The attacks are not aimed at the general public but targets in specified sectors, including academia, defense, government organizations, NGOs, think tanks, as well as politicians, journalists and activists,” the NCSC said.

The agency attributed the intrusions to SEABORGIUM (aka Callisto, COLDRIVER, and TA446) and APT42 (aka ITG18, TA453, and Yellow Garuda). The similarities in the modus operandi aside, there is no evidence the two groups are collaborating with each other.

The activity is typical of spear-phishing campaigns, where the threat actors send messages tailored to the targets, while also taking enough time to research their interests and identify their social and professional circles.

The initial contact is designed to appear innocuous in an attempt to gain their trust and can go on for weeks before proceeding to the exploitation phase. This takes the form of malicious links that can lead to credential theft and onward compromise, including data exfiltration.

To maintain the ruse, the adversarial crews are said to have created bogus profiles on social media platforms to impersonate field experts and journalists to trick victims into opening the links.

The stolen credentials are then used to log in to targets’ email accounts and access sensitive information, in addition to setting up mail-forwarding rules to maintain continued visibility into victim correspondence.

The Russian state-sponsored SEABORGIUM group has a history of establishing fake login pages mimicking legitimate defense companies and nuclear research labs to pull off its credential harvesting attacks.

APT42, which operates as the espionage arm of Iran’s Islamic Revolutionary Guard Corps (IRGC), is said to share overlaps with PHOSPHORUS and is part of a larger group tracked as Charming Kitten.

The threat actor, like SEABORGIUM, is known to masquerade as journalists, research institutes, and think tanks to engage with its targets using an ever-changing arsenal of tools and tactics to accommodate IRGC’s evolving priorities.

Enterprise security firm Proofpoint, in December 2022, disclosed the group’s “use of compromised accounts, malware, and confrontational lures to go after targets with a range of backgrounds from medical researchers to realtors to travel agencies,” calling it a deviation from the “expected phishing activity.”

Furthermore, a notable aspect of these campaigns is the use of targets’ personal email addresses, likely as a means to circumvent security controls put in place on corporate networks.

“These campaigns by threat actors based in Russia and Iran continue to ruthlessly pursue their targets in an attempt to steal online credentials and compromise potentially sensitive systems,” Paul Chichester, NCSC director of operations, said.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Products You May Like

Articles You May Like

Honor Patent Application Hints at Device With Multi-Directional Foldable Screen
Gemini 1.5 Flash-8B With Lowest Token Cost Among Gemini Family Now Available
Samsung Galaxy S25 Ultra Leaked Dummy Units Hint at Slimmer Design With Rounded Corners
Inside one of the first all-female hacker houses in San Francisco
Lords of the Fallen Sequel Is in Full Production, Will Be Announced in 2025

Leave a Reply

Your email address will not be published. Required fields are marked *