Security researchers have uncovered a new Iranian government-backed cyber espionage operation aimed at rooting out female human rights activists who are causing trouble for the regime.
Secureworks has properly released an analysis of its latest Cobalt Illusion campaign the day after International Women’s Day.
The group is suspected of operating on behalf of various Iranian government agencies and the Intelligence Service of the Islamic Revolutionary Guard Corps (IRGC-IO).
Target was typically contacted by a fake Twitter user, “Sara Shokouhi,” to talk about an opportunity to contribute to an article for the Atlantic Council, a think tank.
Attackers then attempt to phish for credentials, possibly via malicious links, or deploy malware to targeted machines and devices.
“Phishing and mass data collection are key tactics of Cobalt Illusion. We have seen this occur in several forms in recent years. , human-focused intelligence gathering, such as extracting content such as physical location,” said Rafe Pilling, Principal Scientist at Secureworks.
“This information is likely mixed with other sources and is being used to inform military and security operations by Iran, both foreign and domestic. Or it could involve targeted killings.”
All those targeted in the campaign have been identified as women who are actively involved in political affairs and human rights in the Middle East, the report claims.
The fake @SaShokouhi Twitter account went to great lengths to appear sympathetic to its target’s cause. It appears to have been involved in tweeting posts in support of the massive Mercer Amini protests in Iran, including one containing harrowing content such as images of dead children and physical abuse suffered by protesters.
“Attackers create fake people and use them to build trust with their targets, then phish their credentials or deploy malware to their devices,” Pilling explained. To do.
“Having a persuasive persona is an important part of this tactic. In this case, the persona of Sarah Shokowhi used images stolen from the Instagram account of a Russian-based psychologist and tarot card reader. I can confirm that it was created using
