Iranian Hackers Target Women Involved in Human Rights and Middle East Politics

Iranian state-sponsored actors are continuing to engage in social engineering campaigns targeting researchers by impersonating a U.S. think tank.

“Notably the targets in this instance were all women who are actively involved in political affairs and human rights in the Middle East region,” Secureworks Counter Threat Unit (CTU) said in a report shared with The Hacker News.

The cybersecurity company attributed the activity to a hacking group it tracks as Cobalt Illusion, and which is also known by the names APT35, Charming Kitten, ITG18, Phosphorus, TA453, and Yellow Garuda.

The targeting of academics, activists, diplomats, journalists, politicians, and researchers by the threat actor has been well-documented over the years.

The group is suspected to be operating on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC) and has exhibited a pattern of using fake personas to establish contact with individuals who are of strategic interest to the government.

“It is common for Cobalt Illusion to interact with its targets multiple times over different messaging platforms,” SecureWorks said. “The threat actors first send benign links and documents to build rapport. They then send a malicious link or document to phish credentials for systems that Cobalt Illusion seeks to access.”

Chief among its tactics include leveraging credential harvesting to gain control of victims’ mailboxes as well as employing custom tools like HYPERSCRAPE (aka EmailDownloader) to steal data from Gmail, Yahoo!, and Microsoft Outlook accounts using the stolen passwords.

Another bespoke malware linked to the group is a C++-based Telegram “grabber” tool that facilitates data harvesting on a large scale from Telegram accounts after obtaining the target’s credentials.

The latest activity involves the adversary passing off as an employee of the Atlantic Council, a U.S.-based think tank, and reaching out to political affairs and human rights researchers under the pretext of contributing to a report.

Are you aware of the risks associated with third-party app access to your company’s SaaS apps? Join our webinar to learn about the types of permissions being granted and how to minimize risk.