Israel Busts Iran’s Phishing Network Active In LinkedIn
Israel’s Shin Bet internal intelligence agency says it has thwarted a phishing campaign by Iran targeting primarily Israeli civil servants and researchers.
Israel’s Shin Bet internal intelligence agency says it has thwarted a phishing campaign by Iran targeting primarily Israeli civil servants and researchers.
On Sunday, the agency disclosed some information about the LinkedIn-based campaign to infect the victims’ computers with malicious software and gather information.
The Iranians created false profiles posing as real Israeli citizens with whom the targets may have had personal or professional interactions. Then, they initiated conversations on LinkedIn and continued correspondence through email, according to the agency.
During their correspondence, the impostors would send an invitation to a conference or other digital files of interest, such as a study or article. Clicking on these links would then infect the recipient's computer with a malicious file that would grant the Iranian entity comprehensive access to the compromised system, enabling remote takeover and complete exposure of the information contained within.
Israeli-based news channel i24NEWS cited Shin Bet as noting that he hackers originally compiled the necessary information for the LinkedIn profiles from social media networks, allowing them to establish a connection and then engage in correspondence tailored to the target's specific interests.
The campaign is just the latest in a series of similar operations by the regime’s cyber agents against Tehran’s archnemesis Israel. Iran-sponsored cyberspies have recently boosted their techniques, using fake personas of real people to add credibility to the phishing emails designed to deliver malware.
Mehdi Saremifar, a Canada-based sci-tech journalist, told Iran International on Sunday that the cyber-attacks by the Iranian regime’s hackers during the past several years indicate that several organizations or institutions in Iran are coordinating their efforts for such campaigns. He says the country’s intelligence ministry and the cyber army of the Revolutionary Guards are among the units involved in the regime’s warfare in cyberspace.
According to Saremifar, Iran’s attacks are mainly aimed at phishing and getting ransom as well as some for military intel, a case of which led to a drone attack against an oil tanker associated with an Israeli billionaire off the coast of Oman in November 2022.
According to a 2022 report by Security firm Proofpoint, Iran-aligned agents deployed a social engineering impersonation technique, informally called Multi-Persona Impersonation, in mid-2022 in which the threat actor uses at least two stolen or hijacked personas on a single email thread to convince targets of the legitimacy of the campaign. The personas used are real people that the target knows and trusts.
Last August, Meta, formerly the Facebook company, removed at least two Iranian cyberespionage groups that were targeting academics, activists, journalists and other victims. Also in 2022, Iranian hackers -- named Sharp Boys -- targeted several travel booking sites of an Israeli company and stolen personal information of more than 300,000 Israelis.
Earlier in the year, researchers at CheckPoint's Incident Response Team said an Iran-linked group calling itself Moneybird has deployed a ransomware against Israeli organizations.
Masih Mohajeri, a cleric who is the editor of Jomhuriye Eslami (Islamic Republic) conservative newspaper in Iran told a local website that “merchants of sanctions” in Iran who always tried to sabotage relations with the West, exposed Malley, who has been suspended from the State Department and his security clearance is under investigation.
‘Merchants of sanctions’ in Iranian jargon are those in the power structure within the regime who reap profits from foreign sanctions, by using Iran’s isolation to set up their business monopolies in the country. Chief among them are allegedly senior officers of the Revolutionary Guard and their circle of hardliners, who currently control the parliament, the presidential administration, and the fearsome judiciary.
Although Mohajeri belongs to the first generation of Islamist revolutionaries who overthrew the monarchy in 1979, he is known as a relatively independent elder, who occasionally criticizes officials and extremists within the regime.
“Malley held negotiations with some Iranian individuals, in such a way that problems were reaching a point [of resolution], which perhaps even American officials were not fully aware. But domestic hardliners and merchants of sanctions exposed the information related to these talks, to sabotage them,” Mohajeri was quoted as saying. He did not claim to have any insider information for accusing the hardliners, but his full interview has not yet been published.
Mohajeri went on to accuse hardliners of a series of malign activities within Iran and interference in domestic politics.
Iran International first reported June 29 that Malley was suspended from his position as US envoy for Iran, his security clearance was suspended and he was under investigation related to his handling of classified documents. The Involvement of the Federal Bureau of Investigation was also reported, although until now no official details have been announced, except that Malley is on “unpaid leave.”
Biden administration officials Friday went to Capitol Hill to brief members of the House Foreign Affairs Committee, but they revealed nothing about why Malley was suspended and what is the investigation about. According to the committee chairman Rep, Michael McCaul (R-TX), officials claimed that due to the US Privacy Act they could divulge any information while the investigation is still ongoing.
To add to the mystery, Tehran Times an Iranian regime mouthpiece has extensively reported on Malley’s saga, appearing to have some insider information. The paper reported the exact date of Malley's suspension as April 21, when Malley was informed by the Diplomatic Security Department that due to his not having maintained classified documents, his security clearance was suspended. No one else had an exact date as to when Malley’s security clearance was suspended.
Benny Avni, a columnist at the New York Sun commented about the briefing, pointing out that “the briefers apparently shed no light on Mr. Malley’s mysterious removal from his post, the stripping of his security clearance, or the purging of his official Twitter account.”
He also quoted Jason Brodsky, the policy director at United Against a Nuclear Iran as saying that the State Department has a communication problem. “They can’t announce that the nuclear deal is dead. They can’t announce there is a deal. And they can’t provide anything on Malley. Their dodge, duck, and weave act is awkward.”
The National Press Club, the world’s leading professional organization for journalists with a 115-year history, named Niloofar Hamedi and Elaheh Mohammadi as the 2023 international honorees for the Club’s highest honor for press freedom, the John Aubuchon Award.
Iran International’s Bozorgmehr Sharafedin – previously with Reuters – was also among the winners of the prestigious National Press Club Journalism Awards, winning Edwin M. Hood Award for Diplomatic Correspondence for co-authoring investigative report “America’s Throwaway Spies: How the CIA failed Iranian informants in its secret war with Tehran.” He wrote the Reuters Special Report with Joel Schectman in 2022.
“This has been a year of momentous struggle for press freedom in Iran. According to studies, as many as 90 journalists were arrested during the protests that followed the murder of Mahsa Amini by the Iranian morality police. Our honorees: Niloofar and Elaheh, created some of the journalism that told Mahsa’s story and captured the hearts of protestors and especially Iranian women,” read a Friday statement by the club.
The two journalists – from reformist Iranian dailies Shargh and Ham-Mihan – have been imprisoned for about 300 days because the regime blames them for the nationwide protests that followed the death of the 22-year-old woman.
Since her tragic death, Amini has become the icon of Women, Life, Liberty movement, the boldest uprising the regime has faced since its establishment.
Hamedi, managed to visit Mahsa Amini in Tehran’s Kasra hospital and broke the news of her grave condition after being taken into the custody of the 'morality' police three days earlier for wearing her hijab “improperly”. Amini was in a coma with severe head wounds at the time and Hamedi’s photo of Mahsa’s parents hugging and crying went viral. She was arrested just days later. Mohammadi, likewise, managed to travel to Amini’s hometown of Saqqez in western Iran to report on her funeral on September 17, which thousands attended. She was arrested for her coverage of Mahsa’s funeral and the unrest around it.
The Islamic Republic is known to crack down on people who reveal corruption and wrongdoing in Iran, with authorities announcing that reporting the crimes is worse than the crimes themselves.
The two journalists, whose second court hearing was held this week, have been charged with propaganda against the regime and conspiracy to commit acts against national security, which could bear death sentences. The duo have become symbols of free journalism and resistance against the regime’s oppressive rule, with a large number of people calling for freedom in their posts.
The National Press Club added in the statement, “In the current climate the global journalism community has worked hard to raise awareness of Niloofar and Elaheh. They have been named to Time magazine’s Time 100 Most Influential People of 2023, among other recognition,” highlighting that “This Aubuchon award is being announced at this time to help draw attention to these two brave women and to protest their brutal treatment.” “We adamantly call for their safety and release.”
The outlet affiliated to the ultraconservative Paydari Front wrote that “reliable information” suggests the two “participated in training courses of institutions that seek the overthrow [of the Islamic Republic] and had connections with foreign intelligence services,”
Iran's intelligence ministry and SAS, the intelligence organization of the Revolutionary Guards (IRGC) even accused Mohammadi and Hamedi of being CIA agents. “Using the cover of a journalist, she was one of the first people who arrived at the hospital and provoked the relatives of the deceased and published targeted news,” they said in a joint statement.
Ghezeljeh told reporters in Tehran that the economic crisis is the outcome of inaction by parliament over the country’s development plans. This comes while some experts say funds allocated to development plans are often spent on propaganda or military projects.
The lawmaker also attributed part of the problem to the fact that Iranian officials including presidents lack long-term vision. For the same reason, he said, only 30 percent of six development plans since the establishment of the Islamic Republic have been implemented.
Meanwhile, another Iranian lawmaker, Alireza Mobaleghi, said in an unprecedented statement on Thursday that officials, including members of parliament, are ashamed and embarrassed for the difficult economic situation and have no convincing answers to the people’s grievances.
He added that the embarrassment is more serious for those like him who represent the people in the underprivileged parts of the country like his constituency in Kouhdasht in southwest Iran.
Iran’s struggling economy has faced a worsening crisis since 2018 when the United States withdrew from the JCPOA nuclear accord and imposed sanctions. Annual inflation is above 50 percent and ordinary salaries are less than half of what families need for basic necessities.
But no politician within the regime dares to criticize Supreme Leader Ali Khamenei who is the top decision maker in matters of security and foreign policy and ultimately responsible for policies that have isolated the country.
The lawmaker further charged that some government managers and decision makers are not efficient enough for their jobs and that is what causes part of the problem. There are individuals who might be good speakers and know a lot of theories, but they cannot do their job necessarily.
“There is no justification for using such individuals in the government although some of them might have good academic credentials,” he said. He added that Iran is involved in a full-fledged economic war, and it needs highly capable officials.
Mobaleghi maintained that some members of parliament have presented serious demands to the government to change its senior and mid-ranking managers in a bid to improve the country’s situation. He further warned that the parliament might consider impeaching some of Iran’s cabinet ministers.
Despite the problems, some hardliner lawmakers such as Fereidoun Abbasi do not seem to take the issue seriously. Abbasi said on Thursday, “Iranians are potentially rich, but if their wealth does not positively impact the country’s economy, that is not the government’s fault. It is something to do with the ongoing economic war.”
Economic war is Iranian officials’ jargon for US sanctions against the Islamic Republic government.
In fact, nepotism, corruption and political considerations play a vital role in the economy, which is mostly controlled by the government. Conditions for private investments are not encouraging and many have taken their capital abroad. Official statements show that tens of billions of dollars have been taken out in the past decade.
Abbasi charged that “the lawmakers who speak about economic shortcomings in their constituencies and state that the people are poor and underprivileged are simply trying to justify their inaction.
The hardliner politician added, “Instead of highlighting the country’s problems, lawmakers should strive to solve them,” shifting the blame from systemic problems to members of parliament.
Meanwhile, in an interview with Khabar Online website, Labor market Expert Hamid Haj Esmaili criticized government officials for providing false statistics to the media to pretend that they have tackled problems such as unemployment and inflation. He said there are serious conflicts between the figures presented by state officials and statistics worked out by specialised agencies.