Espionage by 'Probably Iranian' Hackers on LinkedIn

A group of 'probably Iranian' hackers has utilized a complex network of user profiles on the LinkedIn social media platform to spy on targets worldwide, including in the United States. A report published by Dell's security unit and reflected in CNN states that the hackers' fake profiles are divided into two groups: the first group presented themselves as collaborators with various governments and international companies, while the second group lent legitimacy to the first group through various means. This report, published on Wednesday, October 7, identifies the group behind these profiles as 'TJ 2889' and indicates that there is strong circumstantial evidence suggesting this group operated from Iran. The computer domains used by these hackers match those of previous cyber attacks attributed to Iran, and their targets included countries in the Middle East, Arab nations, North Africa, and the United States. Dell researchers noted that these cyber spies often posed as associates of major international companies such as Northrop Grumman, General Motors, Teledyne Technologies, Airbus, and Doosan. It appears that these hackers have been successful, as over 200 real LinkedIn users interacted with 25 fake users. Most targets were located in Saudi Arabia, Qatar, the United Arab Emirates, and Pakistan, with 12 targets in the United States. Many of the targets operated in telecommunications, defense, and government sectors. Iran, alongside China, Russia, and North Korea, is defined as one of the biggest threats to the United States in the cyber domain.