Iranian Hacking Group 'APT 42' Uses Advanced Social Engineering Schemes for Espionage

Research results from a cybersecurity company indicate that the Iranian hacking group 'APT 42', supported by the Islamic Republic, employs advanced social engineering schemes to access the networks of its victims, including cloud environments. This hacking group targets organizations and NGOs in Western and Middle Eastern countries, media outlets, universities and higher education institutions, legal service providers, and human rights activists, infiltrating their networks with the goal of gathering information and espionage. According to the cybersecurity company 'Mandiant', this Iranian hacking group operates on behalf of the Islamic Revolutionary Guard Corps (IRGC). The research reveals that 'APT 42' hackers contact victims by posing as journalists, human rights activists, and event organizers, gaining their trust through fake invitations and documents, as well as ongoing correspondence. By utilizing these advanced social schemes, hackers collect information from victims to gain initial access to cloud environments. Consequently, after entering the network, hackers extract strategic information of interest to the Islamic Republic and remain undetected due to their internal knowledge and use of open-source tools. The Mandiant report states that hackers exploited the names of media outlets such as The Washington Post, The Economist, and The Jerusalem Post, as well as think tanks like Aspen, McCain, or Washington. In this method, once the victim accesses the provided invitation, they are directed to hosting pages and seemingly legitimate services like YouTube, Google Drive, Gmail, and Google Meet to enter their user information, which is then captured by the hackers. In many cases, hackers did not send malware in their initial communications and instead focused on establishing a relationship with the victim for future exploitation of the created channel. Additionally, 'APT 42' hackers, during their malware operations, create two customized backdoors in the victim's network, enabling initial access that could serve as a command execution interface or a jumping point for deploying additional malware. 'APT 42' is one of dozens of hacking groups affiliated with the Islamic Republic that spy for the Tehran regime using advanced methods in cyberspace. While many of these hacking groups have been active since the onset of the Gaza war between Israel and Hamas, 'APT 42' focuses on its traditional tasks and gathering information from foreign targets. Sources: Mandiant, Cyber News, and Cyber Scope. The U.S. offers up to $10 million for information about three sanctioned Iranian hackers. The U.S. Attorney's Office has indicted an Iranian '10 million dollar' hacker. The Israeli National Cyber Directorate warns: Beware of 'update' emails from Islamic Republic hackers. A security company reports: The 'cyber gang' supported by the Islamic Republic hacked dozens of major Israeli companies. The White House states that the recent hacking operations by the Islamic Republic in the U.S. are a fresh warning to strengthen cybersecurity. Axios reports: Iranian-backed hackers have increased their activities in the region. Germany warns opponents of the Islamic Republic: Hackers are lurking for you.