Microsoft: Prominent Middle Eastern Experts Targeted by Islamic Republic Hackers

Microsoft has announced in a new report that prominent regional experts in the Middle East from universities and research institutions in the United States, the United Kingdom, Belgium, France, Israel, and even Gaza have been targeted by hackers believed to be linked to the Islamic Republic and centers in Tehran. According to the Israeli newspaper 'Jerusalem Post', the report states that a subgroup of a hacking group called 'Mint Sandstorm' has been targeting these experts since November using a phishing scheme. Phishing involves sending deceptive links or forms to individuals to trick them into revealing personal information such as passwords and credit card numbers online. Accordingly, the 'Mint Sandstorm' campaign has also used 'custom phishing bait' to lure targets into 'downloading malicious files'. In a few cases, Microsoft has observed new post-intrusion behavior, including the use of a new 'custom backdoor' called 'MediaPl'. The report adds that journalists, researchers, university professors, or others who have 'insight or perspectives on security and political issues of interest to Tehran', as well as individuals who collaborate with intelligence and policy-making communities or have the potential to influence them, are considered 'attractive targets' for hackers seeking to gather information for governments like the Islamic Republic. Given the identity of some observed targets in this phishing campaign and the use of 'baits related to the Israel-Hamas war', it is likely that this process is an attempt to gather 'views related to events associated with the war' from individuals across various ideological spectrums involved in it. On the other hand, entities associated with the Islamic Republic and the Islamic Revolutionary Guard Corps have previously targeted groups they deemed hostile, including Israeli individuals and organizations. In this context, a cyberattack in November led by Tehran and the terrorist group Hezbollah targeted the Ziv Medical Center in Safed (northern Israel) and succeeded in infiltrating 'hospital information systems' and accessing sensitive personal information of patients. In September, a cyberattack from Iran sent 'fake messages' to users of a 'job search website in Israel'. The hackers pretended that the messages were official from job websites, sending phishing messages containing 'malicious links'. Amir Rashidi: Islamic Republic hackers have advanced but lack precise tools. The United Nations: Hackers and criminals from North Korea collaborate with Asian money laundering networks. Following the attack by Islamic Republic hackers on the Pittsburgh regional water authority, U.S. states are paying attention to cybersecurity. Warning from the Israeli National Cyber Directorate: Beware of 'update' emails from Islamic Republic hackers. Microsoft: Hackers linked to the Islamic Republic have attacked defense companies with 'new malware'. Islamic Republic-affiliated hackers targeted African telecommunications companies.