Intelligence chiefs in the UK have issued a significant warning regarding a new threat posed by targeted phishing attacks allegedly conducted by hackers affiliated with the Iranian government. The alert, released by the National Cyber Security Centre (NCSC), which operates under the Government Communications Headquarters (GCHQ), highlights that cyber attackers, particularly those linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), are employing sophisticated "social engineering" techniques to compromise victims' personal and business accounts online.
The NCSC's warning identifies a range of individuals who may find themselves at heightened risk of these attacks. This group includes current and former senior government officials, prominent personnel from think tanks, journalists, activists, and lobbyists, many of whom are involved with Iranian and Middle Eastern affairs. This comes amid escalating tensions in the region, as Iran supports groups such as Hamas and Hezbollah in their ongoing conflicts with Israel.
Following the UK’s alert, US intelligence agencies have also expressed concerns, stating that individuals connected to political campaigns have similarly been targeted. The cyber attackers are reportedly engaging in deceptive strategies, including impersonating well-known figures, such as family members or journalists, as well as initiating discussions about foreign policy topics or sending invitations to conferences to build trust with potential victims.
Paul Chichester, director of operations at the NCSC, commented on the situation, noting, “The spear-phishing attacks undertaken by actors working on behalf of the Iranian government pose a persistent threat to individuals with a connection to Iranian and Middle Eastern affairs. With our allies, we will continue to call out this malicious activity, which puts individuals’ personal and business accounts at risk, so they can take action to reduce their chances of falling victim."
The nature of these "spear-phishing" attacks is particularly insidious, targeting specific individuals by leveraging information that is known to be of interest to them. Cybersecurity experts have indicated that Iranian hackers have often used email and messaging platforms to establish a rapport with victims, subsequently luring them into sharing sensitive user credentials through counterfeit email login pages. This process allows the attackers access to the victims' accounts, with potential consequences such as exfiltration and deletion of messages, as well as setting up email forwarding rules to monitor communications.
The NCSC has categorically stated that this ongoing activity represents a threat to various sectors both within the UK and globally. Individuals identified as being at risk are encouraged to implement the mitigation measures recommended by the NCSC and may also be able to access special support services tailored for "high-risk individuals."
Moreover, US intelligence reports have earlier indicated that Iranian hackers were involved in stealing materials from Donald Trump’s presidential campaign during the summer, which they then disseminated to officials in the Biden campaign as well as journalists.
The NCSC continues to advise that those in vulnerable positions remain vigilant to any suspicious contacts and consider utilizing the free cyber defence tools it provides to guard against potential compromises of their security.
Source: Noah Wire Services