Iranian spies bait U.S. officials in years-long social engineering scheme

Share this article:
Iranian cyber spies bait U.S. officials in social media ruse
Dubbed “Newscaster,” the operation entailed a years-long social engineering ruse leveraging popular networking sites.

Researchers have uncovered a three-year espionage campaign primarily targeting U.S. military officials, diplomatic and congressional staff, and defense contractors in the country and abroad.

On Wednesday, threat intelligence firm iSight Partners detailed the operation, dubbed “Newscaster" for the intricate social engineering scheme used in attacks. Attackers took on fake, social media personas, and even erected a phony news site, NewsOnAir.org, to gain the trust of their targets.

According to a 19-page report by iSight, hackers, believed to be based in Iran, used numerous networking sites, including Facebook, LinkedIn, Twitter and Google+, to connect with victims.

Once a connection was established with targets, attackers often went after victims' login details by sending them links to “credential collection sites,” which were designed to look like login pages for Yahoo, Google, our Outlook Web Access, the report said.

Researchers believe the network's primary goal was to collect insight on military or diplomatic affairs, as well as intel about defense organizations, for their sponsors' interests and advantage. In addition to collecting credentials, attackers also used the campaign, which dates back to 2011, to distribute malware capable of data exfiltration.

A number of factors led researchers to believe the attacks originated in Iran, including the fact that social networking posts were made during Tehran working hours. Furthermore, NewsOnAir.org was registered in Tehran, and IP addresses used in the attackers' infrastructure mainly hosted Iranian content, the report revealed.

John Hultquist, manager of cyber espionage and threat intelligence at iSight, told SCMagazine.com in a Thursday interview that the Newscaster campaign was the “most extensive social engineering scheme” the firm had seen to date.

Fake social media personas included “reporters,” who shared articles via the fictitious news site, NewsOnAir.org.

“For the most part, the news site was set up just to legitimize the [fake] accounts,” Hultquist said.

Page 1 of 2
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

LEADS Act addresses gov't procedure for requesting data stored abroad

LEADS Act addresses gov't procedure for requesting data ...

Senators introduced the legislation last week as a means of amending the Electronic Communications Privacy Act (ECPA).

Report: Intrustion prevention systems made a comeback in 2013

Report: Intrustion prevention systems made a comeback in ...

A new report indicates that intrusion prevention systems grew 4.2 percent in 2013, with growth predicted to continue.

Mobile device security sacrificed for productivity, study says

Mobile device security sacrificed for productivity, study says

A Ponemon Institute study, sponsored by Raytheon, revealed that employees increasingly use mobile devices for work but cut corners and circumvent security.