“Academics, journalists, and think tank personnel should practice caution and verify the identity of the individuals offering them unique opportunities.”
By TZVI JOFFRE
JULY 15, 2021 11:34
![Iranian flag and cyber code [Illustrative] (photo credit: PIXABAY)](https://images.jpost.com/image/upload/f_auto,fl_lossy/t_JD_ArticleMainImageFaceDetect/433124)
Iranian hackers masqueraded as British scholars with the University of London’s School of Oriental and African Studies (SOAS) in an attempt to solicit sensitive information from journalists, think tank experts and senior professors since the beginning of the year, according to a new report by the cybersecurity company Proofpoint on Tuesday.
While Proofpoint has been unable to independently confirm that the hackers, known as TA453 or CHARMING KITTEN and PHOSPHORUS, are part of the IRGC, the hackers have historically aligned with the priorities of Iran’s Islamic Revolutionary Guard Corps (IRGC), with attacks targeting dissidents, academics, diplomats and journalists, according to the report.
In their latest attack, TA453 compromised a site belonging to SOAS in order to deliver pages disguised as registration links to harvest login information from targets, including experts in Middle Eastern affairs from think tanks, senior professors at academic institutions and journalists specializing in Middle Eastern coverage.
The attempts to connect with targets included lengthy conversations before the fake registration links were delivered in order to capture the credentials of targets. TA453 also targeted the personal email accounts of at least one of the targets in the attack.
Proofpoint stated that the hacking campaign, which it called SpoofedScholars, is one of the more sophisticated campaigns by TA453 it has identified.
cnxps.cmd.push(function () { cnxps({ playerId: ’36af7c51-0caf-4741-9824-2c941fc6c17b’ }).render(‘4c4d856e0e6f4e3d808bbc1715e132f6’); });
if(window.location.pathname.indexOf(“656089”) != -1){document.getElementsByClassName(“divConnatix”)[0].style.display =”none”;}else if(window.location.pathname.indexOf(“634571”) != -1){ document.getElementsByClassName(“divConnatix”)[0].style.display =”none”; var script = document.createElement(‘script’); script.src = ‘https://player.anyclip.com/anyclip-widget/lre-widget/prod/v1/src/lre.js’; script.setAttribute(‘pubname’,’jpostcom’); script.setAttribute(‘widgetname’,’0011r00001lcD1i_12258′); document.getElementsByClassName(‘divAnyClip’)[0].appendChild(script);}
The hacker group used the personas “Dr. Hanns Bjoern Kendel, senior teaching and research fellow at SOAS University in London” and Tolga Sinmazdemir, another individual associated with SOAS, in order to solicit conversations with targets.
In initial emails sent by the Kendel persona, TA453 invited the target to a fake online conference on “The US Security Challenges in the Middle East.” Emails by the Sinmazdemir persona solicited contributions to a “DIPS Conference.”
In one attempt by the Kendel persona, the hackers tried to connect with the target via phone to discuss the invitation, but the target requested a written proposal with details so the hackers provided specific details. After a bit of back and forth, TA453 provided a detailed invitation and eventually attempted to get the target to connect via videoconferencing.
The hackers provided targets with personalized links to a legitimate but compromised website belonging to SOAS which had targets long in with email providers.
Proofpoint warned that emails from hanse.kendel4[@]gmail.com, hannse.kendel4[@]gmail.com, and t.sinmazdemir32[@]gmail.com should be considered suspect and investigated and that network traffic to soasradi.org should be investigated as well.
Proofpoint pointed out that TA453 demonstrated passable English skills and seemed to desire to connect with the target in real-time, even requesting voice communication via videoconferencing. The hacker group also expressed interest in mobile phone numbers, which Proofpoint said could be for mobile malware or additional phishing.
“The use of legitimate, but compromised, infrastructure represents an increase in TA453’s sophistication and will almost certainly be reflected in future campaigns. TA453 continues to iterate, innovate, and collect in support of IRGC collection priorities,” said Proofpoint in the report. “Academics, journalists, and think tank personnel should practice caution and verify the identity of the individuals offering them unique opportunities.”
The targeted categories of people have information of interest to the Iranian government, including foreign policy information, insights into Iranian dissidents and understandings of US nuclear negotiations, among other interests. Most of the targets identified in this campaign have been targeted by TA453 in the past. Less than ten organizations were targeted in the campaign.
According to the BBC, SOAS said that no personal information was unobtained and that its own data systems were unaffected as the compromised website is separate from the official SOAS website.
“Once we became aware of the dummy site earlier this year, we immediately remedied and reported the breach in the normal way. We have reviewed how this took place and taken steps to further improve protection of these sort of peripheral systems,” the university told the BBC.
Kendel, one of the academics impersonated, told Motherboard by Vice that while the experience was stressful, he had conversations with “a lot of interesting people that [he] would probably not have had interaction with otherwise.”
“I think it was smart of them to pick me. The UK does not recognize identity theft as a crime in itself,” Kendel added to Motherboard. “Working in the field of diplomacy and at a renowned institution, yet not senior enough to be implausible for first contact. A mixture of slightly clumsy but also highly sophisticated.”
In April, Proofpoint announced that TA453 targeted senior medical professionals specializing in genetic, neurology and oncology research in the US and Israel late last year. In that campaign, dubbed BadBlood, the hackers used a Gmail account which was presented as belonging to prominent Israeli physicist and former president of the Weizmann Institute of Science, Daniel Zajfman.
TA453 was also reportedly responsible for unsuccessfully targeting former US president Donald Trump’s re-election campaign in 2019, according to Reuters. The hacking attempt targeted hundreds of accounts in Microsoft’s cloud email service; four accounts that were not associated with an election campaign were compromised.
Microsoft’s Digital Crimes Unit and the Microsoft Threat Intelligence Center have tracked TA453 since 2013, the company announced in 2019, adding that the group typically targeted businesses, government agencies, activists and journalists with attempts to entice targets to click on malicious links or enter credentials in fraudulent web forms pretending to belong to well-known online services.
Content retrieved from: https://www.jpost.com/middle-east/iran-hackers-masqueraded-as-uk-scholars-to-hack-journalists-think-tanks-673910.