Iran operates fake HR firm to detect spies

Photo: REUTERS/Dado Ruvic/Illustration/File photo.

A new study from cybersecurity firm Mandiant, a subsidiary of Alphabet and Google Cloud, has revealed that an Iranian hacker group operated a fake recruitment company to lure national security officials in Iran, Syria, and Lebanon into cyber espionage.

Researchers say the hackers are linked to a group called APT42, or Charming Kitten, which was recently accused of hacking into the US presidential campaign of Republican candidate Donald Trump. APT42 is believed to be linked to an intelligence unit of the Iranian Revolutionary Guard Corps, a military organization under the government in Tehran. The FBI said it is investigating APT42's efforts to interfere in the 2024 US presidential election.

The operation Mandiant uncovered is believed to have begun in 2017 and continued until recently. At various stages, Iran made the campaign appear to be run by the Israeli government. Analysts believe the spoofing may have been designed to identify individuals in the Middle East who might be willing to leak secrets to Israel and Western governments . The operation targeted military and intelligence personnel affiliated with Iran’s regional allies.

"Data collected through this operation could help Iran's intelligence apparatus identify individuals who are interested in collaborating with Iran's adversaries. This data could be used to detect human intelligence (HUMINT) activities conducted against Iran and to indict individuals suspected of being involved in such activities," the Mandiant report said.

Iran's ambassador to the UN did not respond to requests for comment.

Mandiant found that the cyber actors used a network of fake websites impersonating human resources firms to manipulate Farsi-speaking targets. The fake firms were called VIP Human Solutions, VIP Recruitment, Optima HR, and Kandovan HR, among others. The actors used a variety of fake profiles on Telegram, Twitter, YouTube, and Virasty, a popular social media platform in Iran, to promote the fake companies. Nearly every account associated with the campaign has been deleted.

One website reads: "VIP Recruitment, a recruitment center for military, security and intelligence personnel from Syria, Hezbollah and Lebanon. Join us in helping each other make a real impact on the world . Our mission is to protect your privacy."

The hackers carried out a large-scale campaign by distributing links to fake staffing companies on various social media platforms. Mandiant said the data collected, including addresses, contact information, and other resume data, could be exploited in the future.

Nguyen Quang Minh (According to Reuters)

Source: https://www.nguoiduatin.vn/iran-van-hanh-cong-ty-nhan-su-gia-mao-de-phat-hien-gian-diep-204240829092356703.htm