Iranian Hackers Disguised as Journalists to Spread Malicious Malware to Western Countries

Liputan6.com, Jakarta – Iranian state-backed hackers, suspected to be the APT42 group, used social engineering attacks, including posing as journalists.

The aim is to penetrate targeted enterprise networks and cloud environments in Western and Middle Eastern countries.

APT42 was first documented by cybersecurity firm Mandiant in September 2022, which reported that the threat actor had been active since 2015–conducting at least 30 operations in 14 countries.

The hacker or espionage group believed to be affiliated with Iran's Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO) is known to target non-governmental organizations, media, educational institutions, activists and legal services.

Quote BleepingComputerTuesday (7/5/2024), Google security analysts researching APT42's operations reported that hackers used malicious emails containing malware to infect their targets with two specific backdoors, namely “Nicecurl” and “Tamecat”.

APT42 attacks rely on social engineering and spear phishingwith the ultimate goal of infecting target devices with a custom backdoor, thereby allowing cyberattackers to gain initial access to an organization's network.

Attacks begin with emails from people posing as journalists, NGO representatives, or event organizers sent from domains that “typosquat” (use similar URLs) to official organization domains.