Day: September 3, 2024

Categories
Security and Intelligence

@SecDef: September is Suicide Prevention Awareness Month. I am committed to doing right by our people – and continuing to work to ensure that our service members have access to the mental health care they need.



Categories
Security and Intelligence

@SpiesVespers: Not all heroes wear capes!



Categories
Security and Intelligence

@NCSCgov: RT @NCSCgov: #TechTuesday: NCSC’s Wall of Spies Artifact, the Lorenz SZ 40/42, known as TUNNY. This encryption machine was used by the Germ…



Categories
Security and Intelligence

@TheValPerrine: RT @TheValPerrine: Today is my 81st Birthday! 🎂I can’t believe it! Here I am in my Birthday suit many moons ago! Help me celebrate by dona…



Categories
Security and Intelligence

@NCSCgov: Today NCSC and partners across the US government kicked off National Insider Threat Awareness Month (NITAM) 2024, an annual, month-long campaign to educate government and industry about the risks posed by #insiderthreats.



Categories
Security and Intelligence

Cyber spies target Iranian government critics with fake job sites


Fake recruitment website dreamy-jobs[.]com used in 2022.

Iranian state-sponsored hackers have launched an espionage campaign targeting individuals perceived as threats to the regime. The cyber spies operate fake job websites, luring unsuspecting job seekers into giving up their personal information, which Iran then uses to spy on them.

The operation, uncovered by the U.S. cybersecurity firm Mandiant, dates back to 2017 and is believed to be part of a broader effort to silence those who oppose the Iranian regime, targeting Iranian dissidents, activists, and human rights advocates.

Ofir Rozmann, Trust and Safety Analyst at Mandiant, told National Security News: “Iranian individuals targeted by this campaign may reveal themselves to the Iranian regime as Israeli/Western supporters, and interested in collaborating with Israeli entities.”

“Subsequently, Iran’s regime may investigate these individuals, conduct further operations against them (cyber and non-cyber) and persecute them,” Rozmann added.

Mandiant found over 35 websites disguised as legitimate recruitment sites. The digital traps offered attractive job opportunities for intelligence and security agencies and promised to protect the privacy of applicants.

Desktop and mobile versions of a fake recruitment website used in February 2024.

To enhance their credibility, the cyber criminals employed a variety of tactics. The websites featured “Israel-related lures” such as images of national symbols and flags, as well as hi-tech offices and major city landmarks.

Additionally, the contact details on the site listed Telegram links with handles containing “IL” (Israel) references, further reinforcing the campaign’s perceived affiliation with Israel, stated Mandiant.

Once the unsuspecting victims click “apply”, they are asked for personal details, including their name, birth date, email, home address, education, and professional experience. The sensitive information is then sent to the attackers.

While the campaign primarily targeted Farsi speakers, Mandiant identified similar operations aimed at Arabic-speaking individuals linked to Syria and Hezbollah. The websites were active between 2020 and 2023, and used a similar style and imagery. One of the websites called “VIP Recruitment” advertised as a recruitment centre for “respected military personnel”, displayed a picture of an Israeli flag.

To amplify their reach, Mandiant said that the cyber spies behind the campaign used fake social media accounts to publicise links to the malicious websites. Posts were made across platforms like X and Virasty, a social media platform that is commonly used in Iran.

Posts on X by an account promoting a fake recruitment website.

Rozzmann said: “Iran’s social engineering efforts are becoming increasingly sophisticated as time goes by. Individuals should be sure to carefully inspect job-related inquiries they receive over social media, as these continue to provide a fertile ground for various Iran-nexus cyber operations.”

Mandiant believes that the campaign is being operated on behalf of Iran’s regime, as the tactics and techniques used were similar to those of APT42, a group linked to Iran’s IRGC Intelligence Organisation. APT42 has a history of conducting surveillance operations against domestic threats and individuals of interest to the Iranian government.

Rozzman explained that users of Google Chrome and other browsers are now better protected against such activities, as the “SafeBrowsing” feature has successfully blocked the malicious infrastructure involved.

The post Cyber spies target Iranian government critics with fake job sites first appeared on National Security News.


Categories
Security and Intelligence

Mongolia ignores ICC demands to arrest Putin during state visit


Russian President Vladimir Putin arrived in Mongolia for a state visit this week despite an International Criminal Court warrant for his arrest.

Categories
Security and Intelligence

@MEMRIReports: Read #MEMRI analysis: Former #Algerian Army Colonel On Algerian Secret Services’ Responsibility For The Assassination Of Algerian President Boudiaf – Audio of report here



Categories
Security and Intelligence

@Robert4787: A U.S. intelligence satellite image uncovered a new nuclear missile site in Russia—Putin’s ‘invincible’ missile with unlimited range is locked and loaded. Some wonder if the Kremlin is gearing up for nuclear war. #NuclearThreat #Russia #GlobalSecurity https://t.co/fD0nPZzPtf https://t.co/ZfMFGxnc4I



Categories
Security and Intelligence

@NCSCgov: #TechTuesday: NCSC’s Wall of Spies Artifact, the Lorenz SZ 40/42, known as TUNNY. This encryption machine was used by the German High Command during WWII, but its code was broken by the British, yielding insights into German strategy and helping the Allies in the D-Day invasion.