{"id":39124,"date":"2021-01-13T18:48:00","date_gmt":"2021-01-13T18:48:00","guid":{"rendered":"http:\/\/e2ac1603-9ca3-42e2-a70e-90ccecd52be3"},"modified":"2021-01-13T18:48:00","modified_gmt":"2021-01-13T18:48:00","slug":"iranian-cyberspies-behind-major-christmas-sms-spear-phishing-campaign","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/iranian-cyberspies-behind-major-christmas-sms-spear-phishing-campaign\/","title":{"rendered":"Iranian cyberspies behind major Christmas SMS spear-phishing campaign"},"content":{"rendered":"
\"Christmas<\/span>
<\/span> Image: Rodion Kutsaev <\/span><\/figcaption><\/figure>\n

An Iranian cyber-espionage group known as Charming Kitten<\/a> (APT35 or Phosphorus) has used the recent winter holiday break to attack targets from all over the world using a very sophisticated spear-phishing campaign that involved not only email attacks but also SMS messages.<\/p>\n

\n

Special feature<\/span> <\/h3>\n
\"Cyberwar<\/span> <\/a> <\/div>\n

Cyberwar and the Future of Cybersecurity <\/a> <\/p>\n

Today’s security threats have expanded in scope and seriousness. There can now be millions — or even billions — of dollars at risk when information security isn’t handled properly.<\/p>\n

Read More<\/a> <\/p>\n<\/p><\/div>\n

“Charming Kitten has taken full advantage of this timing to execute its new campaign to maximum effect,” said CERTFA<\/a>, a cybersecurity organization specialized in tracking Iranian operations.<\/p>\n

“The group started the new round of attacks at a time when most companies, offices, organizations, etc. were either closed or half-closed during Christmas holidays and, as a result, their technical support and IT departments were not able to immediately review, identify, and neutralize these cyber incidents,” it added.<\/p>\n

CERTFA said it detected attacks targeting members of think tanks, political research centers, university professors, journalists, and environmental activists.<\/p>\n

The victims were located in countries around the Persian Gulf, Europe, and the US.<\/p>\n

How an attack unfolded<\/h3>\n

CERTFA researchers said that this particular campaign exhibited an advanced degree of complexity. Victims received spear-phishing messages from the attackers not only via email but also via SMS, a channel that not many threat actors use on a regular basis.<\/p>\n

While the SMS messages posed as Google security alerts, the emails leveraged previously hacked accounts and tried to play on the festive mood with holiday-related lures.<\/p>\n

<\/section>\n

The common denominator in both campaigns was that Charming Kitten operators managed to successfully hide their attacks behind a legitimate Google URL of https:\/\/www.google[.]com\/url?q=https:\/\/script.google.com\/xxxx<\/em>, which would have fooled even the most tech-savvy recipients.<\/p>\n

\"certa-sms.png\"<\/span>