The Iranian threat actor Charming Kitten is launching sophisticated spear phishing attacks to distribute a new version of its POWERSTAR malware, according to researchers at Volexity.
“In the last few years, Volexity has observed threat actors dramatically increase the level of effort they put into compromising credentials or systems of individual targets,” Volexity says. “Spear-phishing campaigns now often involve individual, tailored messages that engage in dialogue with each target, sometimes over a period of several days, before a malicious link or file attachment is ever sent.”
Charming Kitten (also known as “APT35") often uses social engineering in its cyber espionage campaigns.
“One threat actor Volexity frequently sees employing these techniques is Charming Kitten, who is believed to be operating out of Iran,” the researchers write. “Charming Kitten appears to be primarily concerned with collecting intelligence by compromising account credentials and, subsequently, the email of individuals they successfully spear phish. The group will often extract any other credentials or access they can, and then attempt to pivot to other systems, such as those accessible via corporate virtual private networks (VPNs) or other remote access services.”
In this instance, the threat actor posed as an Israeli reporter and began communicating with the targeted individual.
“The target of the recently observed attack had published an article related to Iran,” the researchers write.“The publicity appears to have garnered the attention of Charming Kitten, who subsequently created an email address to impersonate a reporter of an Israeli media organization in order to send the target an email. Prior to sending malware to the target, the attacker simply asked if the target would be open to reviewing a document they had written related to US foreign policy. The target agreed to do so, since this was not an unusual request; they are frequently asked by journalists to review opinion pieces relating to their field of work.”
After several days of conversation, the threat actor sent the victim a password-protected document that would install the malware.
New-school security awareness training can enable your employees to thwart targeted social engineering attacks.
