US Justice Department Accuses Iranian Nationals of Launching Spear Phishing Attacks

spear phishingThe US Department of Justice has indicted four Iranian nationals for allegedly launching spear phishing attacks against the US government and defense contractors.

In one instance, the hackers compromised over 200,000 employee accounts at a victim organization.

“In conducting their hacking campaigns, the group used spearphishing — tricking an email recipient into clicking on a malicious link — to infect victim computers with malware,” the Justice Department said.

“During their campaigns against one victim, the group compromised more than 200,000 employee accounts. In another campaign, the conspirators targeted 2,000 employee accounts. In order to manage their spear phishing operations, the group created and used a particular computer application that enabled the conspirators to organize and deploy their spear phishing attacks.”

The DOJ says the individuals used their access to one victim organization to launch convincing spear phishing attacks against other defense contractors.

“In the course of these spear phishing attacks, the conspirators compromised an administrator email account belonging to a defense contractor (Defense Contractor-1),” the DOJ said. “Access to this administrator account empowered the conspirators to create unauthorized Defense Contractor-1 accounts, which the conspirators then used to send spearphishing campaigns to employees of a different defense contractor and a consulting firm.”

The individuals also allegedly used catfishing tactics to trick their targets into installing malware.

“In addition to spear phishing, the conspirators utilized social engineering, which involved impersonating others, generally women, to obtain the confidence of victims,” the Justice Department said. “These social engineering contacts were another means the conspiracy used to deploy malware onto victim computers and compromise those devices and accounts.”

New-school security awareness training can give your organization an essential layer of defense against social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

The US Justice Department has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews