‘Cobalt Dickens’ group is phishing universities at scale again, researchers say

A 2018 indictment hasn't disrupted the Iran-linked hacking group.

An Iran-linked hacking group whose operatives a U.S. jury indicted last year has launched a phishing operation to steal login credentials against computer users at over 60 universities in the United States, the United Kingdom, and elsewhere, researchers said Wednesday.

The campaign, whose aim is likely intellectual property theft, sees victims redirected to spoofed login pages, where their passwords are stolen, said Secureworks, a Dell-owned cybersecurity company that discovered the activity.

“The threat actors have not changed their operations despite law enforcement activity, multiple public disclosures, and takedown activity,” Secureworks said in a blog post.

The most high-profile attempt to disrupt the hackers was the charges the U.S. Department of Justice announced in March 2018 against nine Iranian nationals for breaching the networks of multiple U.S. universities, federal government agencies and U.S. companies. And yet the hacking group, which Secureworks dubs Cobalt Dickens, has used some of the same domains in their new phishing activity that were used prior to the indictment.

The group “has used nearly the exact same tactics over the past 12 months,” suggesting they’ve been effective in achieving their objectives, said Allison Wikoff, senior researcher at Secureworks Counter Threat Unit.

The attackers have registered 20 new domains for the campaign, many of which use valid security certificates to make them seem authentic. In addition to the U.S. and the U.K., universities in Australia, Canada, Hong Kong, and Switzerland were targeted, according to Secureworks.

“In the cases we have investigated, the phishing recipients included students, faculty and staff,” Wikoff told CyberScoop.“There didn’t seem to be a focus on a particular department or unit within the universities.”

The campaign is similar to one uncovered by Secureworks a year ago, which saw the hackers use breached university accounts to send phishing emails.

Universities are natural targets for government-backed hackers interested in propriety research. Security researchers have previously called out hackers associated with North Korea and China for trying to break into university networks.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems