Group said to be behind attempted campaign hack has also gone after cybersecurity researchers

After Microsoft said Iranian hackers had targeted a presidential campaign, more data on the group is coming out.

An Iran-linked hacking group that targeted a U.S. presidential campaign in recent months also has a history of trying to compromise cybersecurity analysts who have exposed the hackers’ operations, the analysts told CyberScoop.

The hackers have previously sent researchers at Israeli company ClearSky Cyber Security malware-laced emails purporting to be from an antivirus company, according to Ohad Zaidenberg, the company’s senior cyber intelligence researcher.  The hacking group, which analysts say works in support of Iranian interests, also set up a phishing website mimicking that of ClearSky and a web-mail page “built to attack our clients,” Zaidenberg told CyberScoop.

ClearSky flagged some of the activity last year, saying the hackers had failed to breach the company or its clients. But the attackers appear to be very persistent. “They tried to attack me personally and ClearSky as well many times,” Zaidenberg said. “They don’t like us.”

The episode highlights the lengths to which the group might go to try to infiltrate the cybersecurity specialists who track them. And it is indicative of what has been a busy few months for the Iranian computer operatives, known to researchers as Charming Kitten, APT35, or Phosphorus.

Last week, Microsoft said the hackers had tried to break into at least one email account associated with an unnamed U.S. presidential campaign, along with current and former U.S. government officials, journalists, and certain Iranians living abroad. While Microsoft’s report covered a lot of activity (the company said the hackers had targeted 241 email accounts) it also encouraged outside analysts to come forward with their own Charming Kitten data.

Despite Charming Kitten’s penchant for attacking them, ClearSky said this week they’ve found more of the group’s phishing sites. These page lures try to trick Facebook and Twitter users into handing over their passwords. The sites, which the researchers discovered in the last week, are made using WordPress or CrunchPress, a related website tool, and have directories that store logos used to impersonate the target organization. In addition to the targets named by Microsoft, Charming Kitten has also been going after academic researchers who focus on Iran along with activists opposed to the Iranian regime, according to ClearSky.

For some analysts, the latest Charming Kitten activity is a reminder of the group’s persistence and maturation.

John Hultquist, director of intelligence analysis at cybersecurity company FireEye, said the Iranian hacking group had “come a long way” in honing its tradecraft in the five years his company has been tracking the hackers. A group that once had “rudimentary” techniques has been “using a lot of off-the-shelf tools and frameworks to improve their capability,” Hultquist told CyberScoop.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure