Iran-Linked 'Charming Kitten' Touts New Spearphishing Tactics

An Iran-linked advanced persistent threat APT group tied to attacks on President Trump’s 2020 re-election campaign has added new spearphishing techniques to its arsenal in an apparent ramp-up in operations. Charming Kitten—which goes by a number of names, including APT35, Ajax Security Team,...

Iran-linked Hackers Target Trump 2020 Campaign, Microsoft says

A group of hackers tied to Iran has been attempting to break into accounts associated with the 2020 reelection campaign of President Trump, researchers have discovered. Researchers from the Microsoft Threat Intelligence Center said they first observed activity from a group called Phosphorus in...

Cops Take Over a Botnet to Clear Malware Off Nearly a Million PCs

Attacking Iran, a web host data breach, and more of the week's top security news...

Iran-Linked APT34 Invites Victims to LinkedIn for Fresh Malware Infections

A recent phishing campaign by Iran-linked threat actor APT34 made use of a savvy approach: Asking victims to join their social network. According to FireEye, the adversaries masqueraded as a Cambridge University lecturer, including setting up a LinkedIn page, in order to gain victims’ trust. From...

Hard Pass: Declining APT34’s Invite to Join Their Professional Network

Background With increasing geopolitical tensions in the Middle East, we expect Iran to significantly increase the volume and scope of its cyber espionage campaigns. Iran has a critical need for strategic intelligence and is likely to fill this gap by conducting espionage against decision makers a...

The Biggest Cybersecurity Crises of 2019 So Far

Ransomware attacks, supply chain hacks, escalating tensions with Iran—the first six months of 2019 have been anything but boring...

Threat Source newsletter (June 27, 2019)

Newsletter compiled by Jonathan Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. You never want to fall behind on Beers with Talos. So make sure to listen to the latest episode on your commute home today. This...

Iran Targeting U.S. With Destructive Wipers, Warns DHS

The Department of Homeland Security is warning that Iranian hackers are targeting U.S. agencies with destructive “wiper” malware. The statement comes as tensions continue to build between the U.S. and Iran. Christopher Krebs, the director of the Department of Homeland Security DHS Cybersecurity a...

Iran Shoots Down a US Drone, Apple Recalls MacBook Batteries, and More News

Catch up on the most important news from today in two minutes or less...

Iranian Hackers Launch a New US-Targeted Campaign as Tensions Mount

Three cybersecurity firms have identified phishing attacks stemming from Iran—that may lay the groundwork for something more destructive...

The Global Hawk Drone Iran Shot Down Was a $220M Surveillance Monster

The Global Hawk can fly at an altitude of 55,000 feet and stay aloft for 30 hours straight...

5,000 Twitter Accounts Linked to Disinformation Campaigns

Twitter has removed six sets of accounts that the site has deemed to be devoted to coordinated, state-backed propaganda activities – totaling about 5,000 accounts in all. “We believe that people and organizations with the advantages of institutional power and which consciously abuse our service a...

Russia and Iran Plan to Fundamentally Isolate the Internet

Opinion: Russia and Iran’s decisions to build isolated, domestic internets represent a new form of internet fragmentation—one that is far more physical than what we’ve seen before...

Facebook Removes a Fresh Batch of Iran-Linked Fake Accounts

Outside researchers tipped Facebook off that a social media network was pushing Iranian interests, posing as journalists, and even impersonating politicians...

IT threat evolution Q1 2019

Targeted attacks and malware campaigns Go Zebrocy Zebrocy was first observed being used as a Sofacy backdoor in 2015. However, the collection of cases where this tool has been used mean that we consider it a subset of activity in its own right. On the basis of this threat actor's past behaviour, ...

More on the Triton Malware

FireEye is releasing much more information about the Triton malware that attacks critical infrastructure. It has been discovered in more places. This is also a good -- but older -- article on Triton. We don't know who wrote it. Initial speculation was Iran; more recent speculation is Russia. Both...

Elfin Hacking Group Targets Multiple U.S. and Saudi Arabian Firms

An Iran-linked cyber-espionage group that has been found targeting critical infrastructure, energy and military sectors in Saudi Arabia and the United States two years ago continues targeting organizations in the two nations, Symantec reported on Wednesday. Widely known as APT33, which Symantec...

Chinese Surveillance, Facebook Tracking, and More Security News This Week

3-D printed rifles, Iran missile hacking, and more of the week's top security news...

Ex-US Intelligence Agent Charged With Spying and Helping Iranian Hackers

The United States Department of Justice has announced espionage charges against a former US Air Force intelligence officer with the highest level of top-secret clearance for providing the Iranian government classified defense information after she defected to Iran in 2013. Monica Elfriede Witt ,...

Ex-US Intelligence Agent Charged With Spying and Helping Iranian Hackers

The United States Department of Justice has announced espionage charges against a former US Air Force intelligence officer with the highest level of top-secret clearance for providing the Iranian government classified defense information after she defected to Iran in 2013. Monica Elfriede Witt, 3...