Iranian Hackers Use Adept Social Engineering Skills to Gather War-Related Intelligence 

A technically and operationally mature subgroup of the Iranian cyber espionage group called Mint Sandstorm has been targeting high-profile individuals working on Middle Eastern affairs at universities and research organizations in Belgium, France, Gaza, Israel, the UK, and the US. Mint Sandstorm (a.k.a. APT35/Charming Kitten/PHOSPHORUS) has been linked to the Islamic Revolutionary Guard Corps (IRGC), and operators within the subgroup are known for their patience and skillful social engineering mastery that often lacks the identifiers present in most phishing emails. The recent activity associated with a subgroup of Mint Sandstorm has been on-going since November 2023.  The Iranian-backed state hackers are using custom spear phishing lures centered around the Israel-Palestine war, disguising themselves as journalists or other high-profile individuals and exchanging email communications with targets to build trust, and in some cases have used legitimate compromised email accounts of the individuals they were impersonating. The emails sent to targets requested input about articles relating to the Israel-Palestine conflict, and the hackers sent links to a malicious “.rar” file that was supposed to contain the alleged documents or related articles. In some cases, researchers have uncovered the use of a custom backdoor called MediaPL which is disguised as Windows Media Player to evade detection and is a form of malware that uses encrypted communication channels to exchange information with its designated command-and-control (C2) server. MediaPL and another backdoor, MischiefTut, can be used to launch commands received from the C2 server, run reconnaissance commands, and download additional tools to maintain access in a compromised environment and continuously evade detection. Based on the Israel-Palestine related lures and the targeting of individuals potentially within the intelligence and policy communities, this campaign is likely being used to gather information and perspective on events related to the war from a range of individuals.