Top military officials in Israel have been the targets of an aggressive series of phishing attacks. Targets included senior officials in the Israeli defense industry and the former U.S. Ambassador to Israel. Researchers stated that the main goal of the attack was to attempt to gain personal information from the targets. One of the targets, Israel’s former foreign minister, received a phishing email impersonating a “well known former Major General in the IDF who served highly in a sensitive position.” However, the email address used in this phishing attempt was not spoofed. She received the email from the same domain she had corresponded with before. She had a delayed response to the email which caused a flurry of follow up emails that raised her suspicions. The attack, that was led by an advanced persistent threat group with ties to Iran, used a phishing technique known as spear phishing. The attack used multiple compromised emails and specifically constructed each email for a specific target. The attackers initiated the attack by compromising the email address book belonging to a contact of their target and then used that email to message their target in time, steering the conversation towards the attempt to gain the target’s personal information. Several of the emails included links to real documents or invitations. The evidence indicates that the attacks at least started in December 2021, however it is possible they started earlier. The attacks are believed to be tied to rising tensions between Iran and Israel since in their evidence points to the phosphorus group which has “a long history of conducting high-profile cyber operations, aligned with the interest of the Iranian regime, as well as targeting Israeli officials.” CTIX analysts continue to monitor the operations of threat actors worldwide and will further report on this matter if new evidence comes to light.