Targeted manipulation: Iran's social engineering and spear phishing campaigns

Iran’s approach to sophisticated social engineering campaigns

We assess that Iranian cyber threat actors customize and enhance the effectiveness of their social engineering campaigns by developing compelling personas, building rapport with targets over longer periods of time and using enticing, highly emotive content related to timely geopolitical issues or traumatic events.

Figure 1: The social engineered spear phishing process

Actors construct false persona on multiple social media sites

Persona interacts with the target, often building trust and relating on shared interests

Actors send malicious link or file and/or attempt to compromise device

Creating compelling personas

Iranian cyber threat actors create and employ fake personas to build relationships with their targets and establish trust. They typically develop professional relationships or relationships around the targets’ interests. Personas allow for a curated and interactive approach to establishing trust and legitimacy with targets, especially when more individuals’ “professional and social selves” are now online and not as distinguishable from their “offline selves”. We assess that Iranian cyber threat actors very likely use attractive female personas to manipulate their targets.^{Footnote 2} Further, we assess that Iranian cyber threat actors likely leverage previously compromised and spoofed email accounts to add a perceived legitimacy to their personas and for subsequent lures.

Iranian cyber threat actors have used fake personas to target individuals from a wide variety of professional fields including:

• defence contractors
• aerospace employees
• energy sector employees
• journalists
• academics
• researchers
• activists
• politicians
• diplomats
• civil society groups^{Footnote 1Footnote 2Footnote 3}

Case study 1: Aerobics instructor from Liverpool or Iranian social engineer?

An Iranian cyber threat actor used a false persona to pose as an aerobics instructor and personal trainer named Marcella Flores. The false persona established a months-long relationship with the employee of an aerospace defence contractor.

The false persona nursed the digital relationship over multiple corporate and personal communication platforms. The persona then delivered malware to the target’s machine through a malicious Excel spreadsheet that appeared to be a benign “Diet Survey” document.^{Footnote 4}

Case study 2: Mia Ash

Mia Ash was a fake persona used by Iranian cyber threat actors to target organizations in the Middle East from 2016 to 2017. Ash claimed to be a 30-year-old British professional photographer. Her profile was built using stolen pictures, likely from an Instagram account of a legitimate photographer. She had a presence on Facebook, Blogger and LinkedIn.

The persona used LinkedIn to contact an employee at a targeted organization and exchanged messages with the target about their professions, photography and travels, after which she encouraged the target to add her on Facebook. Correspondence continued via WhatsApp, email and Facebook. After a few weeks, she sent a malicious Excel document for a photography survey, encouraging the target to open it at work using their corporate email. Threat actors likely leveraged the persona to gain access to a targeted organization because the initial phishing campaign was unsuccessful.

Targeting emotional vulnerabilities and building trust: Operations around traumatic events

Iranian cyber threat actors use personas to develop trust with a target by sharing their concerns around major traumatic events and tragedies. For example, Iranian cyber threat actors had reportedly run an Israel-Hamas war-themed campaign creating a fake website for the “Bring Them Home Now” movement, which calls for the return of Israeli hostages held by Hamas, where the website would eventually lead to downloading a malicious payload.

In October 2022, after the death of Mahsa Amini and ensuing protests in Iran, Iranian cyber threat actors used a false Twitter (now X) persona, Sara Shokouhi, to conduct a spear phishing campaign targeting female protestors, political activists and human rights researchers inside and outside of Iran. The persona reached out to victims, purportedly on behalf of the U.S. Atlantic Council think tank, to gain trust and build rapport with victims over several weeks after which it attempted to either steal credentials or deploy malware on their computer or mobile device.^{Footnote 5}

Offering false professional opportunities and collaboration

Iranian cyber threat actors appeal to shared professional interests, offering to collaborate with the target, gaining more trust and access to information throughout the process. For many fields, including academia, journalism, research, activism and NGOs, online collaboration is considered routine. Targets in these professions are valuable not only for their knowledge, but also for their networks of contacts and the places and people that they may have access to.

Job opportunities

Iranian cyber threat actors have run many operations using personas posing as recruiters and employees of companies from the countries in which their targets were located to offer targets prospective job opportunities. These operations typically target U.S. defence contractors in the Middle East and subcontractors associated with larger defence companies.^{Footnote 2}

Think tanks and research institutes

Iranian actors impersonated the president of the U.S.-based Middle East Institute and contacted Iranian and non-Iranian activists asking to establish a partnership with the target and collaborate in the target’s area of expertise. After building trust with the target over correspondence, actors invited them to participate in a virtual meeting, sending a malicious link to steal the target’s credentials.^{Footnote 6}

Conferences

In a 2021 operation to gather strategic insights on relations with Tehran, Iranian cyber threat actors masqueraded as scholars from the University of London’s School of Oriental and African Studies (SOAS) organizing a conference. Personas targeted experts in foreign policy, journalism, and academics specializing in Middle East politics. They established relationships and communicated with targets eventually leading them to a conference registration link hosted on a compromised website.^{Footnote 2}

Iranian cyber threat actors reportedly targeted Human Rights Watch staff members, journalists and human rights activists using WhatsApp, claiming to be from a Lebanon-based think tank, inviting recipients to a conference. The actor impersonated an individual who had previously worked at the think tank and used a similar format to the think tank’s previous invitations.^{Footnote 2Footnote 3}

Media and expertise

Iranian cyber threat actors have used journalistic personas on multiple occasions to conduct intrusion or influence operations against targets. Reporting in 2020 indicates that Iranian actors developed fake personas that spoofed real journalists from major news entities including the New York Times, CNN and The Wall Street Journal. Actors would engage with victims driving them to encrypted chat platforms like WhatsApp, eventually moving to fake video conferences where presumably the victim would continue to be compromised.^{Footnote 3}