Iranian Hackers Pose as Journalists to Trick Victims Into Installing Malware

An Iranian cyberespionage group known for targeting
government, defense technology, military, and diplomacy sectors is
now impersonating journalists to approach targets via LinkedIn and
WhatsApp and infect their devices with malware.

Detailing the new
tactics^[1] of the “Charming Kitten”
APT group, Israeli firm Clearsky said, “starting July 2020, we have
identified a new TTP of the group, impersonating ‘Deutsche Welle’
and the ‘Jewish Journal’ using emails alongside WhatsApp messages
as their main platform to approach the target and convince them to
open a malicious link.”

This development is the first time the threat actor is said to
have carried out a watering hole attack through WhatsApp and
LinkedIn, which also includes making phone calls to victims,
Clearsky noted in a Thursday analysis.

After the company alerted Deutsche Welle about the impersonation
and the watering hole in their website, the German broadcaster
confirmed, “the reporter which Charming Kitten impersonated did not
send any emails to the victim nor any other academic researcher in
Israel in the past few weeks.”

Charming
Kitten^[2] (also known by aliases
APT35, Parastoo, NewsBeef, and Newscaster) has been previously
linked to a series of covert campaigns at least since December 2017
with an aim to steal sensitive information from human rights
activists, academic researchers, and media outlets.

The watering hole — in this case, a malicious link embedded in the
compromised Deutsche Welle domain — delivered the info-stealer
malware via WhatsApp, but not before the victims were first
approached via tried-and-tested social engineering methods with an
intention to lure the academics to speak at an online webinar.

“The correspondence began with an email sent to the target,
initiating a conversation,” Clearsky explained. “After a short
conversation with the target, the Charming Kitten attacker requests
to move the conversation to WhatsApp. If the target refuses to move
to WhatsApp, the attacker will send a message via a fake LinkedIn
profile.”

In one scenario, the adversary even took the step of messaging and
calling a victim to gain the target’s trust and subsequently walk
the person through the steps of connecting to the webinar using the
malicious link earlier shared in the chat.

Although APT35 may have picked up a new ruse, this is not the
first time the Iranian hackers have used social media channels to
spy on personnel of interest.

In a three-year-long “Operation
Newscaster^[3]” uncovered by iSIGHT
Partners (now owned by FireEye) in 2014, the threat actor was found
to have created false Facebook accounts and a fake news website to
spy on military and political leaders in the U.S., Israel, and
other countries.

“In this campaign, we observed a willingness of the attackers to
speak on the phone directly with the victim, using WhatsApp calls,
and a legitimate German phone number. This TTP is uncommon and
jeopardizes the fake identity of the attackers,” Clearsky
researchers said.