In an unprecedented, three-year cyber espionage campaign, Iranian hackers created false social networking accounts and a bogus news website to spy on military and political leaders in
The firm declined to identify victims and said it could not say what data had been stolen by the hackers, who were seeking credentials to access government and corporate networks, as well as intelligence on weapons systems and diplomatic negotiations. "If it's been going on for so long, clearly they have had success," iSight Executive Vice President
ISight dubbed the operation "Newscaster" because it said the Iranian hackers created six "personas" who appeared to work for a fake news site, NewsOnAir.org, which used content from the
The hackers set up false accounts on
To build credibility, hackers approached high-value targets after establishing ties with victims' friends, colleagues, relatives and other connections over social networks including
The hackers would initially send the targets content that was not malicious, such as links to news articles on NewsOnAir.org, in a bid to establish trust. Then they would send links that infected PCs with malicious software, or direct targets to web portals that ask for network log-in credentials, iSight said.
The hackers used the 14 personas to make connections with more than 2,000 people, the firm said, adding that it believed the group ultimately targeted several hundred individuals.
"This campaign is not loud. It is low and slow," said Jones. "They want to be stealth. They want to be under the radar."
ISight said it had alerted some victims and social networking sites as well as the
"We removed all of the offending profiles we found to be associated with the fake NewsOnAir organization and we have used this case to further refine our systems that catch fake accounts," Nancarrow said.
ISight disclosed its findings as evidence emerges that Iranian hackers are becoming increasingly aggressive in the wake of the 2010 Stuxnet computer virus attack on
ISight said it could not ascertain whether the hackers were tied to
The firm said NewsOnAir.org was registered in
Among the 14 false personas were reporters for NewsOnAir, including one with the same name as a Reuters journalist in
A spokesman for
Most Popular Stories
- Prosecutor to Investigate Walmart Police Shooting
- GM to Announce New Jobs in Tennessee
- Emirates Hit Libyan Targets With Airstrikes
- Michael Brown Funeral: Can Americans Change the Script of Violence?
- Smith & Wesson Misses Target
- American Killed With ISIS Fighters in Syria
- Marco Rubio Warns Obama on Deportations
- Hamas Claims Gaza Ceasefire as Victory Over Israel
- Surf's Up! SoCal Prepares for Big Storm Surf
- Ford Hires 300 at Louisville Lincoln Plant