Meta Removes Two Separate Iranian Cyberespionage Networks
Meta, formerly the Facebook company, has removed two Iranian cyberespionage groups that were targeting academics, activists, journalists and other victims.
Meta, formerly the Facebook company, has removed two Iranian cyberespionage groups that were targeting academics, activists, journalists and other victims.
The first network was linked to a group of hackers known in the security industry as UNC788. The network is Iran’s decade-long campaign of credential harvesting and surveillance operations that is possibly sponsored by Revolutionary Guard (IRGC). It targets Iranian diaspora, dissidents and human rights activists from Israel and Iran, Iran-focused academics, politicians in the US, people in the Middle East including the Saudi military, and journalists around the world.
The other group is a separate newly identified cyberespionage network that was targeting companies in the energy, telecommunications, maritime logistics, semiconductor, and information technology in several countries, including the United States, Israel, Saudi Arabia, UAE, Russia, Canada, and others.
The previously unreported hacking group relied on phishing and extensive social engineering tactics to impersonate the domains of legitimate companies and used a complex network of fake personas across Facebook, Telegram, and other platforms along with a network of fake recruiting firms.
Both groups used unique malware applications disguised as a VPN app, a salary calculator, an audio book reader, a chat app, a birthday calendar app, or a Quran app.
Law enforcement sources told CBS News on Thursday that investigators were looking into the possible ties of two men arrested by the Federal Bureau of Investigation (FBI) in Washington, DC, on Wednesday to Iranian intelligence including to the Revolutionary Guards (IRGC) and its extraterritorial arm, the Qods (Quds) force.
Arian Taherzadeh and Haider Ali had since February 2020, soon after the US targeted killing of Iran's Qods Force Commander Ghasem Soleimani in Iraq, posed as officers and employees of the US government, including members of federal law enforcement agencies.
According to US prosecutors, Ali, 36, had told witnesses that he had connections to the Pakistani intelligence service and his passport contained Pakistani visas as well as two Iranian visas from 2019 and January 2020. He appears to have travelled to Iran on one of the visas, prosecutors said without specifying the date.
The second suspect, Ali Taherzadeh, 40, has an Iranian name but is apparently a US citizen now. Some media have claimed that Taherzadeh who previously lived in Missouri, was in hundreds of thousands of dollars in debt, repeatedly finding himself on the run from creditors.
The conspiracy began in February 2020, according to the Washington Post. This coincides with the killing of Iranian Revolutionary Guard general Qasem Soleimani in a US airstrike in Baghdad in January 2020 for which Iranian officials have repeatedly vowed revenge. Five days after the killing, Iran fired more than a dozen ballistic missiles at military bases in Iraq hosting US troops, but officials often say that was not the end of Iran's revenge.
The US has arrested or charged others on suspicion of ties with Iranian intelligence on several previous occasions including July 2021 when four members of an alleged Iranian spy network were charged with plotting to kidnap an Iranian-American journalist based in New York.
Iran's threats against US officials for Soleimani's killing is apparently one of the biggest hurdles in Vienna nuclear talks. Washington wants such threats to stop if Tehran wants the IRGC to be removed from the list of Foreign Terrorist Organizations (FTO).
Iran’s Supreme Leader Ali Khamenei vowed revenge for Soleimani in a speech on January 1, saying Trump and others like him would be "forgotten and lost in the dustbin of history" but only "after paying for their crimes in the world”.
In a televised speech two days later, President Ebrahim Raisi said that "Muslims" would take revenge" if Trump and former Secretary of State Mike Pompeo were not "tried in a fair court for the criminal act of assassinating Soleimani."
At the time of Soleimani's killing, Raisi, then Chief Justice, threatened Trump that he would not be "immune to the enforcement of law and justice" and said none of those responsible would be "safe anywhere on the globe."
On January 6, 2021 the commander of Iran's Qods (Quds) Force Esmail Ghaani was quoted by Iranian media as saying that "revenge [for Soleimani] has started from day one and you will not have peace even in your own homes...and it cannot be ruled out that we take revenge in your own home."
