The hacking group Cleaver returns to the headlines with a new social engineering campaign, which targets entities in the Middle East.
By leveraging a well-established network of fake LinkedIn, attackers are attempting to infiltrate business circles related to defense companies and telecommunications operators for cyber-espionage purposes.
According to Dell's SecureWorks Counter Threat Unit Threat Intelligence research team, the actors behind the attack appear to be the same ones who ran the Operation Cleaver, targeting critical infrastructure in organizations around the world.
Dell states that “the group is now focusing on developing a network of fake LinkedIn profiles, creating false identities of purported high‑tech professionals, and attempting to contact multiple companies in various countries”.
The majority of attackers' targets involve businesses in the telecommunications sector, primarily companies in the Middle East and North Africa. The group also targets the aerospace, defense, education, and energy sectors, as well as government entities.
Analysis of the fake profile network
Dell has managed to identify 25 fake profiles on LinkedIn so far, and as it points out, all have been created to support 8 accounts with the code name “leader personas”.
The secondary accounts exist only to support the “leaders” by providing them credibility through the creation of a network of followers around them.
“The level of detail in the profiles shows that the attack actors have invested significant time and effort in creating and maintaining these profiles” reports the study published by Dell. “Five of the lead “personas” appear as recruitment consultants, and in this way they manage to get in touch with their prospective targets”.
The structure of the network of fake LinkedIn accounts
