Facebook was the first company to notice Iranian hackers infiltrating email accounts of US State Department employees focused on Iran
.
The attacks appear to have been politically motivated and aimed at gathering information on Iranian-American citizens in Iran. Earlier this month, computers at the U.S. State Department and other government agencies were targeted by hackers. Experts linked the perpetrators to Iran’s Revolutionary Guard Corps, according to researchers. The Facebook and emails of State Department employees were intended to gather information on Iranian-American citizens and the arrest of an Iranian-American businessman in Tehran in October.
Hackers breached the social media accounts of lower-level Ministry officials and launched a phishing campaign targeting State Department employees working on Iranian affairs, as well as employees of the Bureau of Oriental Affairs and some journalists .
Facebook was the first to notice the campaign and notified some of the users whose accounts had been compromised. A senior US official said that “the attack was very well planned and showed the extent to which they understood which of our employees were working on Iranian matters now that the nuclear deal was in place. ”
The recent wave of attacks came after a period of apparent calm, and security experts have observed an evolution in the Iranian hackers’ TTPs. The Iranians initially targeted the financial industry but have since limited their activities to sabotage targeted infrastructure, such as the attack on casino company Las Vegas Sands Corp. The fact that the hackers were more interested in destruction than in gathering information has led authorities to believe that they are likely hacktivists rather than state-sponsored.
The recent attacks on the State Department are clearly an act of cyber espionage that were initially attributed to Chinese hackers who may have infiltrated the department's email systems.
