Iranian state-backed hackers posed as flirty Scouser called Marcy to target workers in defence and aerospace
- Reference: 1627490712
- News link: https://www.theregister.co.uk/2021/07/28/flirty_scouse_fitness_instructor_actually_iranian_spy/
- Source link:
Researchers from Proofpoint said this morning they had uncovered a fake social media account being operated by state-backed Iranians, tracked internally by the enterprise security firm as TA456.
Using the alias Marcella Flores, the Iranians patiently built up a relationship with their targets "over years" to convince them to open malware-laden emails on useful devices – even sending a video of "herself" to sucker in her unwitting targets.
[1]
"Once the malware, which is an updated version of Liderc that Proofpoint has dubbed LEMPO, establishes persistence, it can perform reconnaissance on the infected machine, save the reconnaissance details to the host, exfiltrate sensitive information to an actor-controlled email account via SMTPS, and then cover its tracks by deleting that day's host artifacts," said the infosec outfit in a blog post published today.
[2]
[3]
Variously known as Imperial Kitten and Tortoiseshell, the Iranian crew tracked by Proofpoint apparently has a taste for using western female aliases. In the case of Marcella "Marcy" Flores, they went a little deeper than has previously been seen in public.
A screenshot of "her" now-deleted Facebook page showed an unremarkable profile that wouldn't have raised questions in a non-friend's mind – exactly as it was intended to be.
[4]
The fake Marcy account spotted by Proofpoint
"The 'Marcella' profile appeared to be friends with multiple individuals who publicly identify as defense contractor employees and who are geographically dispersed from 'Marcella's' alleged location in Liverpool, UK," said Proofpoint.
[5]America world's sole cyber superpower, ten years ahead of China, says Brit think tank
[6]Dozens of Iranian media websites devoured by the Great Satan, apparently
[7]Iran bans cryptocurrency mining for four months as the weather – and election campaigns – start to heat up
[8]SAP to pay $8m in non-prosecution agreement with US authorities over Iran sanction violations
South of Liverpool is the Airbus wing factory at Hawarden, just inside the Welsh border. A couple more miles brings you to BAE Systems' factory at Broughton, which among other things carries out final assembly of Eurofighter Typhoon jets for European air forces. It takes little to imagine engineers at either location potentially chatting to what they believed to be a local girl – though Proofpoint did not name the contractors involved.
The takedown of "Marcy" came when Facebook summarily deleted a bunch of Iran-related mischief from its website [9]earlier this month , highlighting fake accounts "designed to attract particular targets within the aerospace and defense industries" and deceive the victims into visiting credential-harvesting sites.
[10]
Symantec previously published [11]detailed research into Tortoiseshell, setting out its targeting of IT companies in supply chain attacks. Cisco Talos has also found it [12]targeting US military leavers hunting for jobs.
While there appears to be significant overlap between Tortoiseshell, Imperial Kitten, and APT35, there is no consensus on whether the APT is one and the same as the featured hacking crew above. ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YQHTd4qNa1iZ0UmOwEhpzAAAANM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQHTd4qNa1iZ0UmOwEhpzAAAANM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQHTd4qNa1iZ0UmOwEhpzAAAANM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://regmedia.co.uk/2021/07/28/proofpoint_fake_profile_iranian.jpg
[5] https://www.theregister.com/2021/06/29/international_institute_for_strategic_studies_cyber_study/
[6] https://www.theregister.com/2021/06/22/iran_media_websites_us_government_seized/
[7] https://www.theregister.com/2021/05/27/iran_bans_cryptocurrency_mining/
[8] https://www.theregister.com/2021/04/30/sap_iran_sanctions/
[9] https://about.fb.com/news/2021/07/taking-action-against-hackers-in-iran/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQHTd4qNa1iZ0UmOwEhpzAAAANM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain
[12] https://blog.talosintelligence.com/2019/09/tortoiseshell-fake-veterans.html
[13] https://whitepapers.theregister.com/
patiently built up a relationship with their targets "over years"
"But Granny Marcy! What big purse you have there," said Little Red Riding Robin Hood as he edged closer to her bed...
Retaliation
UK Cyber Defence Force Commandos are currently infiltrating Iranian nuclear facilities by sending videos of the Rugby team in drag.
UK Cyber Defense Force is currently trying to expand it's recruitment to non-traditional candidates who may have gone to a school where there were girls !
Re: Retaliation
Are you saying that the UK Cyber Defence Force would dare imply that gender is binary?!??
I've definitely met women on these apps where this is the most logical explanation for their behaviour to date.
Ahh, yes, but
Some of us are hunky (please see icon) and liverpudlian babes swarm us! All offering naked videos with the filename 'payload.exe'. I was a bit suspicious when some old bird 'Cilla Black' started giving me the glad eye:-) though.
Can't believe people
Are dumb enough to accept a random friend request from someone they don't know. Yeah yeah I'm sure they targeted "lonely loser" type guys who are perhaps more likely to accept a friend request from a young hottie, but they're the ones who should be the most suspicious if they're being honest with themselves.
Still I guess if you try it with a few hundred people you only need a 1% success rate, and then a lot of patience if as they said it was a multi year effort.
Re: Can't believe people
Such is the nature of social media. I have a friend who uses FB and claims he has several thousands "friends". WTF? Maybe the "name" should be "acquaintances" instead of "friends".
Re: Can't believe people
I have people who are acquaintances as "friends", and depending on who they are might accept a friend request from them even if I only met them once or wasn't sure I'd ever see them again - if they were interesting in person they might be interesting online. You can always remove them later.
What I don't do is accept requests from people I've never met. If I see there are some mutual friends I might give them a closer look wondering "maybe I know them and just don't remember" but I figure most friend requests out of the blue are scams of some sort, or desperately lonely people that I don't want to deal with.
Non grata
My Iranian girlfriend (unless she was a scouser pretending) said she was going back to Tehran to see her family. I said I'd join her because I'd love to see her country and meet her parents. "No, silly, they'd kill you."
"Your parents would kill me? I mean I don't actually like meeting parents but that is the best excuse ever."
"No silly,, my parents would love you. The mullahs would kill you., and they'd kill me too. We're not married."
The best girlfriends leave you with anecdotes rather than STDs.
Crickets . .
I'm curious to hear a response from the several commenters who so forcefully disagreed a few weeks ago with Uncle Sam taking down Iranian or Iranian-backed sites for spreading misinformation.
https://www.theregister.com/2021/06/22/iran_media_websites_us_government_seized/
I know "all my data are belong to (the) US." I also don't believe that means Iranian cybercrimes and misconduct should be left without a proportional response. This scam is a serious assault on the UK defence industry. Let's see what the UK response is.