Iran-Linked Hackers Target Nuclear Security Experts
A state-sponsored Iranian hacker group recently employed a new infection chain to target a nuclear security expert at a US think tank.
A state-sponsored Iranian hacker group recently employed a new infection chain to target a nuclear security expert at a US think tank.
Charming Kitten, also known as TA453, APT42, Mint Sandstorm, and Yellow Garuda earlier targeted high-value accounts in government, academia, NGOs, national security, and journalism.
As part of their recent operation, the IRGC-linked group used a benign email to begin a relationship with their target. Then they sent a follow-up email containing a malicious macro that directed the target to a Dropbox URL.
“Using a .rar and LNK file to deploy malware differs from TA453’s typical infection chain of using VBA macros or remote template injection. The LNK enclosed in the RAR used PowerShell to download additional stages from a cloud hosting provider,” a new analysis by Proofpoint says.
“The use of Google Scripts, Dropbox, and CleverApps demonstrates that TA453 continues to subscribe to a multi-cloud approach in its efforts to likely minimize disruptions from threat hunters. (...) Regardless of the infection method, TA453 continues to deploy modular backdoors in an effort to collect intelligence from highly targeted individuals,” Proofpoint said.
In April, Microsoft warned that hackers linked to Iran are targeting critical US infrastructure including transport, energy and ports. A report by Microsoft Threat Intelligence revealed the threat from the Iranian hackers, known as "Mint Sandstorm".
Initially engaged in reconnaissance, the subgroup eventually began attacking critical infrastructure organizations in the United States in 2022. In November 2021, the United States Justice Department indicted two Iranians, Mohammad Hosein Musa Kazemi and Sajjad Kashian, who were employed by Emennet Pasargad. During the 2020 presidential election, they allegedly conducted a cyber campaign "to intimidate and influence American voters".
According to Iranian law enforcement officials in Sistan-Baluchistan province, four gunmen attacked the police station using hand grenades and seized control of a watchtower. The attack was still ongoing as of noon local time. In early afternoon, officials said that all four gunmen were eventually killed and the situation around the heavily protected police compound returned to normal.
These circumstances suggest that since the attack began at around 7:15 am, it took hours to subdue the gunmen. This raises questions about whether the details provided by the authorities accurately represented the event.
Other reports have mentioned one or two suicide bombers detonating explosives to create an entry point for others into the heavily guarded premises. However, police officials insist that there were no suicide bombings and only hand grenades were used.
Tensions in Zahedan have been high since security forces, under the command of the Revolutionary Guard, killed an estimated 80-90 civilian protesters in the city on September 30, 2022, marking the start of anti-regime nationwide protests in Iran. This tragic event became known as Black Friday.
Since then, the people of Zahedan have been participating in peaceful demonstrations every Friday after prayers and sermons by their respected religious leader, Mowlana Abdolhamid.
One hour after the attack began, Abdolhamid disassociated himself from the incident and called for peace and security. However, some speculate that the authorities can use the incident to restrict his freedom, possible putting him under house arrest.
The authorities have attempted to intimidate and silence Abdolhamid, who has strongly criticized the rulers of the Islamic Republic in his sermons. He has called for a referendum on the future of the country, respect for women, the release of political prisoners, and genuine elections.
The government has failed to launch a proper investigation into the mass killings that occurred during Black Friday, which has been one of Abdolhamid's demands. No security officials have been arrested or suspended.
Some reports suggested that the police station - precinct #16 - was the compound from where security forces opened fire on September 30, 2022, because it was close to the main mosque where people began their protest march.
Although incidents of attacks against security forces have occurred in the impoverished and desolate province for years, the general population has remained peaceful. On June 30, Zahedan residents held a silent march in the city.
In this instance, no one knows who the attackers are and it cannot be ruled out that the whole incident could have been staged by security and intelligence organs to clamp down on Zahedan's residents and particularly Abdolhamid.
In recent weeks, the regime has escalated pressure on the outspoken cleric by arresting several individuals from his inner circle and supporters. Additionally, Abdolhamid has been prevented from leaving Iran for the annual Hajj pilgrimage in Saudi Arabia.
In June, his grandson and several aides were arrested. The Makki Mosque, Abdolhamid's headquarters in Zahedan, has become a center of resistance against the government since September 2022. It is where Abdolhamid delivers his weekly sermons, openly criticizing Supreme Leader Ali Khamenei's regime.
These arrests followed reports that the Revolutionary Guard's intelligence arm had assigned a hitman to poison and kill the prominent Sunni cleric. Security guards at Makki Mosque apprehended a man posing as a religious student who allegedly intended to assassinate the Sunni leader.
Last updated at 16:00 GMT, July 8
Mohammad Ramez Rashidi and Naeem Hashem Ghetali were hanged in a street near the Shahcheragh Shiite shrine and mausoleum in the southern city of Shiraz early in the morning. Iran's official news agency IRNA said they were hanged before dawn with “hundreds of the families of the martyrs” and other citizens of Shiraz witnessing the executions.
The attack on Shahcheragh shrine took place October 26 last year when anti-regime protests were raging on in Iran. This led to speculations and accusations that the attack was staged by the government to divert attention from the protests and also justify a crackdown.
However, in a strange twist, the Islamic State group took responsibility for the attack, which fit the government narrative of Iran being under attack by extremists.
The lone gunman, who entered the shrine with an assault rifle, was shot and wounded during the attack and the government said he died later in the hospital and identified him as a citizen of Tajikistan. The two men who were hanged July 8 were accused of playing a direct role in the "arming, procurement, logistics, and guidance of the main perpetrator" of the terrorist attack.
Iranian human rights groups have said that the trial of the two men was not held according to legal standards and their conviction and subsequent death penalties were illegal.
Mahmood Amiry-Moghaddam, director of Norway-based Iran Human Rights, said Thursday that the two Afghan nationals were sentenced to death after “grossly unfair trials where no evidence was presented against them.”
Documents released by a hactivist group in early December showed that the Revolutionary Guard might have has foreknowledge of the attack and did nothing to stop it.
The documents, released by hacking group Black Reward, were several reports prepared by the IRGC’s media arm, Fars news agency, which were marked “top secret” and indicated that the author believed at least parts of Iran's several intelligence organizations had knowledge of an imminent terrorist attack but did not take any action to stop it.
Many Iranians immediately after the attack began accusing the regime of organizing the terror act as some kind of distraction from the boldest and most widespread protests in 43 years of clerical rule. Some even alleged that the government of complicity with ISIS in the attack to create its own narrative and martyrs to divert attention from fierce anti-regime protests.
CCTV footage shown on state TV showed the gunman entering the popular shrine despite the usual heavy security measures with a weapon and firing at worshippers as they tried to flee and hide in corridors.
The attacker, identified as Sobhan Komrooni with the nickname “Abu Aisha”, a citizen of Tajikistan, later died in a hospital from injuries sustained during the attack, according to the government.
Iran's intelligence ministry in a statement in November claimed that a citizen of the Republic of Azerbaijan who was the “main element of directing and coordinating the attack” had flown from Baku and entered Iran through Tehran’s Imam Khomeini Airport. According to the statement, he had then contacted the ISIS network of foreign nationals in Iran and organized the attack.
Some people at the time also noted a similarity with a 1994 terrorist attack on the shrine of Imam Reza in Mashhad which killed and injured dozens of people. Although a Sunni group had claimed responsibility, the government laid the blame on the People’s Mujahedin Organization of Iran (MEK). However, the former Interior Minister Abdollah Nouri claimed during his trial in 1999 that it was a false flag operation by the Iranian regime to discredit MEK.