A group linked to Iran has been identified as responsible for a “coordinated” and “multi-wave” spear-phishing campaign targeting embassies and consulates in Europe and other regions of the world. The Israeli cybersecurity company Dream has attributed this activity to operators aligned with Iran, connecting it to broader cyber operations carried out by the group known as Homeland Justice.
Iran (but they won’t return)
Email messages sent to multiple government recipients worldwide disguised legitimate diplomatic communications. This effort of digital espionage has occurred in a context of high geopolitical tension, especially between Iran and Israel. The attacks use themes related to these tensions to lure victims into opening malicious Microsoft Word documents that, when activated, prompt users to “Enable content” to run a Visual Basic for Applications (VBA) macro, which has the capability to deploy malware.
The messages were sent from 104 compromised addresses, many of which belong to officials and pseudo-governmental entities, including a hacked email from the Ministry of Foreign Affairs of Oman in Paris. The emails targeted embassies and international organizations in various regions, with European embassies and African organizations being the most affected by this campaign.
The obfuscation technique used aims to hide attribution and ensure the persistence of malware in infected systems. This type of operation is not new; ClearSky, another cybersecurity company, has noted that similar methods were employed by Iranian threat actors in 2023 when attacking Mojahedin-e-Khalq in Albania. It is assessed with moderate confidence that this activity is linked to the same Iranian threat actors.
