Novel Iran-linked threat operation sets sights on US academics

More than 20 academics and experts part of a U.S.-based think tank focused on Iran-related policy have been targeted by the newly emergent UNK_SmudgedSerpent threat cluster in cyberattacks between June and August as geopolitical tensions between Iran and Israel flared, The Hacker News reports.

UNK_SmudgedSerpent distributed illicit emails with domestic political lures to deceive targets into downloading a Microsoft Teams-spoofing MSI installer that launches remote monitoring and management software, according to a Proofpoint analysis.

Another attack chain involved the spread of a fake Microsoft Teams login page with a "Join now" button, said researchers, who noted the adversary's removal of the password requirement on the page following suspicions from targets. Such techniques were akin to Iranian cyberespionage operations TA455, TA453, and TA450.

"The campaigns align with Iran's intelligence collection, focusing on Western policy analysis, academic research, and strategic technology. The operation hints at evolving cooperation between Iranian intelligence entities and cyber units, marking a shift in Iran's espionage ecosystem," said Proofpoint.