NEW: #Iran-based hackers known as "Tortoiseshell" targeted US military, defense companies in US, #Britain, #Europe per @Facebook
"This group used various malicious tactics to identify its targets & infect their devices with malware to enable espionage"
about.fb.com/news/2021/07/t…
"This group used various malicious tactics to identify its targets & infect their devices with malware to enable espionage"
about.fb.com/news/2021/07/t…
"This activity had the hallmarks of a well-resourced & persistent operation, while relying on relatively strong operational security measures to hide who’s behind it" per @Facebook
#Iran hackers
#Iran hackers
.@Facebook's platform just one element in a "much broader cross-platform cyber espionage operation"by #Iran-based #Tortoiseshell
"Activity on Facebook manifested primarily in social engineering...driving people off-platform, rather than directly sharing the malware itself"
"Activity on Facebook manifested primarily in social engineering...driving people off-platform, rather than directly sharing the malware itself"
"Tortoiseshell deployed sophisticated fake online personas to contact its targets, build trust & trick them into clicking on malicious links" per @Facebook "These fictitious personas had profiles across multiple social media platforms to make them appear more credible"
re #Iran
re #Iran
"These accounts often posed as recruiters & employees of defense & aerospace companies from the countries their targets were in" per @Facebook "Other personas claimed to work in hospitality, medicine, journalism, NGOs & airlines"
The #Iran-based #Tortoiseshell hackers also "created a set of tailored domains designed to attract particular targets...Among them were fake recruiting websites for particular defense companies" per @Facebook
#Iran's #Tortoiseshell "used custom malware tools we believe to be unique to their operations, including full-featured remote-access trojans, device and network reconnaissance tools and keystroke loggers" per @Facebook
"A portion of their malware was developed by Mahak Rayan Afraz (MRA), an IT company in #Tehran with ties to the Islamic Revolutionary Guard Corps (#IRGC)" per @Facebook
Background from @Mandiant Threat Intelligence:
#Tortoiseshell, aka UNC1833 "has historically targeted people and organizations affiliated with the U.S. military and information technology (IT) providers in the Middle East since at least 2018" per sr principal analyst Sarah Jones
#Tortoiseshell, aka UNC1833 "has historically targeted people and organizations affiliated with the U.S. military and information technology (IT) providers in the Middle East since at least 2018" per sr principal analyst Sarah Jones
"We assess that a front company tied to #IRGC is involved in these operations" per @Mandiant's Jones
"#Iran is still an aggressive cyber actor that shouldn’t be ignored"
"#Iran is still an aggressive cyber actor that shouldn’t be ignored"
"The existence of #Trump related domains is notable, though we have no evidence that these domains were operationalized or used to target anyone affiliated w/the Trump family or properties" per @Mandiant's Jones 
#Trump domains - #Iran/#Tortoiseshell (UNC1833):
"Domains such as these could suggest social engineering associated w/US political topics" per @Mandiant's Jones
"In the past we have seen targeting of the US political sphere by #IRGC affiliated actors"
"Domains such as these could suggest social engineering associated w/US political topics" per @Mandiant's Jones
"In the past we have seen targeting of the US political sphere by #IRGC affiliated actors"
• • •
Missing some Tweet in this thread? You can try to
force a refresh
