Thread by @arawnsley

My latest: Someone has spent the past four years creating fake Mossad recruiting websites and buying Google Ads to target them at intelligence and military veterans from Iran, the Assad regime, and Hezbollah. thedailybeast.com/shady-network-…

We found the sites while looking into a series of phishing domains that spoofed legitimate news organizations like Business Insider, Jerusalem Post, and the UAE-based Khaleej Times along with think tanks like the Quincy Institute, Stimson Center, Begin-Sadat Center, & Gatestone

Bit of a thread here. Meet "VIP Human Solutions," which pretends to be an Israel-based "consulting" firm interested in hiring intelligence & security veterans of the Assad regime & Hezbollah. They claim to offer big salaries & fast hiring for folks with the right experience.

It's one of at least 16 sites spanning a four year period that use the same phrasing, logo, and at times, the same Google Analytics account and Israeli phone numbers and Telegram accounts to accept resumes and place google ads to Internet users in Iran/Syria/Lebanon

This is pretty obviously not how the Mossad does business and intelligence experts tell us it's extremely unlikely these sites are operated by Israel. The Daily Beast, Mandiant, Facebook, and Google (where the sites had accounts) couldn't identify who's behind the sites.

But @AminSabeti, a cybersecurity researcher at CERTFA, suspects that the sites are part of an Iranian counterintelligence effort—“a honey trap by the [Iranian] regime to identify the potential people interested in working with the foreign intelligence services.”

The weird thing about these sites is that they're not blocked in Iran despite Iran being very block-happy on Israeli websites and having had multiple opportunities to be aware of them. Mashregh, a news outlet close to Iranian security services, covered one mashreghnews.ir/news/1153970/%…

Mashregh speculated that the sites were being targeted at users of illicit gambling and gaming websites in Iran. And Iranian social media users have posted screenshots reacting with confusion/anger/bemusement when being targeted with the ads.

At least one Twitter user claimed to encounter an ad for one of these sites from a third party ad service running on the New York Times website

https://twitter.com/aliahmadi_iran/status/1349347208194379776

I spoke to Douglas London, a 34-year veteran of the CIA and the recent author of a memoir of his service, "The Recruiter," who said the crude and clumsy methods make it deeply unlikely this is run by Israel's intelligence services

https://twitter.com/douglaslondon5/status/1485657270709108741

Here's some IOC for you:

vipjobsglobal[.]com
topiranjobs[.]me
salamjobs[.]me
damkahill[.]com
azadijobs[.]me
bilal1com[.]com
jomehjob[.]com
radabala[.]com
dream-jobs[.]org
dream-jobs[.]vip
trnjobs[.]me
wazayif-halima[.]org
wazayif-halima[.]com
damavand-hr[.]me
golanjobs[.]me

What's interesting is how we came across these fake jobs. It started with a single tweet from a Jerusalem Post reporter warning people that someone had set up a fake Post domain and was impersonating her via email through the domain.

https://twitter.com/LahavHarkov/status/1473606164617342978

The Daily Beast is lucky enough to have a DomainTools account. Folks very quickly realized after the tweet that there was another spoofed news org hosted at the same IP address, one of only 3 domains there.

https://twitter.com/ariehkovler/status/1473615365779431428

And there the trail ended. Or did it? I noticed that the fake Jerusalem Post domain and the fake Khaleej Times domain used a broadly commercial registrar (NameSilo), mail provider (Zoho), and name server (cloudns). Thousands upon thousands of legit sites use these services.

But if you run a query in DomainTools IRIS to find all current websites who use the three companies for those three services, you get only 68 website—a much smaller haystack to sift through. Among those 68 sites matching the pattern was one of the VIP Human Solutions domains.

Most of those 68 sites were boring, legit sites. But a handful of them—all hosted at an obscure Bulgarian host, Belcloud, looked a lot like phishing domains meant to spoof Middle East and security-focused think tanks along with Google login pages.

This cluster of Belcloud sites tried to spoof:
•Quincy Institute
•Begin-Sadat Center
•Stimson Center
•Gatestone Institute
•Galil Engineering (an Israeli engineering firm)
•Lots of Google-ish logins

@AminSabeti at CERTFA also found linked infrastructure with the same host/pattern with a spoof of Business Insider

@AminSabeti Interesting bit: there's some limited overlap between the domains and tactics we found and a previously reported phishing activity attributed to Charming Kitten, an Iranian intelligence linked hacking group. blog.certfa.com/posts/fake-int…

Like the fake emails sent out in the Lahav's name from the fake Jerusalem Post domain, this 2020 operation tried to set up interviews via fake reporters/think tanks. reuters.com/article/us-ira…

One of the domain names in that reported/activity activity set—most of which were hosted at the same Bulgarian hosting company—moved from Belcloud and was hosted at the same IP address as the fake Jerusalem Post/Khaleej Times domain. It's far from attribution but it is curious

One last bit on the fake Mossad jobs sites. I reached out to one of the Telegram accounts, which showed as recently active, and sent them a resume. No response or job offer :/

Interesting coda

https://twitter.com/AliAhmadi_Iran/status/1485671469208195072