Google warns of escalating activity of state-backed hackers | the pirate

[ad_1]

Google has warned of an increase in the activity of government-backed hackers this year, including attacks from an Iranian group whose targets include a British university.

The research group said that so far in 2021 it has sent more than 50,000 warnings to account holders that they have been the target of phishing attempts or government-backed malware. Google said in a blog post that this is a one-third increase from the same period last year, with a rise attributed to an “unusually large campaign” by a Russian hacking group known as APT28, or Fancy Bear.

However, the Google post focused on a group linked to the Iranian Revolutionary Guards, known as APT35, or Charming Kitten, that regularly conducts phishing attacks — where, for example, an email is used to trick someone into delivering sensitive information or to install malware. .

“This is one of the groups that we disabled during the 2020 US election cycle for targeting campaign staff,” wrote Ajax Bash, of Google’s Threat Analysis Group. “For years, this group has hijacked accounts, spread malware, and used new technologies to conduct espionage operations in line with the interests of the Iranian government.”

In one attack in early 2021, APT35 attacked a British university website using a tried and tested technique: directing users to a compromised web page where they were encouraged to sign in via their email service provider – Gmail, Hotmail or Yahoo for example – from In order to view a webinar. Users are also asked for two-factor authentication codes, which go directly to APT35.

Google did not name the UK university but in July it was reported that the School of Oriental and African Studies (Soas) at the University of London was targeted by APT35 in early 2021. The attack began with a fake email from Soas Academy inviting people to a webinar, starting a series of The interactions that led to a fake page on the University Radio website tricked phishing victims into handing over their email usernames and passwords. SOAS said in July that the attack did not access personal information or data.

“As soon as we became aware of the bogus site earlier this year, we immediately addressed the breach and reported it in the normal way. We’ve reviewed how this happened and taken steps to improve the protection of these end systems.

Referring to the attack on the UK University, Bash said: “APT35 has relied on this technology since 2017 – targeting high-value accounts in government, academia, the press, NGOs, foreign policy and national security. Credential phishing demonstrates through a website that Its hack is that these attackers will do their best to appear legitimate – because they know that this type of attack is difficult for users to detect.”

The blog details other forms of the APT35 attack. These include: trying to upload spyware to the Google Play Store, where Android phone users can purchase apps; Impersonating conference officials to carry out phishing attacks; and use a bot on the Telegram messaging service to notify users when they enter a phishing site, although Google said Telegram has dealt with the scam since.

[ad_2]