Friday, March 29, 2024

Charming Kitten APT Hackers Group Abusing Google Services to Attack U.S Presidential Campaign Members

The Iranian based hacker group Charming Kitten, also known as APT35 or Ajax or Phosphorus is active since 2014. The hacker group primarily targets researchers from the US, Middle East, and France, focusing on Iranian academic researchers, Iranian dissidents in the US.

The group plays a vital role in democratic procedures, they attempt to intercept the elections in the US, Germany, and France.

Charming Kitten Attack Vector

The hacker group employes a spear-phishing method as the main attack vector, along with the phishing method the group attempts social media impersonation such as Facebook, Twitter, and Instagram for delivering malicious links. They also use SMS for delivering malicious links.

Pretending as Google Services

Threat actors use Google sites domain to trick the users in downloading the attachments, and they also collect the user’s Google account credentials. The email found to be sent from a no-reply email address.

ClearSky researchers observed multiple waves of a phishing campaign, one with a link to Google Drive and another set of emails from a colleague’s email. The Google drive link appears below.

hxxps://sites.google[.]com/view/cubqzpmuxra5bjxu7q2jxcxnhkldpa/drive/
hxxps://sites.google[.]com/screenshot-sharing-service/drive/

On clicking into the Google links, users are redirected to a shortened URL and directed to the malicious site. The malicious site poses as the entrance to Google services and tempts victims to enter login credentials.

SMS message as Attack Vector

Threat actors send SMS with a link embedded from the Sender ID ‘Live Recover’, the SMS asks to verify the victims with the attached link.

Login Attempt Alert

Attackers use to send fake login alerts, in one of the messages the victim receives a security alert for Yahoo, but the email was sent from Gmail.

Social Networks

Researchers found that Charming Kitten impersonates as a security team of social networks such as facebook, Twitter and Instagram.

“We have found an open directory at port 80 which contains files relevant for the deployment of different phishing sites. As seen from the picture, the first uploaded files were Facebook and Twitter impersonations.”

Recently Microsoft issued a serious warning that Iran state-sponsored hacking group Charming Kitten targets Government and private sector to compromise high profile email accounts.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles