Iranian state-sponsored hacking group, Cobalt Illusion, has been impersonating the Atlantic Council, a US think tank, to target women involved in Middle East politics and human rights activism.
Cybersecurity company, Secureworks, has been tracking the group’s activities for years, and attributes it to the Islamic Revolutionary Guard Corps (IRGC).
Cobalt Illusion is known for its use of fake personas to establish contact with individuals who are of strategic interest to the Iranian government.
The group employs a range of tactics, including leveraging credential harvesting to gain control of victims’ mailboxes and stealing data from Gmail, Yahoo! and Microsoft Outlook accounts using HYPERSCRAPE (aka EmailDownloader) to steal data from Gmail, Yahoo!, and Microsoft Outlook accounts using the stolen passwords. It also uses a C++-based Telegram “grabber” tool to harvest data on a large scale from Telegram accounts.
The latest activity involves the adversary posing as an employee of the Atlantic Council and reaching out to political affairs and human rights researchers under the pretext of contributing to a report.
The fraudulent persona, Sara Shokouhi, claimed to have a PhD in Middle East politics and had social media accounts on Twitter and Instagram. The profile photos on these accounts were taken from an Instagram account belonging to a Russian psychologist and tarot card reader. It is not clear if the effort resulted in any successful phishing attacks.
Cobalt Illusion has a history of targeting academics, activists, diplomats, journalists, politicians, and researchers. Its core tactics include phishing and bulk data collection.
The group uses the intelligence it gathers to inform military and security operations by Iran, foreign and domestic. According to Rafe Pilling, principal researcher and Iran thematic lead at SecureWorks CTU, the group’s intelligence gathering is often human-focused, such as extracting the contents of mailboxes, contact lists, travel plans, relationships, physical location, and more. The intel is likely blended with other sources.
