امنیت و حریم‌خصوصی در دنیای دیجیتال | Security and Privacy in the Digital World
www
Joined June 2018
- Tweets416
- Following176
- Followers4.1K
- Likes0
A Telegram phishing operation hitting Iranian journalists doesn't guess passwords. It triggers a real Telegram login as you behind a fake "Microsoft Teams" meeting, then asks you to hand over the code Telegram just sent your phone.
radar.certfa.com/en/alerts/a…
We assess, with moderate to high confidence, that the operation belongs to the MOIS-linked cluster tracked as Banished Kitten, also known as Storm-0842. A second confirmed diaspora victim fits the pattern, not proof on its own.
Telegram never needs your login code on a website. The takeover works only because the code is real, the prompt looks real, and the voice sounds real. If "teltoone" shows up in your Active Sessions, the account is already gone.
radar.certfa.com/en/alerts/a…
RT @AminSabeti: 🚨Exclusive: At @Certfa, we have identified a new surveillance malware "IranGuard" targeting Iranians. The campaign imperson…
🚨 New Android Surveillance Malware Targeting Persian Speakers #malware #iran #InfoSec #apt
radar.certfa.com/en/alerts/8…
Certfa | سرتفا retweeted
URGENT SECURITY ALERT:
Iranian Revolutionary Guards intelligence has initiated a phishing campaign targeting individuals abroad who are involved in Iran-related activities. The current attack specifically targets WhatsApp users. Do not click on suspicious links.
Certfa | سرتفا retweeted
🚨New malicious macro-enabled Word file sample believed to be linked with Iranian hackers. #malware #iran #InfoSec #apt
radar.certfa.com/en/alerts/4…
🚨New malicious macro-enabled Word file sample believed to be linked with Iranian hackers. #malware #iran #InfoSec #apt
radar.certfa.com/en/alerts/4…
Certfa | سرتفا retweeted
A detailed report about activities of #APT42 on @LinkedIn as we previously published a report about them at @certfalab. #infosec
wired.com/story/linkedin-fak…
Certfa | سرتفا retweeted
⚠️ A new day and a new fake account from Iranian state-backed hackers!
In the continuation of the recent campaign of #APT42, this hacking group has started sending phishing links via a new fake account (@mona_louri - ID: 2249072423) to different targets.
Related IOCs:
136.243.236[.]68
136.243.236[.]72
144.76.115[.]28
144.76.115[.]37
honest-halcyon-fresher[.]buzz
ksview[.]top
besview[.]top
mtvisiion[.]top
hilivisiion[.]top
beeasaze[.]top
myvidsdomain[.]com
vidsname[.]com
myviddomain[.]com
myvidname[.]com
The related report about the recent campaign of #APT42 by @secureworks:
secureworks.com/blog/cobalt-…
cc: @TwitterSafety
⚠️ A new day and a new fake account from Iranian state-backed hackers!
In the continuation of the recent campaign of #APT42, this hacking group has started sending phishing links via a new fake account (@mona_louri - ID: 2249072423) to different targets.
Related IOCs:
136.243.236[.]68
136.243.236[.]72
144.76.115[.]28
144.76.115[.]37
honest-halcyon-fresher[.]buzz
ksview[.]top
besview[.]top
mtvisiion[.]top
hilivisiion[.]top
beeasaze[.]top
myvidsdomain[.]com
vidsname[.]com
myviddomain[.]com
myvidname[.]com
The related report about the recent campaign of #APT42 by @secureworks:
secureworks.com/blog/cobalt-…
cc: @TwitterSafety
✍️An important update regarding the phishing kit of #APT24 that we were not seen, at least in our samples before this campaign: When the targets type their password on the phishing page in the password input box, the hackers get a copy of it simultaneously, even if the victim does not click on the Next/Submit button.
Certfa | سرتفا retweeted
مقاله سایت هکزنیوز درباره اکانتی جعلی تحت نام سارا شکوهی که توسط عوامل رژیم جمهوری اسلامی جهت ارسال پیامهای حاوی بدافزار برای شناسایی و #هک حسابهای کاری مخالفین رژیم مورد استفاده قرار میگرفت.
هزاران هزار اکانت فعال مشابه وجود دارد.
مراقب باشیم...
thehackernews.com/2023/03/ir…
Certfa | سرتفا retweeted
⚡️حساب زیر در توییتر مربوط به هکرهای سازمان اطلاعات سپاه پاسداران جمهوری اسلامی است و اخیرا تلاش کردند تا شرکت کنندگان نشست چند هفته پیش حقوق بشر #ایران در #اسلو را مورد حمله قرار دهند و به ایمیل‌های آنها نفوذ کنند.
#APT35 #CharmingKitten virustotal.com/gui/domain/st…
⚠️ Beware of fake accounts of Iranian state backed hackers on Twitter. They usually send phishing links via DM and you must not click on these links under any circumstances.
user_id: 1581246833887698944
