Iran-backed cyber group increases phishing against Israel, US targets: Google

An Iranian-backed cyber group is waging an “aggressive, multi-pronged” effort to target the US and Israel and interfere in the US presidential election, Google analysts said Wednesday. blog post.

The group, APT42, is associated with Iran’s Islamic Revolutionary Guard Corps and has consistently targeted high-ranking US and Israeli officials, including current and former government officials, Google said.

“Over the past six months, the US and Israel have accounted for approximately 60% of APT42’s known geographic targets, including former Israeli military officers and individuals affiliated with both US presidential campaigns,” the blog post says. “These activities demonstrate the group’s aggressive, multifaceted effort to quickly shift its operational focus in support of Iran’s political and military priorities.”

The FBI is investigating concerns that Iran stole documents from former President Trump’s campaign and sent them to reporters, as well as allegations that Tehran tried to gain access to Vice President Harris’ campaign.

Media outlets reportedly received an email from an AOL account named “Robert” that included a dossier of research on Senator JD Vance (R-Ohio), Trump’s running mate.

The Trump campaign had previously announced that it was hacked by Iran, shortly after Microsoft published a report indicating election interference from Iran and other countries.

Trump told reporters on Wednesday that “it looks like Iran is the one doing this.”

“The reason is because I was strong in Iran,” he said. “I was protecting people in the Middle East who maybe weren’t so happy about it.”

The FBI also suspects that three officials associated with President Biden’s previous campaign or Harris’ current campaign were targeted by phishing campaigns.

Trump was also under heightened Secret Service security after Iran threatened his life, part of an Iranian campaign to target and threaten former Trump administration officials who were aggressive in policy against Tehran.

Trump survived an assassination attempt on July 13 that authorities believe was unrelated to Iran.

State Department spokesman Vedant Patel told reporters Wednesday that the U.S. “has long spoken about how Iran has made efforts to maliciously influence the election.”

“It’s something we’re constantly vigilant about,” he said.

APT42 has previously targeted officials during the U.S. elections, but during the current cycle, personal email accounts of about a dozen individuals associated with the Biden or Trump campaign have been targeted, Google said.

Google said it blocked several malicious attempts, but some were successful, including one against a high-profile political consultant.

Israeli military officers, diplomats and other senior figures were also targets of Iran’s phishing campaign.

Iran disguised itself as legitimate organizations, including the Washington Institute for Middle East Policy, the Brookings Institution and the Institute for the Study of War, according to Google.

Phishing efforts often involve emails containing some type of phishing link to lure users into allowing them to gain access to accounts and steal information. Over the past six months, Google said it has blocked more than 50 campaigns involving Google Sites scams.

“As we described above, APT42 is a sophisticated and persistent threat actor and shows no signs of stopping its attempts to target users and deploy new tactics,” analysts wrote in the blog.

Concerns surrounding Iran’s election interference come as Iranian authorities have publicly warned they will retaliate against Israel for the death of top Hamas leader Ismail Haniyeh in Tehran two weeks ago. Iran blamed Israel for his death, which neither confirmed nor denied responsibility.

The US and Israel are preparing for an attack, with Washington transferring additional military assets to the Middle East to prepare.

This story originally appeared on thehill.com read the full story