Google announced that it disrupted a hacking campaign carried out by Iran-linked group APT42<\/a> (Calanque, UNC788<\/a>) that targeted the personal email accounts of individuals associated with the US elections<\/a>.<\/p>\n\n\n\n
“In the current U.S. Presidential election cycle, TAG detected and disrupted a small but steady cadence of APT42\u2019s\u00a0Cluster C<\/a>\u00a0credential phishing activity. In May and June, APT42 targets included the personal email accounts of roughly a dozen individuals affiliated with President Biden and with former President Trump, including current and former officials in the U.S. government and individuals associated with the respective campaigns.” reads the report<\/a> published by Google.<\/em><\/p>\n\n\n\n
Last week, Donald Trump\u2019s presidential campaign<\/a> announced it was hacked<\/strong><\/a>, a spokesman attributed the attack to foreign sources hostile to the United States. The presidential campaign believes that Iran-linked threat actors may be involved in the cyber operation that is aimed at stealing and distributing sensitive documents. At this time, no specific evidence was provided.<\/p>\n\n\n\n
The media outlet POLITICO first reported<\/a> the hack, it became aware of the security breach after receiving emails from an anonymous account with documents from inside Trump\u2019s operation.<\/p>\n\n\n\n
The Trump campaign cited an incident that occurred in June where an Iran-linked APT, Mint Sandstorm<\/a>, sent a spear-phishing email to a high-ranking campaign official from a compromised account.<\/p>\n\n\n\n
The campaign cited a Microsoft report<\/a> published on Friday that linked Iranian hackers to the spear phishing email sent to an official on a presidential campaign.<\/p>\n\n\n\n
APT42 employed several phishing kits targeting a variety of sign-on pages including:<\/p>\n\n\n\n
APT42’campaings relies on detailed reconnaissance to target personal email addresses that may lack robust security measures. The attackers research the security settings of their targets\u2019 email accounts, using failed login or recovery attempts to understand authentication factors, and adapt their phishing kits accordingly. This approach ensures their attacks appear legitimate, often including geographic location data to avoid detection. Once gained access to the accounts, the Iranian hackers typically modified account settings to enhance their control, such as changing recovery email addresses and exploiting application-specific passwords. Google\u2019s Advanced Protection Program helps mitigate this by disabling these passwords.<\/p>\n\n\n\n
“As we outlined above, APT42 is a sophisticated, persistent threat actor and they show no signs of stopping their attempts to target users and deploy novel tactics.” concludes the report. “This spring and summer, they have shown the ability to run numerous simultaneous phishing campaigns, particularly focused on Israel and the U.S. As hostilities between Iran and Israel intensify, we can expect to see increased campaigns there from APT42.”<\/em>
Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/a><\/p>\n\n\n\n
Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n
(<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking, APT)<\/strong>