Microsoft reveals Iranian attacks against 100 personalities
Microsoft accused Iranian hackers of posing as conference organisers in Germany and Saudi Arabia in order to steal the email accounts of prominent officials by inviting them to two conferences in Germany and Saudi Arabia.
"We share that we have detected and worked to stop a series of cyber attacks by the threat actor Phosphorous posing as conference organizers to attack over 100 high-profile individuals," the company wrote in its blog.
The technology company said Wednesday it detected attempts by the hacking group it calls Phosphorus to trick former government officials, policy experts and academics.
The targets included more than 100 prominent people invited by the hackers to the Munich Security Conference, which world leaders attend every February, and the upcoming Think 20 Summit, which begins later this week in Saudi Arabia, online.
"We believe that Phosphorus is participating in these attacks for intelligence gathering purposes," said Tom Burt, Microsoft's head of security, in a prepared statement. "The attacks succeeded in engaging several victims, including former ambassadors and other high-level policy experts who help shape global agendas and foreign policies in their respective countries.
"Microsoft did not identify the nationalities of the individuals attacked. It said the activity is not related to the upcoming US elections.
This activity was discovered by Microsoft's Threat Intelligence Information Center, or MSTIC, which tracks the world's nation-state and cybercrime actors so that we can better protect our customers. MSTIC is also central to the work of our Defending Democracy Program, which drives our AccountGuard threat notification service available in 30 countries around the world and feeds the intelligence we share to help keep elections safe," they write in their blog.
Wednesday's announcement refers to the hacker group as an "Iranian actor" but does not explicitly link it to the Iranian government. Microsoft calls it Phosphorus, while others call it APT35 or Charming Kitten.
The Redmond, Washington-based technology company has been tracking the group since 2013 and previously accused it of attempting to spy on activists, journalists, political dissidents, defense industry workers and others in the Middle East.
Cybersecurity researchers have said that the group generally attempts to infiltrate a target's personal online accounts and computer networks by luring them to click on a link to a compromised website or open a malicious attachment.
