Certfa | سرتفا

امنیت و حریم‌خصوصی در دنیای دیجیتال | Security and Privacy in the Digital World

[Certfa | سرتفا @certfalab]

⚠️ A new day and a new fake account from Iranian state-backed hackers!

In the continuation of the recent campaign of #APT42, this hacking group has started sending phishing links via a new fake account (@mona_louri - ID: 2249072423) to different targets.

Related IOCs:
136.243.236[.]68
136.243.236[.]72
144.76.115[.]28
144.76.115[.]37
honest-halcyon-fresher[.]buzz
ksview[.]top
besview[.]top
mtvisiion[.]top
hilivisiion[.]top
beeasaze[.]top
myvidsdomain[.]com
vidsname[.]com
myviddomain[.]com
myvidname[.]com

The related report about the recent campaign of #APT42 by @secureworks:
https://t.co/S1UW0c0W2J

cc: @TwitterSafety

[Certfa | سرتفا @certfalab]

⚠️ Beware of fake accounts of Iranian state backed hackers on Twitter. They usually send phishing links via DM and you must not click on these links under any circumstances.

user_id: 1581246833887698944

[Certfa | سرتفا @certfalab]

RT @AminSabeti: 🚨Exclusive: At @Certfa, we have identified a new surveillance malware "IranGuard" targeting Iranians. The campaign imperson…

[Certfa | سرتفا @certfalab]

🚨 New Android Surveillance Malware Targeting Persian Speakers #malware #iran #InfoSec #apt
https://t.co/Kk1LVpnHhF

[Nariman Gharib @NarimanGharib]

URGENT SECURITY ALERT:

Iranian Revolutionary Guards intelligence has initiated a phishing campaign targeting individuals abroad who are involved in Iran-related activities. The current attack specifically targets WhatsApp users. Do not click on suspicious links.

[Certfa | سرتفا @certfalab]

🚨New malicious macro-enabled Word file sample believed to be linked with Iranian hackers. #malware #iran #InfoSec #apt

https://t.co/aQOudWM6ui

[Certfa | سرتفا @certfalab]

🚨New malicious macro-enabled Word file sample believed to be linked with Iranian hackers. #malware #iran #InfoSec #apt

https://t.co/aQOudWM6ui

[Amin Sabeti | امین ثابتی @AminSabeti]

A detailed report about activities of #APT42 on @LinkedIn as we previously published a report about them at @certfalab. #infosec
https://t.co/5YEdehtkdv

[Certfa | سرتفا @certfalab]

⚠️ A new day and a new fake account from Iranian state-backed hackers!

In the continuation of the recent campaign of #APT42, this hacking group has started sending phishing links via a new fake account (@mona_louri - ID: 2249072423) to different targets.

Related IOCs:
136.243.236[.]68
136.243.236[.]72
144.76.115[.]28
144.76.115[.]37
honest-halcyon-fresher[.]buzz
ksview[.]top
besview[.]top
mtvisiion[.]top
hilivisiion[.]top
beeasaze[.]top
myvidsdomain[.]com
vidsname[.]com
myviddomain[.]com
myvidname[.]com

The related report about the recent campaign of #APT42 by @secureworks:
https://t.co/S1UW0c0W2J

cc: @TwitterSafety

[Certfa | سرتفا @certfalab]

✍️An important update regarding the phishing kit of #APT24 that we were not seen, at least in our samples before this campaign: When the targets type their password on the phishing page in the password input box, the hackers get a copy of it simultaneously, even if the victim does not click on the Next/Submit button.

[Certfa | سرتفا @certfalab]

⚠️ A new day and a new fake account from Iranian state-backed hackers!

In the continuation of the recent campaign of #APT42, this hacking group has started sending phishing links via a new fake account (@mona_louri - ID: 2249072423) to different targets.

Related IOCs:
136.243.236[.]68
136.243.236[.]72
144.76.115[.]28
144.76.115[.]37
honest-halcyon-fresher[.]buzz
ksview[.]top
besview[.]top
mtvisiion[.]top
hilivisiion[.]top
beeasaze[.]top
myvidsdomain[.]com
vidsname[.]com
myviddomain[.]com
myvidname[.]com

The related report about the recent campaign of #APT42 by @secureworks:
https://t.co/S1UW0c0W2J

cc: @TwitterSafety

[Certfa | سرتفا @certfalab]

⚠️ Beware of fake accounts of Iranian state backed hackers on Twitter. They usually send phishing links via DM and you must not click on these links under any circumstances.

user_id: 1581246833887698944

[Dawood Sajjadi (داود سجادی) @5tuxnet]

مقاله سایت هکزنیوز درباره اکانتی جعلی تحت نام سارا شکوهی که توسط عوامل رژیم جمهوری اسلامی جهت ارسال پیامهای حاوی بدافزار برای شناسایی و #هک حسابهای کاری مخالفین رژیم مورد استفاده قرار میگرفت.

هزاران هزار اکانت فعال مشابه وجود دارد.

مراقب باشیم...
https://t.co/PaIMG22edk

[Nariman Gharib @NarimanGharib]

⚡️حساب زیر در توییتر مربوط به هکرهای سازمان اطلاعات سپاه پاسداران جمهوری اسلامی است و اخیرا تلاش کردند تا شرکت کنندگان نشست چند هفته پیش حقوق بشر #ایران در #اسلو را مورد حمله قرار دهند و به ایمیل‌های آنها نفوذ کنند.
#APT35 #CharmingKitten https://t.co/OCnGVmVejL

[Certfa | سرتفا @certfalab]

Related IOCs:
148.251.130[.]18
88.198.96[.]214
46.4.95[.]242
node-dashboard[.]site
node-panel[.]site
stellar-stable-faith[.]top
funeral-engineering-expression[.]top
compact-miracle-abounds[.]top

[Certfa | سرتفا @certfalab]

⚠️ Beware of fake accounts of Iranian state backed hackers on Twitter. They usually send phishing links via DM and you must not click on these links under any circumstances.

user_id: 1581246833887698944

[Certfa | سرتفا @certfalab]

آموزش کوتاه ویدیویی برای مدیریت و پاکسازی سوابق موقعیت مکانی برای حساب کاربری گوگل

[Certfa | سرتفا @certfalab]

آموزش کوتاه ویدیویی برای مدیریت و پاکسازی سوابق مشاهده و جستجوی ویدیوها در یوتیوب برای حساب کاربری گوگل

[Certfa | سرتفا @certfalab]

آموزش کوتاه ویدیویی برای مدیریت و پاکسازی سوابق فعالیت‌ها و جستجوها در حساب کاربری گوگل

[Certfa | سرتفا @certfalab]

The link #APT42 sent was in a shortened format, and the target would not see the link of the fake page hosted on mailer-daemon[.]online.

[Certfa | سرتفا @certfalab]

🧵 @RecordedFuture published a report about the cyber ops of #APT42 in November. @certfalab has seen the same op is still active, and in one case, in which they failed, they tried to hack a @gmail account of a journalist based in Israel.
https://t.co/vf8RWQbJbb

[Certfa | سرتفا @certfalab]

In this operation, they impersonated a prominent scholar, contacted the journalist via @WhatsApp, and wrote a message in Hebrew. Then, they offered the target to check a document (a phishing page) before a video call to discuss a topic.

[Certfa | سرتفا @certfalab]

به گفته باب دیاچنکو، داده‌های کاربران وب‌سایت «برق من»، شامل نام، شماره موبایل، ایمیل، میزان برق مصرفی و... (۴۸۴ هزار رکورد اطلاعاتی) دچار نقض اطلاعی شده و در دسترس عموم قرار گرفته است.
سایت برق من، پرتال رسمی استعلام و پرداخت قبض برق شرکت‌های توزیع نیروی برق ایران است.