The National Cyber Security Centre has issued a warning about an ongoing threat from spear-phishing attacks carried out by cyber actors working on behalf of the Iranian government.

In a joint advisory, the NCSC and its US partners shared technical details about how cyber-attackers working on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC) are using social engineering techniques to gain access to victims’ personal and business accounts online.

The malicious activity is targeted against individuals with links to Iranian and Middle Eastern affairs, such as current and former senior government officials, senior think tank personnel, journalists, activists and lobbyists. 

Analysts in the US have also observed targeting of people associated with the current political campaigns.

The advisory warns that threat actors have been observed impersonating contacts over email and messaging platforms, building rapport with targets, then soliciting them to share user credentials via a false email account login page. That information is then used to gain access to victims’ accounts, view and delete messages, and set up email forwarding rules. 

The actors are known to tailor their social engineering techniques to include areas of interest or relevance to their targets, with approaches including impersonation of family members, well-known journalists, discussion of foreign policy topics, and invitations to conferences. 

In other cases, threat actors have impersonated email service providers to obtain sensitive user security information. 

The NCSC believes the activity poses a serious threat to various sectors worldwide, including in the UK. To reduce the chances of compromise, the advisory encourages high-risk individuals to follow mitigation steps and approved guidance, which includes signing up for free cyber defence services offered by the NCSC.

Recommended reading

• UK Gov: Data Centres Are Now Critical National Infrastructure
• UN Report Highlights Progress in Global Cybersecurity
• Over 70% of UK Believe Cyber Is the Next Step In Modern Warfare

Paul Chichester, NCSC director of operations, said: “With our allies, we will continue to call out this malicious activity, which puts individuals’ personal and business accounts at risk, so they can take action to reduce their chances of falling victim.

“I strongly encourage those at higher risk to stay vigilant to suspicious contact and to take advantage of the NCSC’s free cyber defence tools to help protect themselves from compromise.”

In a sign of escalating global tensions, the NCSC issued another advisory late last month urging individuals and organisations to take protective action after it exposed a botnet operated by a company with links to the Chinese government, thought to have compromised over 260,000 devices around the world.