Iran MOIS Phishes 50+ Embassies, Ministries, Int'l Orgs

Iranian state hackers tied to the Homeland Justice APT used a trove of compromised email accounts to phish dozens of diplomatic missions and international organisations from six continents. Researchers from Dream Security and Clear Sky Cyber Security have both since tied this activity to Homeland Justice, associated with Iran’s Ministry of Intelligence (MOIS).

The key to the operation was 104 unique, compromised addresses used to send emails purporting to be official government correspondence, with attached infostealing malware. The first email in the campaign was sent on 19 August, generated from a legitimate Oman Ministry of Foreign Affairs address in Paris, and routed through a NordVPN exit node in Jordan to mask its origin.

Phishing targeted around four dozen embassies, consulates, and ministries worldwide, including entities such as the United Nations and its agencies, the African Union, and the World Bank, among others. By the time of reporting, researchers noted the attackers’ command-and-control infrastructure appeared inactive, suggesting the campaign had likely concluded. according to Dream Security and Clear Sky Cyber Security