Tehran
\nThe Iranian hacking team that compromised the campaign of Republican presidential candidate Donald Trump is known for placing surveillance software on the mobile phones of its victims, enabling them to record calls, steal texts and silently turn on cameras and microphones, according to researchers and experts who follow the group.
\nKnown as APT42 or CharmingKitten by the cybersecurity research community, the accused Iranian hackers are widely believed to be associated with an intelligence division inside Iran\u2019s military, known as the Intelligence Organization of the Islamic Revolutionary Guard Corps or IRGC-IO. Their appearance in the U.S. election is noteworthy, sources told Reuters, because of their invasive espionage approach against high-value targets in Washington and Israel.
\n\u201cWhat makes (APT42) incredibly dangerous is this idea that they are an organization that has a history of physically targeting people of interest,\u201d said John Hultquist, chief analyst with U.S. cybersecurity firm Mandiant, who referenced past research, opens new tab that found the group surveilling the cell phones of Iranian activists and protesters. Some of them were imprisoned or physically threatened in the country shortly after being hacked.
\nA spokesperson for Iran\u2019s permanent mission to the United Nations in New York said in an email that \u201cthe Iranian government neither possesses nor harbors any intent or motive to interfere in the United States presidential election.\u201d
\nSpokespeople for Trump have said that Iran is targeting the former president and current Republican candidate because they disfavor his policies toward Tehran.
\nHIGHLY TARGETED
\nThe APT42 crew that targeted Trump has never been formally named in U.S. law enforcement indictments or criminal charges, leaving questions about their structure and identity. But experts believe they represent a significant threat.
\n\u201cThe IRGC-IO is entrusted with collecting intelligence to defend and advance the interests of the Islamic Republic,\u201d said Levi Gundert, chief security officer for U.S. cyber intelligence firm Recorded Future and a former Secret Service special agent. \u201cAlong with the Quds Force, they are the most powerful security and intelligence entities inside Iran.\u201d
\nIn March, Recorded Future analysts discovered hacking attempts by APT42 against a U.S.-based media group named Iran International, which British authorities previously said, opens new tab were the target of physical violence, opens new tab and terror threats by Iranian-linked agents.
\nHultquist said the hackers commonly use mobile malware that allows them to \u201crecord phone calls, room audio recordings, pilfer SMS (text) inboxes, take images off of a machine,\u201d and gather geolocation data.
\nIn recent months, Trump campaign officials sent a message to employees warning them to be diligent about information security, according to one person familiar with the message. The message warned that cell phones were no more secure than other devices and represented an important point of vulnerability, said the person, who requested anonymity as he was not permitted to speak to the media.
\nThe Trump campaign did not respond to a request for comment. The FBI and the Office of the Director of National intelligence both declined to comment.
\nThe Secret Service did not answer questions about whether the Iranian hacking activity could be intended to support physical attacks planned for the future. In a statement sent to Reuters, a Secret Service spokesperson said they work closely with intelligence community partners to ensure the \u201chighest level of safety and security\u201d but could not discuss matters \u201crelated to protective intelligence.\u201d
\nAPT42 also commonly impersonates journalists and Washington think tanks in complex, email-based social engineering operations that aim to lure their targeting into opening booby-trapped messages, which let them takeover systems.
\nThe group\u2019s \u201ccredential phishing campaigns are highly targeted and well-researched; the group typically targets a small number of individuals,\u201d said Josh Miller, a threat analyst with email security company Proofpoint. They often target anti-Iran activists, reporters with access to sources inside Iran, Middle Eastern academics and foreign-policy advisers. This has included the hacking of western government officials and American defense contractors.
\nFor example, in 2018, the hackers targeted nuclear workers and U.S. Treasury department officials around the time the United States formally withdrew from the Joint Comprehensive Plan of Action (JCPOA), said Allison Wikoff, a senior cyber intelligence analyst with professional services company PricewaterhouseCoopers.
\nThe public emergence of APT42 in the ongoing presidential racebegan earlier this month following a report, opens new tab by Microsoft (MSFT.O), opens new tab on Aug. 9, which said the group was attempting to hack staffers on an unnamed presidential campaign.
\nAPT42 is still actively targeting campaign officials and former Trump administration figures critical of Iran, according to a blog post, opens new tab by Google\u2019s cybersecurity research team.<\/p>\n","protected":false},"excerpt":{"rendered":"
Tehran The Iranian hacking team that compromised the campaign of Republican presidential candidate Donald Trump is known for placing surveillance software on the mobile phones of its victims, enabling them to record calls, steal texts and silently turn on cameras and microphones, according to researchers and experts who follow the group. Known as APT42 or […]<\/p>\n","protected":false},"author":2,"featured_media":427036,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":{"0":"post-427019","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-world"},"yoast_head":"\n