US Government employees hacked by Iranian TG 2889 group
Iran has been hacking its neighbours in the region for a few years, but the activity has been far from sophisticated. That changed earlier this year with news that various Iran-sponsored groups had been hacking into LinkedIn profiles of key diplomats in Saudi Arabia, Israel, Jordan and the Gulf States. Now it seems that one group dubbed "TG 2889" also succeeded in hacking into the Facebook accounts of senior staff in the US State Department. Initially more akin to spear-phishing and reverse social-engineering, than to major breaches, the hackers created LinkedIn and Facebook avatars to gain friends and contacts. The attacks were only discovered due to Facebook’s policy change to alert users to possible state-sponsored hacking activity, which pushed out the following message to around 1600 US Government employees: “We believe your Facebook account and your other online accounts may be the target of attacks by state-sponsored actors,” 

“It was very carefully designed and showed the degree to which they understood which of our staff was working on Iran issues now that the nuclear deal is done,” said one senior American official who oversees much of that operation and who requested anonymity to discuss a continuing investigation. “It was subtle.”

Iran’s cyberskills are not yet equal to those of Russia or China. But the attack against the State Department by using the social media accounts of young government employees to gain access to their friends across the administration — a focus that had not been seen before — showed an ingenuity beyond the Russian brute-force attack that infiltrated the State Department’s unclassified email system a year ago.

In the aftermath of the nuclear accord, American intelligence officials have warned senior officials that they expect Iran to ramp up its use of cyberespionage.

The director of national intelligence, James R. Clapper Jr., has told Congress in closed sessions that he believes state-sponsored Iranian hackers are not attempting big attacks that could threaten their ability to reap the financial rewards of complying with the nuclear accord, according to two officials familiar with those briefings. But he said they were stepping up traditional cyberespionage, and getting better at it.

“The Iranians have not been as destructive as they could be, but they are getting far more aggressive in cyberespionage, which they know is less likely to prompt a response from the United States,” said James Lewis, who runs the cyberprogram at the Center for Strategic and International Studies in Washington. “They seem very attuned to every stage of implementing the nuclear agreement.”