Iranian hackers create LinkedIn profiles for spear-phishing
The Cleaver group is an Iranian state-sponsored hacking group that has used LinkedIn to create a network of at least 25 well-developed profiles to assist in an ﻿advanced and highly effective spear-phishing campaign across the Middle East.  So successful has this﻿ campaign been that the group has managed to infiltrate major defence, telco and utility companies to a "shocking extent". The latest analysis from Dell's Counter Threat Unit shows that the group has created six leader-profiles within LinkedIn that support some 500 connections: these '﻿leaders' claim that they are high-level executives within companies such as Northrop Grumman, TeleDyne, Malaysia's RHB Bank, and South Korean's Doosan.

For over past two years, Iranian hackers have infiltrated computer networks of some of the world's top organizations including airlines, defense contractors, universities, military installations, hospitals, airports, telecommunications firms, government agencies, and energy and gas companies, security researchers said.





87-page report Cylance says Iranian state-sponsored hackers have hacked critical infrastructure of more than 50 organizations in 16 countries worldwide in a An published by the U.S. cyber security firmsays Iranian state-sponsored hackers have hacked critical infrastructure of more than 50 organizations in 16 countries worldwide in a cyber-espionage campaign that could allow them to eventually cause physical damage. Among the targeted organizations, ten are reportedly based in the United States.





The threat-detection firm dubbed the campaign as "Operation Cleaver," which aimed at gathering data from various agencies. The group reportedly stole highly sensitive information and took control of networks in Canada, China, England, France, Germany, India, Israel, Kuwait, Mexico, Pakistan, Qatar, Saudi Arabia, South Korea, Turkey, the United Arab Emirates, and the U.S.





But what could be the exact motive of Iranian hackers behind this Operation Cleaver?? Well, Cylance firm suspects it is revenge from the US and Israel for developing the Stuxnet worm that infected Iran's nuclear program years ago, and launching espionage campaigns using Flame and Duqu malware





In Operation Cleaver, the group uses its own custom software to hack critical infrastructure and pumped-up highly sensitive, confidential information from victims. They use SQL Injection, spear phishing, water-holing attacks and other methods in order to compromise the networks.

"We believe that if the operation is left to continue unabated, it is only a matter of time before the world's physical safety is impacted by it," the report said. "While the disclosure of this information will be a detriment to our ability to track the activity of this group, it will allow the security industry as a whole to defend against this threat."

According to the security researchers at the firm, so far the group has only focused on gathering intelligence, but it has the ability to launch cyber-attacks on their targets as well.





The research firm didn't exposed the individual companies, but a Reuters source listed these Corporations which includes California power company Calpine Corp, Saudi Arabia's petroleum and gas company Aramco, Mexican-state-owned Petroleos Mexicanos or Pemex, Qatar Airlines and Korean Air.





However, an Iranian spokesperson Hamid Babaei has denounced Cylance's report as a "baseless and unfounded allegation fabricated to tarnish the Iranian government image, particularly aimed at hampering current nuclear talks."





Iranian hackers group have collected a lot of information so far, according to researchers who managed in gaining access to some of the hackers' infrastructure finding"massive databases of user credentials and passwords, diagrams, and screenshots from organizations including energy, transportation, and aerospace companies, as well as universities.