Loading story…
Iranian and North Korean state-linked hacking groups were reported using journalist and think tank impersonation to trick targets into surrendering credentials and sensitive information. Recorded Future said Iran’s APT42, tied to the Islamic Revolutionary Guard Corps, continued masquerading as media outlets and research organizations in espionage campaigns, while U.S. agencies and regional reporting described North Korea’s Kimsuky/APT43 using fake reporters and policy experts to approach foreign policy specialists, officials, and other high-value targets.
Google said APT42 also targeted both the Trump and Biden/Harris presidential campaigns, along with Israeli military, government, and diplomatic organizations, in phishing operations that included current and former officials and campaign personnel. Microsoft and Google reported successful compromises linked to the activity, including access to a political consultant’s personal Gmail account and a campaign-related official through a hacked adviser’s email, while the FBI opened an investigation and providers said they blocked login attempts, warned victims, and coordinated with law enforcement.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The FBI opened an investigation in June 2024 into phishing attacks linked to the campaign-targeting activity attributed to APT42. Google said it also warned affected users, blocked login attempts, and worked with law enforcement.
By August 2024, Google and Microsoft had separately described successful compromises connected to the campaign-targeting operation, including access to a high-profile political consultant's personal Gmail account and a campaign-related official through a hacked former senior adviser's email account. Roger Stone said Microsoft and the FBI warned him that both his Microsoft and Gmail accounts had been compromised.
Iranian state-backed espionage group APT42 was reported as continuing to impersonate media organizations and think tanks in phishing and social-engineering operations. The reporting indicates the tactic remained active as of early May 2024.
The NSA and FBI publicly warned that Kimsuky hackers were posing as journalists to gather intelligence from targets, reinforcing earlier reporting on the group's social-engineering tactics. The warning highlighted the campaign as an ongoing espionage threat.
North Korean state-linked group Kimsuky (also tracked as APT43) was reported using personas impersonating journalists and subject-matter experts to socially engineer targets and steal intelligence. The activity was described in reporting published at the end of March 2023.
TechCrunch reported that Iran-backed hackers were linked to an espionage campaign targeting journalists and activists. This represents an earlier documented instance of Iran-aligned social-engineering activity against civil society targets before the later 2024 APT42 campaign reporting.
Proofpoint reported that Iran-linked TA453, overlapping with APT42/Charming Kitten, targeted experts in Middle Eastern affairs, nuclear security, and genomic research using phishing emails impersonating trusted contacts and institutions. The campaign used a 'Multi-Persona Impersonation' technique and delivered a malicious Office document via OneDrive that fetched the Korg template for basic host and network reconnaissance.
In May and June 2024, Google said APT42 targeted about a dozen people tied to both the Trump and Biden-Harris presidential campaigns, including current and former government officials. The same activity also targeted Israeli military, government, and diplomatic organizations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
wired.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcerfa.org
Open sourcetechcrunch.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A joint advisory from the FBI, U.S. Cyber Command Cyber National Mission Force, the U.S. Department of the Treasury, and the UK National Cyber Security Centre says cyber actors working on behalf of Iran’s Islamic Revolutionary Guard Corps are conducting social-engineering and phishing campaigns against personal and business accounts. The activity has targeted people connected to Iranian and Middle Eastern affairs, including current and former senior government officials, think tank personnel, journalists, activists, lobbyists, and more recently individuals associated with U.S. political campaigns. The operators reportedly impersonate trusted contacts, journalists, relatives, or email providers, build rapport over time, and then direct victims to credential-harvesting pages that also capture multi-factor authentication codes. The advisory says successful compromises can lead to suspicious logins, unauthorized email forwarding rules, connections from unknown devices or applications, message theft and deletion, and attempts to pivot into additional accounts. Authorities urged organizations to strengthen phishing awareness, deploy anti-spoofing protections, disable external auto-forwarding where possible, monitor mailbox-rule changes, enable alerts for anomalous logins, and adopt phishing-resistant MFA, including hardware-backed authentication methods. The references provided did not supply usable details tying the second document to this activity, so the reported event is defined by the joint warning on IRGC-linked account targeting.
Jun 29, 2026
Access Now, Lookout, and SMEX reported a suspected **hack-for-hire espionage campaign** targeting journalists and activists across the Middle East and North Africa through spearphishing, fake social media personas, messaging apps, and sustained social engineering. Researchers said the operation used infrastructure linked to the APT group **Bitter** and likely deployed **ProSpy** Android spyware, which can steal files, contacts, messages, and geolocation data, activate microphones and cameras, and install malicious apps. The activity has reportedly been ongoing since at least 2022, with broader targeting that may have included civil society figures and possibly government officials. Two Egyptian journalists, **Mostafa Al-A’sar** and **Ahmed Eltantawy**, were among the identified targets in an elaborate campaign that ran between October 2023 and January 2024 and spoofed trusted services including Apple and Signal. A prominent Lebanese journalist was also reportedly targeted, and researchers said the attackers relied on overlapping infrastructure with possible ties to Asia, though Access Now said it lacked enough evidence to definitively name a sponsor. Neither Egyptian journalist’s accounts were ultimately compromised, but press freedom groups warned that surveillance of reporters endangers their safety, sources, and ability to work.
Jun 29, 2026
U.S. agencies warned that Iran could target **critical infrastructure** operators as researchers and policy analysts described a cyber ecosystem that blends state-directed activity with nominally independent hacktivist groups. CSIS said Tehran uses this structure to support espionage, sabotage, influence operations, and plausible deniability, citing the **CyberAv3ngers** intrusions into U.S. water and wastewater systems as a prominent example after U.S. authorities tied the activity to officials in the Islamic Revolutionary Guard Corps Cyber-Electronic Command. The same reporting linked Iranian state organs, including the **IRGC** and **MOIS**, to affiliated groups such as `APT33`, `APT35`, `APT34`/`OilRig`, and `MuddyWater`. The threat picture expanded as pro-Russia actors joined Iran-linked operations under **#OpIsrael**, with attacks reportedly including **DDoS**, claimed breaches, leaked CCTV footage, **SQL injection**, and data leaks against Israeli government, education, and municipal targets. Researchers said dozens of Russia-aligned and Iran-nexus actors appeared to be participating, while Radware separately reported retaliatory hacktivist DDoS activity tied to the regional conflict. U.S. officials and sector groups have monitored for spillover risk, warning that even if many operations are opportunistic or low sophistication, smaller U.S. infrastructure operators could still face disruptive, high-visibility attacks.
Jun 29, 2026