Iranian hackers ramp up digital attacks on US political campaigns

Elections are coming up, and threat actors are ramping up efforts to manipulate voters and attack political campaigns. Cybersecurity researchers have discovered new network infrastructure set up by Iranian hackers, aimed at targeting U.S. political campaigns. They use phishing emails and links to trick users into installing malicious software, often pretending to be cloud services.

GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE

What you need to know

The infrastructure has been discovered by Recorded Future's Insikt Group, which has been tracking it since June 2024. The cybersecurity company has linked the infrastructure to GreenCharlie, an Iran-nexus cyberthreat group with connections to Mint Sandstorm, Charming Kitten, and APT42.

"GreenCharlie's phishing operations are highly targeted, often employing social engineering techniques that exploit current events and political tensions," Recorded Future said.

The hackers have set up their systems very carefully, using specific services to create websites for phishing attacks. These fake websites often look like they belong to cloud services, file-sharing platforms or document-viewing tools to trick people into sharing personal information or downloading harmful files.

Some examples of these fake website names include "cloud," "uptimezone," "doceditor," "joincloud" and "pageviewer." Most of these sites were registered with the .info domain, which is a change from the other domains like .xyz, .icu and .online that hackers used in the past.

DON’T FALL PREY TO THIS ELECTION SEASON’S CRAFTIEST SCAMS

It's not their first rodeo

The threat actors are known for launching highly targeted phishing attacks, where they use sophisticated social