Russian and Iranian state-linked hackers are increasingly targeting British politicians, journalists and researchers with sophisticated campaigns aimed at gaining access to a person’s email, Britain’s online security agency warned on Thursday.
The National Cyber Security Centre (NCSC) issued an alert about two groups from Russia and
Iran, warning those in government, defence, thinktanks and the media against clicking on malicious links from people posing as conference hosts, journalists or even colleagues.
Both groups have been active for some years, but it is understood they have recently stepped up their activities in the UK as the war in Ukraine continues, as well as operating in the US and other Nato countries. They aim to steal secrets – or leak correspondence online to embarrass high-profile figures – but not to extort money.
Paul Chichester, NCSC’s operations director, said the “threat actors based in Russia and Iran” from the two separate groups “continue to ruthlessly pursue their targets in an attempt to steal online credentials and compromise potentially sensitive systems”.
The hackers typically seek to gain confidence of a target by impersonating somebody likely to make contact with them, such as by falsely impersonating a journalist, and ultimately luring them to click on a malicious link, sometimes over the course of several emails and other online interactions.
In one case, the Iranian group, dubbed Charming Kitten, held a fake zoom meeting with their target, and shared the malicious link “in the chat bar during the phone call”, the NCSC said. Sometimes two or more fake personas are used in a carefully crafted effort to convince a person their inquiries or business is legitimate.
Last year, the Russian Group known as Seaborgium or Cold River was accused by Google of hacking into and leaking correspondence involving the former director of MI6 Richard Dearlove and other hard Brexiters seeking to block Theresa May’s Chequers EU exit deal.
This year, the same group was accused of targeting three nuclear research laboratories in the US, creating fake login pages for each institution and emailing scientists who worked there to try to make them reveal their passwords. It is not clear if any of the efforts were successful.