On August 28th, an Iranian hacker organization ran a hoax recruiting businesses to catch the eye of national security officials from Iran, Lebanon, and Syria. This new research surfaced from a United States cybersecurity firm named Mandiant, a sector of Alphabet Inc., Google Cloud.

According to the Mandiant report, “the data collected by this campaign may support the Iranian intelligence apparatus in pinpointing individuals who are interested in collaborating with Iran’s perceived adversarial countries. The collected data may be leveraged to uncover human intelligence (HUMINT) operations conducted against Iran to persecute any Iranians suspected to be involved in these operations.” On one of the websites the headline stated, “VIP Recruitment, a center for recruiting respected military personnel into the army, security services and intelligence from Syria and Hezbollah, Lebanon. Join us to help each other impact the world. Our duty is to protect your privacy.”

As of recent news, Iran has begun to meddle in the 2024 U.S. presidential election. Iranian hacker groups and their associates are capable of malicious cyber activity hence the significance of this new research surfacing. In light of these threats, preventative actions can be taken to strengthen resilience against anti-democratic attacks. Always being cognizant of online spaces and implementing multifactor authentication are just a few ways to protect and promote the prosperity of the world’s people.

Mandiant reported that the hackers are connected to a group called APT35 or Charming Kitten, which was linked to the hacker disruption of the U.S. 2024 presidential election. APT35 is considered a branch of the intelligence division of the Iranian Revolutionary Guard, a large military organization established in Tehran. The FBI is pursuing further investigations of APT35’s part in interfering in the upcoming election.

In their research thus far, Mandiant has dated this hacker organization’s inception to 2017 and deduced that it currently remains active. Often, such Iranian organizations will make the operation appear to be conducted by Israelis, to lure in and identify individuals in the Middle East who are willing to give confidential information to Israel and their Western government allies. Mandiant further discovered that cybernated spies used a collection of websites imitating human resource companies to exploit Farsi-speaking persons. X, Telegram, YouTube and the lesser-known platform Virasty were all used by the hackers to promote fraud firms such as VIP Human Solutions, VIP Recruitment, Optima HR, and Kandovan HR.

By using these various social media platforms, the Iranian hackers grew their clientele and expanded their fake HR scheme. There is no data showing how many people fell for the ruse, but Mandiant is investigating the current data that includes addresses, contacts, and more to be discovered. Strengthening and uniting to restrain cyberattacks is fundamental to protecting the cyberspace. Iran is just one actor among an ever-increasing number of threats, and the proper maintenance of effective cybersecurity remains extremely complex but of utmost importance.