New Iranian APT data extraction tool

[[correlate]]

Content source

https://blog.google/threat-analysis-group/new-iranian-apt-data-extraction-tool/

As part of TAG's mission to counter serious threats to Google and our users, we've analyzed a range of persistent threats including APT35 and Charming Kitten, an Iranian government-backed group that regularly targets high risk users. For years, we have been countering this group's efforts to hijack accounts, deploy malware, and their use of novel techniques to conduct espionage aligned with the interests of the Iranian government. Now, we're shining light on a new tool of theirs.

In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts. The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials. We have seen it accounts against fewer than two dozen located in Iran. The oldest known sample is from 2020, and the tool is still under active development. We have taken accounts to re-secure these and have notified the victims through our Government Backed Attacker Warnings.

New Iranian APT data extraction tool

As part of TAG's mission to counter serious threats to Google and our users, we've analyzed a range of persistent threats including APT35 and Charming Kitten, an Iranian government-backed group that regularly targets high risk users. For years, we have been countering this group’s efforts to...

blog.google