An Iranian hacking group accused of targeting bipartisan U.S. presidential campaigns earlier this year also sent WhatsApp messages in an attempt to trick members of the current Biden and former Trump administrations, Meta said Friday.
The campaign began earlier this year and ended before President Joe Biden lost the presidential race last month, a Meta spokeswoman said. The Iranian group, often referred to as “Mint Sandstorm,” used fewer than 10 accounts to target several dozen people around the world, including public figures and political and diplomatic officials, the spokesman said.
The WhatsApp accounts claimed to be technical support for companies such as AOL, Google, Yahoo and Microsoft, according to a Meta blog post. The company became aware of the campaign after several people who received the messages reported them as possible phishing attempts.
The WhatsApp messages appeared to be a manipulation operation where the hacker tries to gain the victim’s trust in order to move on to another stage of the operation, such as accessing a company or email account.
The U.S. government and Google said last week that a stubborn cyber espionage group linked to Iran’s Islamic Revolutionary Guard Corps is targeting presidential campaigns of both parties and successfully hacked former President Donald Trump’s campaign. According to the Harris campaign, it was not violated.
A spokesman for Iran’s mission to the United Nations did not immediately respond to an email seeking comment. In a statement earlier this week, the mission issued a statement denying that Iran interfered in the US election.
Like other major state cyberespionage groups, IRGC hackers target a wide variety of targets. NBC News reported Friday that the state of Utah privately issued a warning last month that the same group had attempted to hack into state data on oil, gas and other geological exploration data.
The same WhatsApp campaign also targeted users in Iran, Israel, Palestine and the UK, Meta said.
Companies like Microsoft and Google routinely remove accounts they say are linked to groups like IRGC hackers. However, identifying such campaigns on WhatsApp is more difficult because all WhatsApp messages use end-to-end encryption, meaning Meta can only see what they’re saying if the user forwards them to the company.
The Iran operation was uncovered after several users who received fake tech support messages reported them as suspicious, Meta said.
Meta said it had seen no evidence that the accounts had been compromised. However, the company did not necessarily know if the victim had believed the WhatsApp messages and given the hackers other valuable information.
Following Iran’s successful hacking of the Trump campaign, three US media outlets – Politico, The Washington Post and The New York Times – all received an email containing stolen campaign documents. The tactic appears to have been a “hack-and-leak” operation, similar to how Russian intelligence hacked the Democrats and Hillary Clinton’s campaign in 2016 and released files on the Internet, particularly through WikiLeaks.
However, unlike in 2016, the three news channels did not give the hacked documents significant coverage. It’s unclear whether or how more hacked Trump files will emerge before Election Day.
This article was originally published on NBCNews.com
