The United States State Department issued a $10 million bounty for an Iranian hacker responsible for a string of cyber attacks on the US. Alireza Shafie Nasab allegedly spent years carrying out a series of cyber crimes on more than a dozen companies and government agencies.
After successfully compromising an administrator account for a company that works for the Department of Defense, Nasab fabricated dozens of official-looking accounts. These accounts were used in a long-running spearphishing campaign targeting companies that worked with the Department of Defense.
Spearphishing campaigns are when hackers deliberately target specific figures within a company using highly personal and very effective social engineering tactics. Typically, hackers only need a single point of entry to carry out their entire plan, so if a spear phishing campaign gets past a single employee’s defenses, it can jeopardize the entire company.
Since Nasad could use inside information to appear like a legitimate defense contractor, it was easy for him to convince other contractors to give him sensitive data. The spearphishing campaign affected more than 200,000 computers across the US.
He was able to get away with it for years thanks to a clever secret identity. Nasab posed as a cybersecurity expert who worked with reputable companies. The Office of Public Affairs explained the charges and crimes in a recent press release, highlighting that Iranian hackers have become increasingly more aggressive.
“Today’s charges highlight Iran’s corrupt cyber ecosystem, in which criminals are given free rein to target computer systems abroad and threaten US sensitive information and critical infrastructure,” the Office of Public Affairs said.
Nasab is alleged to be part of a larger hacker group that has launched a series of attacks on the US.
“The FBI will leverage all of its capabilities in combating the threat posed by Iranian hacker organizations to America’s public and private sectors,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division.