UK issues warning over threat from cyber attackers working for Iranian state

The National Cyber Security Centre (NCSC) - part of GCHQ - has shared details of how cyber attackers working for Iran's Revolutionary Guard Corps (IRGC) are using social engineering techniques

The UK has sounded the alarm over the threat posed by cyber attackers linked to the Iranian state.

In a joint advisory with US partners, the National Cyber Security Centre (NCSC), a branch of GCHQ, revealed how hackers working for Iran's Revolutionary Guard Corps (IRGC) are using social engineering techniques to infiltrate victims' personal and business accounts online.

The NCSC warned that these malicious activities are primarily aimed at individuals connected to Iranian and Middle Eastern affairs, including high-ranking government officials, think tank personnel, journalists, activists, and lobbyists. It was also noted that people associated with domestic political campaigns in the US have been targeted.

The advisory detailed how the attackers often impersonate contacts via email and messaging platforms, building trust with their targets before tricking them into sharing login details on a fake email account page. Once they gain access, the attackers can siphon off and delete messages and set up email forwarding rules.

This activity "poses an ongoing threat to various sectors worldwide, including the UK", according to the NCSC. To minimise the risk, the organisation advised those at risk to follow the mitigation steps outlined in the advisory and take advantage of its free cyber defence tools.

Paul Chichester, NCSC director of operations, sounded the alarm on cyberattacks, informing: "The spear-phishing attacks undertaken by actors working on behalf of the Iranian government pose a persistent threat to individuals with a connection to Iranian and Middle Eastern affairs."

Alongside international partners, Chichester pledged ongoing efforts to expose such dangers: "With our allies, we will continue to call out this malicious activity, which puts individuals' personal and business accounts at risk, so they can take action to reduce their chances of falling victim."

He also urged those facing greater risks to remain alert and utilise available protective measures: "I strongly encourage those at higher risk to stay vigilant to suspicious contact and to take advantage of the NCSC's free cyber defence tools to help protect themselves from compromise."