Details on a 3+ year cyber espionage campaign tied to Iran using LinkedIn, Facebook, Twitter to target high ranking officials in the US, UK, Israel and other nations. More than 2,000 targets across government, defense contracting firms, lobbying groups, etc.

1. NEWSCASTER – Iranian Cyber Espionage using
Facebook, LinkedIn,Twitter…
An iSIGHT Partners Overview
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com

2. iSIGHT Partners
200+ experts, 16 Countries, 24 Languages, 1 Mission
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 2
Mission Global Reach
Betheworld’sleading global
cyberthreatintelligence
provider,connecting
securitytechnologyand
operationstothebusiness.

3. NEWSCASTER
 Cyber-espionage campaign
 Links to Iran
 Targeting high and low ranking personnel in multiple
countries – US, UK, Israel, Saudi Arabia, Iraq
– U.S. military
– Congressional personnel
– Washington D.C. area journalists
– Diplomatic corps
– U.S. Defense contractors
– Israeli Defense contractors
– Members of the U.S./Israeli lobby
 Utilizing social media platforms as targeting platform
– Facebook
– LinkedIn
– YouTube
– Twitter
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 3

4. NEWSCASTER
 Active since at least 2011
 More than a dozen elaborate principal personas; many
supported by the fictitious news organization NewsOnAir.org
– Included at least two legitimate identities (falsified) from
leading news organizations
 Thomson Reuters
 Fox News
 More than 2,000 targets and legitimate individuals connected
to the network
– High probability of a vastly wider reach
 Brash and complex, reliance on social engineering and spear-
phishing for credential harvesting, use of malware with data
exfiltration capabilities
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 4

5. NEWSCASTER Personas
Persona Purported Profession Known Platforms
Known
Connections
Sandra Maler Reporter, NewsOnAir LinkedIn, Facebook,
Twitter, Google
226
Adia Mitchell Reporter, NewsOnAir LinkedIn, Facebook,
Twitter, Wordpress
281
Amanda Teyson Reporter, NewsOnAir LinkedIn, Facebook,
Twitter, Google
310
Sara McKibben Reporter, NewsOnAir LinkedIn, Facebook Unknown
Joseph Nilsson Founder, NewsOnAir LinkedIn, Facebook 231
Jane Baker (Ava T. Foster) Reporter, NewsOnAir LinkedIn 30
Mary Cole Recruiter for Defense
Contractor
LinkedIn, Facebook, Google 500+
Berna Achando Web Designer for Defense
Contractor
LinkedIn, Facebook 151
Jeann Maclkin Systems Administrator for US
Navy
LinkedIn, Facebook,
Blogger, YouTube
500+
Alfred Nilsson Talent Acquisition for Defense
Contractor
LinkedIn, Facebook Unknown
Josh Nilsson (Josh Furie) IT Manager for Defense
Contractor
LinkedIn, Facebook 130
Dorotha Baasch IT Analyst for Defense
Contractor
LinkedIn, Facebook Unknown
Kenneth Babcock CPA and Tax Advisor for
Payment Processor
LinkedIn, Facebook, Google Unknown
Donnie Eadense Information Systems Manager
for Defense Contractor
LinkedIn 118
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 5
 Interconnected
 Multi-platform
 Pictures taken from bystanders
and the moderately famous
 Young, pretty women used
 Secondary personas legitimize
principals
 NewsOnAir.org created to
legitimize multiple personas

6. Elaborate Support for Personas
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 6

7. NewsOnAir.org
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 7
Kimberly Gulifoyle

8. NewsOnAir.Org: A Front News Agency
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 8
Fake journalists shareNewsOnAir.org
links onsocialmedia networks.5
Articlereposted toNewsOnAir.org
withoriginal authorship removed2Real Newsarticles from Reuters,AP,
BBC, other resources.1 Links tweetedfrom @NewsOnAir2
4
Article
News
ByAmanda Teyson
Amanda Teyson Persona
Persona’s nameattachedinbyline
3 ByAmanda Teyson

9. Malicious Activity
 Social networking as
reconnaissance tool and
propagation method
 Credential collection capability
 Low-sophistication malware
– IRC malware
 Other capabilities anticipated
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 9

10. Malicious Activity
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 10
Linkleads to
fakelogin
portal.
4 Unsuspecting target
directed tocontent.6
User credentials
captured, stolen.5
NEWSCASTER Network (Multiple Fake Personas)
Targeted HVT approached with
connection request.2
Malicious link sent
to target3
HighValue TargetFriends ofHVT
approached first
with request.1

11. IranianTies
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 11
 Infrastructure
 Tehran registration
 “Parastoo”
 Iranian content
 Targeting
 Tehran working hours and
days

12. Implications
 Method is not novel
 What this group lacks in technical
sophistication they make up for in
brashness, creativity, and patience
 We infer from the length of this
operation is indicative of at least
marginal success
 Defense requires a human touch
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 12

13. NEWSCASTER SUMMARY
 3+ year Cyber-espionage campaign with links to Iran
 Targeting high and low ranking personnel in multiple countries– US, UK,
Israel, SaudiArabia, Iraq
– U.S. military
– Congressional personnel
– Washington D.C. area journalists
– Diplomatic corps
– U.S. Defense contractors
– Israeli Defense contractors
– Members of the U.S./Israeli lobby
 Utilizing social media platforms as targeting platform
– Facebook
– LinkedIn
– YouTube
– Etc.
 More than 2,000 targets and legitimate individuals caught in the net
– Credential harvesting
– Access to corporate and personal emails
– Malware with data exfiltration capabilities
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 13

14. Today’s Cyber Security Challenges
CISOsfindingitdifficulttodefinesecurityROItoexecutives
ShortshelflifeforCISOs
Vastlyexpandingattacksurfacearea
Mobile,cloud,virtualization,globalbusinessoperations
Largeprotectioninvestmentsandnogoodprioritizationfilter
Who,why,when,how
Operationalchaos
Toomanyalarms,notenoughpeople,poorprioritization
“Braindead”securitytoolsthatrelyonpastevents/signatures
Versesextremelyagileadversaries
Severebreachescontinue…
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 14

15. How CanCyberThreat Intelligence Help?
1. BeProactive
2. Shrink theProblem
3. ImprovePrioritization
4. EnhanceExecutiveCommunications
5. ConnectSecurityWithBusiness
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 15
CISORecommendation:
“Useacommercialthreat
intelligenceservicetodevelop
informedtacticsforcurrent
threats,andplanforthreats
thatmayexistinthemidterm
future.”
RobMcMillan&KellyKavanagh
TechnologyOverviewforSecurityThreatIntelligenceServiceProviders
Published:16October2013

16. iSIGHT Partners –WhatWe Do
Cyber
Crime
Cyber
Espionage
Distributed
Denial-of-Service
Enterprise
Hacktivism Mobile Vulnerability and
Exploitation
Analyst Access Global Response
ThreatScape® Subscriptions
!
ThreatScapeTechnologies
ThreatScape API
ThreatService™ Engagements
BundledAnalyst Research
! Partner Integrations
Threat Diagnostics
Intelligence Integration
Breach Diagnostics
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 16

17. Formal Research Process
Yields Rich, ContextualThreat Intelligence
Intelligence
Requirements
Created Based
on Clients,
Sectors and
Adversaries
Requirements
Prioritized
by Analysts,
Matched to
Current
Holdings then
Passed to
Research
Teams
Collection
Planning and
Tasking of
Global Teams
Requirements
Collected by
Unique Global
Teams and
returned to
Fusion Center
Processing and
Exploitation
To Standardize
Multiple
Information
Sources Ready
for Analysis
Analysis of
Information and
Production of
Reporting for
Clients
Fully fused,
Corroborated,
Cross-
referenced
and Edited
Multi-source
Intelligence
Reporting
Disseminated
to
Clients
Client
Feedback,
Refinement of
Intelligence
Product
Intelligence
Requirements
Requested
From Client
? i
Feedback &
Clarification
Analysis DisseminationCollection
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved 17

18. HowWe Deliver:
Fully Integrated Dissemination Model
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 18
Executive Summary
Standards
Context
…The campaign is related to other Gameover Zeus analyses as it uses
a similar attack infrastructure and campaign identifiers.
Malicious hyperlinks within the message point to pages hosted on
compromised websites that contain no visible content, but do load
one JavaScript file:
hxxp://crazytraintour.com.ar/jie3Qd6E/js.js
Executives
Risk, Intel, Fraud
SOC
Incident
Response
Tech Security
Controls
Standard Formats
Consumers
Technology Partners
ThreatScape® API
MySIGHT Portal
Email
TechnologiesThreatScape
PGPHTML
TXT
XML
JSON
STIX
PDF
CSV
Data
On April 10, 2012, iSIGHT Partners
observed a mass mailing targeting
chief financial officers (CFOs) with a
fraudulent e-mail titled, "CFO
Bulletin Update.”
Size: 305704 bytes
MD5: 5bda9aea96360d9260d7cf38b416af8c
Digital Signature: This file is digitally signed by 'nYZbvA3YL8XjBMx’
Certificate Validity: 04/10/2012to 01/01/2040
Timestamp: 2010:11:01 22:56:53+01:00
Company Name: Microsoft Corporation
File Description: Windows DiskDiagnostic User Resolver
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Internal Name: DFDWiz.exe
...

19. At the Ready to Help
StephenWard:
sward@isightpartners.com
www.isightpartners.com
Request more information:
info@isightpartners.com
Proprietary and Confidential Information. © Copyright 2014, iSIGHT Partners, Inc. All Rights Reserved www.isightpartners.com 19

20. iSIGHT Partners
200+ experts, 16 Countries, 24 Languages, 1 Mission