{"id":27,"date":"2021-10-14T14:36:04","date_gmt":"2021-10-14T14:36:04","guid":{"rendered":"http:\/\/pc-keeper.tech\/index.php\/2021\/10\/14\/a-telegram-bot-told-iranian-hackers-when-they-got-a-hit\/"},"modified":"2021-10-14T14:36:04","modified_gmt":"2021-10-14T14:36:04","slug":"a-telegram-bot-told-iranian-hackers-when-they-got-a-hit","status":"publish","type":"post","link":"https:\/\/pc-keeper.tech\/index.php\/2021\/10\/14\/a-telegram-bot-told-iranian-hackers-when-they-got-a-hit\/","title":{"rendered":"A Telegram Bot Told Iranian Hackers When They Got a Hit"},"content":{"rendered":"

[ad_1]
\n<\/p>\n

\n

When the Iranian<\/span> hacking group APT35 wants to know if one of its digital lures has gotten a bite, all it has to do is check Telegram. Whenever someone visits one of the copycat sites they\u2019ve set up, a notification appears in a public channel on the messaging service, detailing the potential victim\u2019s IP address, location, device, browser, and more. It\u2019s not a push notification; it\u2019s a phish notification.<\/p>\n

Google\u2019s Threat Analysis Group outlined the novel technique as part of a broader look at APT35, also known as Charming Kitten, a state-sponsored group that has spent the last several years trying to get high-value targets to click on the wrong link and cough up their credentials. And while APT35 isn\u2019t the most successful or sophisticated threat on the international stage\u2014this is the same group, after all, that accidentally leaked hours of videos of themselves hacking\u2014their use of Telegram stands out as an innovative wrinkle that could pay dividends.<\/p>\n

The group uses a variety of approaches to try to get people to visit their phishing pages in the first place. Google outlined a few scenarios it has observed lately: the compromise of a UK university website, a fake VPN app that briefly snuck into the Google Play Store, and phishing emails in which the hackers pretend to be organizers of real conferences, and attempt to entrap their marks through malicious PDFs, Dropbox links, websites, and more.\u00a0<\/p>\n

In the case of the university website, the hackers direct potential victims to the compromised page, which encourages them to log in with the service provider of their choice\u2014everything from Gmail to Facebook to AOL is on offer\u2014to view a webinar. If you enter your credentials, they go straight to APT35, which also asks for your two-factor authentication code. It\u2019s a technique so old it\u2019s got whiskers on it; APT35 has been running it since 2017 to target people in government, academia, national security, and more.\u00a0<\/p>\n

\n