The United Kingdom has issued a warning about the threat posed by targeted spear-phishing campaigns against organisations and individuals conducted by cyber actors based in Russia and Iran.

The National Cyber Security Centre (NCSC) published an advisory this week that shared details about the attackers' techniques and tactics, as well as mitigation advice to combat the ongoing threat.

Spear-phishing involves an attacker sending malicious links to specific targets, usually via email, in order to persuade them to share sensitive information.

According to the advisory, separate malicious campaigns were carried out throughout 2022 by Russia-based group SEABORGIUM and Iran-based group TA453, also known as APT42, to target a variety of organisations and individuals in the UK and elsewhere for information-gathering purposes.

The attacks are not aimed at the general public but targets in specified sectors, including academia, defence, government organisations, NGOs, think-tanks, as well as politicians, journalists and activists.

Based on NCSC knowledge and extensive industry reporting, the advisory urges organisations and individuals to remain vigilant to approaches and follow advice to protect their online accounts from compromise.

Paul Chichester, NCSC Director of Operations, said:

“The UK is committed to exposing malicious cyber activity alongside our industry partners and this advisory raises awareness of the persistent threat posed by spear-phishing attacks.

“These campaigns by threat actors based in Russia and Iran continue to ruthlessly pursue their targets in an attempt to steal online credentials and compromise potentially sensitive systems.

“We strongly encourage organisations and individuals to remain vigilant to potential approaches and follow the mitigation advice in the advisory to protect themselves online.”

This is typical of spear-phishing attacks, in which the actor conducts reconnaissance around their target in order to tailor their content before making an approach.

Contact may appear benign at first as the attacker attempts to gain targets' trust and build a rapport before sharing malicious links that can lead to credential theft and further compromise.

The advisory describes how approaches have been made via email, social media and professional networking platforms, with attackers impersonating real-world contacts of their targets, sending false invitations to conferences and events, and sharing malicious links disguised as Zoom meeting URLs.

While the malicious campaigns employ similar techniques and have similar targets, the campaigns are distinct and the two actors are not working together.

Individuals or organisations in the identified sectors should notify the NCSC if they notice the specific and targeted activity described in the advisory.

The advisory includes the following advice to mitigate the spear-phishing activity:

• Use strong and separate passwords for your email account
• Turn on multi-factor authentication (also known as 2-step verification, or 2SV)
• Protect your devices and networks by keeping them up to date
• Exercise vigilance
• Enable your email providers’ automated email scanning features
• Disable mail-forwarding

The ‘Think Before You Link’ app, from the Centre for the Protection of National Infrastructure (CPNI), is also designed to help individuals identify malicious online profiles and reduce the risk of being targeted.

The NCSC is dedicated to raising awareness of the most recent cyber threats and offers a variety of practical advice on its website to assist public sector organisations, critical national infrastructure, businesses of all sizes, and individuals in protecting themselves online.

View the full advisory here.

Reporting

Report all Fraud and Cybercrime to Action Fraud by calling 0300 123 2040 or online. Forward suspicious emails to report@phishing.gov.uk. Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).