Researchers at Mandiant unit uncovered a web of social media accounts, fake websites and more used by Iran’s military to gain information on “Iranians and domestic threats who may be collaborating with intelligence and security agencies abroad, particularly in Israel.”
Mandiant found multiple fake social media accounts on Twitter, Telegram, YouTube and an Iranian social media site known as Virasty the posts promote recruiting firms offering jobs in IT, cybersecurity and human resources
The campaign appears to have begun as early as 2017 and lasted until March 2024
The Mandiant report was released on the same day as a Microsoft study on another allegedly Iran-based campaign involving a custom malware named Tickler.
Mandiant attributed the campaign to Iran’s government based on the tactics, techniques and targeting seen. The security company noted that it saw no relation between this campaign and the recently discovered operations targeting U.S. elections.
https://therecord.media/iran-targets-us-election
I Spy With My Little Eye: Uncovering an Iranian Counterintelligence Operation