Hackers using job offers target dissidents

Hacker groups from Iran and the DPRK are believed to be behind a recent spate of job offer hacking attempts, according to two new reports from Mandiant and Secureworks.

The hack attempts, which were both reported on March 9, appear to be aimed at either targeting dissidents and their allies, in the case of the suspected Iran attacks, or at general espionage, in the case of the suspected DPRK attacks.

Suspected Iran attack. A threat actor or actors posing as an Atlantic Council worker named Sara Shokouhi targeted Middle East analysts in late February, asking them to help with a report. No one named Shokouhi appears to work with the Council, however, and the photos used in the profile belong to a tarot reader based in Russia.