Hackers linked to Iran target WHO staff emails during coronavirus

Traffic passes the Regional Office for the Americas of the World Health Organization (WHO) during the coronavirus disease (COVID-19) outbreak in Washington, D.C. March 22, 2020. (Reuters)
Short Url
Updated 03 April 2020

Hackers linked to Iran target WHO staff emails during coronavirus

  • Attacks show how the WHO and other organizations at the center of a global effort to contain the coronavirus have come under a sustained digital bombardment by hackers
  • Large prizes for intelligence agencies would include coronavirus response plans for various countries, or word of effective treatments

SAN FRANCISCO/WASHINGTON/LONDON: Hackers working in the interests of the Iranian government have attempted to break into the personal email accounts of staff at the World Health Organization during the coronavirus outbreak, four people with knowledge of the matter told Reuters.
It is not clear if any accounts were compromised, but the attacks show how the WHO and other organizations at the center of a global effort to contain the coronavirus have come under a sustained digital bombardment by hackers seeking information about the outbreak.
Reuters reported in March that hacking attempts against the United Nations health agency and its partners had more than doubled since the beginning of the coronavirus crisis, which has now killed more than 40,000 worldwide.
The latest effort has been ongoing since March 2 and attempted to steal passwords from WHO staff by sending malicious messages designed to mimic Google web services to their personal email accounts, a common hacking technique known as “phishing,” according to four people briefed on the attacks. Reuters confirmed their findings by reviewing a string of malicious websites and other forensic data.
“We’ve seen some targeting by what looks like Iranian government-backed attackers targeting international health organizations generally via phishing,” said one of the sources, who works for a large technology company that monitors Internet traffic for malicious cyber activity.
WHO spokesman Tarik Jasarevic confirmed that personal email accounts of WHO staff were being targeted by phishing attacks, but said the WHO did not know who was responsible. “To the best of our knowledge, none of these hacking attempts were successful,” he said.
Iran’s government denied any involvement. “These are all sheer lies to put more pressure on Iran,” said a spokesman at Iran’s information technology ministry. “Iran has been a victim of hacking.”
Karim Hijazi, chief executive of cyber intelligence firm Prevailion, shared his recently captured data with Reuters that shows a sophisticated hacking group was actively targeting the global health organization. Reuters couldn’t independently confirm his analysis. Hijazi said the identity of the hackers was difficult to determine, although their techniques appeared advanced.
The intrusion attempts are distinct from others reported by Reuters last week, which sources said were thought to be the work of an advanced group of hackers known as DarkHotel that has previously been active in East Asia — an area that has been particularly affected by the coronavirus.
The motives of the hackers was not clear, but targeting officials at their personal accounts is a longstanding intelligence-gathering technique.
Other details in this phishing attempt point to links with Tehran. For example, Reuters found that the same malicious websites used in the WHO break-in attempts were deployed around the same time to target American academics with ties to Iran.
The related activity — which saw the hackers impersonate a well-known researcher — parallels cases Reuters previously documented where alleged Iranian hackers masqueraded as media figures from organizations such as CNN or The New York Times to trick their targets.
Iran has suffered enormous loss of life from the coronavirus, and infections have reached the inner circle of the country’s leadership.
A person close to US intelligence said he was aware of the Iranian campaign and that such attacks are standard fare during times of international crisis.
While large prizes for intelligence agencies would include coronavirus response plans for various countries or word of effective treatments, more benign data, such as WHO estimates for infection rates, would also be valuable, the person said.


Trump signs order targeting social media giants' legal protections

Updated 28 May 2020

Trump signs order targeting social media giants' legal protections

  • President lashed out at Twitter for applying fact checks to two of his tweets

WASHINGTON: President Donald Trump escalated his war on social media companies, signing an executive order Thursday challenging the liability protections that have served as a bedrock for unfettered speech on the internet.
Still, the move appears to be more about politics than substance, as the president aims to rally supporters after he lashed out at Twitter for applying fact checks to two of his tweets.
Trump said the fact checks were “editorial decisions” by Twitter and amounted to political activism. He said it should cost those companies their protection from lawsuits for what is posted on their platforms.
Trump and his allies, who rely heavily on Twitter to verbally flog their foes, have long accused the tech giants in liberal-leaning Silicon Valley of targeting conservatives on social media by fact-checking them or removing their posts.
“We’re fed up with it," Trump said, claiming the order would uphold freedom of speech.
It directs executive branch agencies to ask independent rule-making agencies including the Federal Communications Commission and the Federal Trade Commission to study whether they can place new regulations on the companies — though experts express doubts much can be done without an act of Congress.