The report states that the attackers who tried to hack into journalists’ computers pretended to be media representatives. The story touches on several groups impersonating or harassing journalists in 2021-2022.

Report details

• from the beginning of 2021 Chinese group Zirconium It attacked American journalists with emails containing private audiences that let the attackers know that the messages had been viewed. This simple trick allowed attackers to learn the IP address of the target, from which additional information could be obtained, for example, about the victim’s location and Internet provider.
• in April 2022 discovered another Chinese groupIt attacks media using RTF files that, when opened, infect the victim’s machine with the Chinoxy virus. This group mainly attacked publications dealing with Afghanistan’s foreign policy.
• in the spring of 2022 North Korean hackers It was also seen in attacks against media workers and used fake job postings for this.
• Turkish group organized credential collection campaigns aimed at hacking journalists’ social media accounts.

In order to contact targets and further compromise their devices, some hackers disguised by impersonating media members. This tactic is mainly used by Iranian hackers such as Charming Kitten, who are posing as journalists to email academics and experts on Middle East politics. Another example is the Tortoiseshell group, which disguises its emails as newsletters from the Guardian and Fox in hopes that it will help the virus reach victims.

Researchers believe that attacks using phishing, social engineering and other similar tactics will continue into the future. At the same time, hackers’ goals can range from a desire to collect confidential information to attempts to manipulate public opinion.