Hacker Group Supported By Iranian Government Attacks Numerous ‘High Profile’ Accounts, Microsoft Says

Microsoft said Wednesday they stopped hacking attacks on numerous “high profile” accounts, according to an official company blog post.

Phosphorus, an Iranian-backed hacker group, attacked more than “100 high-profile” possible attendees to the Munich Security Conference and the Think 20 Summit in Saudi Arabia, according to Microsoft Corporate Vice President Tom Burt. Microsoft said the group’s intention appeared to be to collect intelligence.

The company said the attack targeted former ambassadors and other senior policy experts with hackers masquerading as event organizers.

“The Munich Security Conference is the most important gathering on the topic of security for heads of state and other world leaders, and it has been held annually for nearly 60 years, ” Burt said in the post.

“Likewise, T20 is a highly visible event that shapes policy ideas for the G20 nations and informs their critical discussions.”

“The attackers have been sending possible attendees spoofed invitations by email. The emails use near-perfect English and were sent to former government officials, policy experts, academics and leaders from non-governmental organizations,” he continued.

https://twitter.com/ericgeller/status/1321451658585513990?ref_src=twsrc%5Etfw” target=”_blank” rel=”noopener noreferrer
Phosphorus invited users to confirm their attendance to the event, and would then steal the user’s credential’s through a fake login page, according to Tech Crunch.  The group’s actions were not connected to the upcoming 2020 election, based on analysis, Burt said.

Microsoft obtained a court order in March to seize the domains Phosphorus used for phony Google and Yahoo logins in order to take credentials, Tech Crunch reported. Microsoft and The State Department did not immediately respond to the Daily Caller News Foundation’s request for comment.