'Wanted: enemy agents' | Iranians root out spies using recruitment company ruse

A sophisticated Iranian espionage operation, masquerading as a professional recruiting business, has been uncovered by US cybersecurity firm Mandiant, a division of Google Cloud.

The operation, which dates back to at least 2017, targeted national security officials across Iran, Syria, and Lebanon, raising significant concerns about the vulnerabilities in recruitment processes.

According to Mandiant's research, the hackers behind the operation are loosely connected to a group known as APT42 or Charming Kitten, which has previously been accused of hacking the US presidential campaign of Republican candidate Donald Trump and is widely attributed to an intelligence division of the Iranian Revolutionary Guard.

Read more from us

The great treasure hunt | A CHRO's guide to attracting, hiring, and retaining top talent

The cyber espionage mission utilized a network of websites impersonating HR companies to manipulate Farsi-speaking targets. The bogus firms operated under names such as VIP Human Solutions (also known as VIP Recruitment), Optima HR, and Kandovan HR.