Iranian Educated Manticore Targets Leading Tech Academics

Key findings

• Amid ongoing tensions between Iran and Israel, the Iranian threat group Educated Manticore, associated with the Islamic Revolutionary Guard Corps, has launched spear-phishing campaigns targeting Israeli journalists, high-profile cyber security experts and computer science professors from leading Israeli universities.
• In some of those campaigns, Israeli technology and cyber security professionals were approached by attackers who posed as fictitious assistant to technology executives or researchers through emails and WhatsApp messages.
• The threat actors directed victims who engaged with them to fake Gmail login pages or Google Meet invitations. Credentials entered on these phishing pages are sent to the attackers, enabling them to intercept both passwords and 2FA codes and gain unauthorized access to the victims’ accounts.
• Check Point Research continues to track the large and evolving cluster of infrastructure used to facilitate credential harvesting in support of Educated Manticore’s cyber-espionage activities.

Introduction

For the last few years, Check Point Research has been monitoring the activity of the Iranian APT group, Educated Manticore. This group aligns with activity tracked by the wider security community as APT42, Charming Kitten, or Mint Sandstorm, and is believed to operate on behalf of the Islamic Revolutionary Guard Corps’ Intelligence Organization (IRGC-IO).

Over the years, Educated Manticore has consistently used spear-phishing as a core tactic to target individuals across government, military, research, media, and policy sectors. In addition to developing and deploying custom backdoors such as CharmPower (aka POWERSTAR) and PowerLess, the group has conducted numerous targeted phishing campaigns including those aimed at senior officials and their PII and identity documents.

One of the group’s long-running operations targets Israeli individuals fake meeting invitations. Attackers impersonate a wide range of personas, from high-ranking individuals to journalists or researchers, to gain credibility and lure victims into interaction. Victims are then directed to custom phishing kits designed to harvest credentials to their Google, Outlook, or Yahoo accounts. In some reported cases, this has compromised Israeli journalists’ accounts. Following the outbreak of the Iran–Israel war, we observed a new phase of this campaign in which Educated Manticore began using the name and credibility of cybersecurity companies to gain their victims’ trust, focusing on renowned academic experts in cyber security and computer technology.

Initial Vector: Spear-phishing

Starting mid-June, top cyber and computer science experts from leading Israeli universities were approached by individuals impersonating fictitious employees of cybersecurity companies, either by email or in WhatsApp messages.

Judging by the formal tone, structured layout, and error-free grammar, the email appears to have been crafted with AI assistance. However, despite its polished writing, some observant targets noticed signs that revealed it was fake — for instance, a mismatch between the name in the email body “Sarah Novominski” and the sender’s email account name, “Sara Noviminski”.

Another message, sent via WhatsApp to a different target, leverages the current tensions between Iran and Israel to lure the recipient into an urgent meeting. Interestingly, in this case, the threat actors also suggest meeting in person in Tel Aviv. This could be a tactic aimed to secure quicker confirmation for an online meeting. However, given the history of Iranian operations, the possibility that this campaign extends beyond cyberspace cannot be entirely ruled out.

In all cases, the initial message contains no links, but the attackers quickly gain the victims’ trust through prompt and persuasive interactions, ultimately guiding them to an online meeting link that leads to attacker-controlled phishing infrastructure.

Google Authentication Custom Phishing Kit

Before sending the phishing link, threat actors ask the victim for their email address. This address is then pre-filled on the credential phishing page to increase credibility and mimic the appearance of a legitimate Google Authentication flow.

Figure 3 – Link to the phishing page sent via WhatsApp to one of the targets. The target communicates in Hebrew and refuses to use the link as it suspiciously asks for credentials.

The phishing kit used by Educated Manticore is implemented as a Single Page Application (SPA) built with React. It is tightly bundled, minified, and obfuscated. The main page code of it is very laconic as all the visible UI is dynamically rendered by JS (in the example below, main.a184cc65.js) once the app loads: