Mossad.com: How Iran is Using Fake Job Sites and Movie Studios to Catch Moles
summary
An Iran-linked cluster builds fake Mossad job sites and a bogus film studio to lure IRGC, Assad-regime, and Hezbollah security vets, using Google Ads, Telegram contacts, shared registrars and a copied Google Analytics account; infrastructure profiling links the cluster to previously attributed APT35 activity and Shin Bet says one site was used to lure people abroad for kidnap/kill. A canary-token résumé test shows operators avoid opening on internet-connected hosts; VIP Human Solutions and Hatcast film studio branding persist, and some respondents and alleged arrests are publicly reported.
AI-written summary · about
chapters (8)
- 0:00Introduction and context
- 1:36Discovering the phishing sites
- 3:24Distinguished impersonators
- 5:57Recruitment ruses
- 8:47State awareness and oversight
- 12:37Spaghetti matrix and analysis
- 15:13The Tehran show obsession
- 18:19Conclusion and Q&A
related talks
52mIran's Soft-War for Internet Dominance
20mYour Persistent Friend: The Untold History of Iran’s Effectiveness in Using...
07mThe Fake IT Worker Scam Unmasked
08mIran's Decade of Soft War: Dissidents, Trolls, and Khamenei
21mWHOIS Your Daddy: Tracking Iranian-backed Cyber Operations...
29mFake Hires, Real Threats: When Background Checks Aren’t Enough
12mTheir Own Little War: Iran Adopts Disruptive Ransomware
30mThe Hidden Layer of Cyberattacks