The breach of the French satirical magazine Charlie Hebdo in early January 2023 has been attributed to an Iranian nation-state entity sanctioned by the US government.

Microsoft is following the activity cluster under the chemical element-themed appellation NEPTUNIUM, which is an Iran-based corporation known as Emennet Pasargad, according to facts revealed by Microsoft.

The FBI linked the state-backed cyber team to a sophisticated influence effort carried out to meddle with the 2020 presidential elections in January 2022. Two Iranian nationals have been charged in connection with the disinformation and threat campaign.

Microsoft’s announcement came after a “hacktivist” group known as Holy Souls (now known as NEPTUNIUM) claimed to have obtained the personal information of over 200,000 Charlie Hebdo subscribers, including their complete names, phone numbers, home and email addresses.

The hack, which provided NEPTUNIUM access to an internal database, is thought to have been staged in punishment for the publication’s participation in a cartoon contest “ridiculing” Iranian Supreme Leader Ali Khamenei.

The release of the entire cache of stolen material, which was sold for 20 Bitcoin, might result in mass doxing and expose its readership to online or physical targeting by extremist organisations, Redmond warned.

“The breach was propagated by a concerted effort across many social media platforms after Holy Souls posted the sample data on YouTube and multiple hacker forums,” the Windows maker’s Digital Threat Analysis Center (DTAC) said.

“This amplification attempt employed a distinct set of influence tactics, methods, and procedures (TTPs) that DTAC has previously observed in Iranian hack-and-leak influence operations.”

The utilization of false-flag personas to execute hack-and-leak operations, inauthentic sockpuppet accounts, and imitation of authoritative sources are all similarities, according to an FBI advisory issued in October 2022.

According to the FBI, the purpose is to “undermine public trust in the victim’s network and data security, as well as embarrass victim companies and targeted countries.”

“These hack-and-leak tactics entail a combination of data hacking / theft and information operations that have a financial and reputational impact on victims,” the agency noted.

Info source – The Hacker News