Security News > 2021 > July > Iranian Spies Maintained Social Media Persona for Years Before Targeting Defense Contractor
An Iranian state-sponsored threat actor tracked as TA456 maintained a social media account for several years before engaging with their intended victim, cybersecurity firm Proofpoint reports.
The newly detailed activity attributed to the group involved the use of the social media persona "Marcella Flores," which was used to engage with an employee of a subsidiary of an aerospace defense contractor over multiple communication platforms, to gain their trust in an attempt to infect them with malware.
The adversary maintained the online persona for several years, uploading the first photo to the Marcella Flores Facebook profile in 2018 and befriending the intended victim in 2019, if not before.
The Marcella Flores persona employed in this campaign showed similarities with other fictitious profiles that known Iran-linked threat actors have used in operations targeting individuals of interest.
Using Marcella's persona, the adversary befriended several defense contractor employees.
The Marcella Flores persona was removed from the social media platform at that time.