Analysts from Proofpoint have observed Advanced Persistent Threat (APT) groups targeting journalist and media organizations. These are sought after targets for state supported threat actors due to their unique access to sensitive information. Proofpoint analysts also noted that journalists are an attractive target for phishing attacks because it is often a necessity to communicate with unknown sources to investigate new leads for stories. Proofpoint observed Chinese APTs targeting journalists email accounts early this year to obtain data on the U.S. response to the war in Ukraine. Iranian APTs have been using a slightly different tactic, impersonating journalists to reach out to targets directly. Some threat groups have sent fake stories from major news outlets hoping an enticing headline will allow for a successful malware delivery.
Analyst Notes
Media outlets and journalists will continue to be targets of APTs due to the unique nature of their job and their access to sensitive information. Anyone working in the media industry and covering a specific country should be familiar with the capabilities and techniques of that country’s threat groups. In general, everyone should protect themselves from phishing scams and attacks. Individuals should use multi-factor authentication (MFA) to protect accounts. Regularly update software and protect data with back-ups. Practicing caution and verifying the identity or source of an email can halt an APT attack in its beginning stages.
https://www.bleepingcomputer.com/news/security/hackers-pose-as-journalists-to-breach-news-media-org-s-networks/
https://www.proofpoint.com/us/blog/threat-insight/above-fold-and-your-inbox-tracing-state-aligned-activity-targeting-journalists
