Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

Exploit-DB RSS Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Iranian threat group Educated Manticore, associated with the Islamic Revolutionary Guard Corps, has launched spear-phishing campaigns targeting Israeli journalists, cyber security experts and computer science professors. The attackers posed as fictitious assistants to technology executives or researchers, directing victims to fake Gmail login pages or Google Meet invitations. This allowed them to intercept passwords and 2FA codes, gaining unauthorized access to victims' accounts. The group used a custom phishing kit implemented as a Single Page Application built with React, supporting various Google authentication flows and enabling 2FA relay attacks. The infrastructure relied on over 130 unique domains resolving to multiple IP addresses. Despite increased exposure, Educated Manticore continues to pose a persistent threat, particularly to individuals in Israel during the Iran-Israel conflict escalation.

Educated Manticore is an Iranian state-sponsored threat group linked to the Islamic Revolutionary Guard Corps (IRGC). This group has been conducting targeted spear-phishing campaigns aimed at Israeli journalists, cybersecurity professionals, and computer science academics. The attackers impersonate fictitious assistants to technology executives or researchers, leveraging social engineering to lure victims into interacting with malicious content. The core attack vector involves directing victims to counterfeit Gmail login pages or fraudulent Google Meet invitations. These phishing pages are crafted as Single Page Applications (SPAs) using React, enabling sophisticated mimicry of legitimate Google authentication flows. This design supports the interception of both passwords and two-factor authentication (2FA) codes through relay attacks, effectively bypassing standard 2FA protections. The infrastructure supporting these campaigns is extensive, utilizing over 130 unique domains that resolve to multiple IP addresses, indicating a robust and resilient command and control setup. Despite increased visibility and exposure of their tactics, Educated Manticore remains an active and persistent threat, particularly in the context of heightened tensions between Iran and Israel. The group’s use of advanced phishing kits and multi-domain infrastructure demonstrates a high level of operational capability and adaptability, targeting high-value individuals in the technology and academic sectors to gain unauthorized access to sensitive accounts and information.

CC=RU ASN=AS210512 internet technologies llc

Detailed information about Iranian Educated Manticore Targets Leading Tech Academics. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'educated manticore'

Filter Threats

Threats Tagged 'educated manticore'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility