Meta, the parent company of Facebook, has announced the removal of two separate cyber espionage groups from Iran that were using the company’s platforms to target academics, activists, journalists, and other victims.
According to Meta, one of the groups, which had been previously identified, posed as a legitimate company and used a complex network of fake personas on Facebook, Telegram, and other platforms to target its victims.
This group, known as UNC788, had already been identified and disrupted by Meta, Google, and several other major platforms.
Meta added that the other newly identified Iranian cyber espionage group targeted companies in the energy, maritime, semiconductor, and telecommunications sectors in multiple countries, including the United States, Israel, Russia, and Canada.
This is not the first time that the Islamic Republic has used social networks such as Facebook to spy on Israel and Western countries.
In a similar operation in recent weeks, the Shin Bet revealed the actions of an Iranian intelligence officer that led to the recruitment of five Israeli women.
The Israeli internal security agency, Shin Bet, announced that four Iranian-Israeli women who had tried to provide information to the Iranian Ministry of Intelligence had been arrested.
Based on reports from Israeli security officials, the link between these four women and a man named Rambod Namdar on Facebook was established.
The Israeli internal security service, Shin Bet, said about the modus operandi of “Rambod Namdar”:
- He claimed to be Jewish and initiated contact with several Israeli women.
- In the next step, Namdar asked them to communicate with him through WhatsApp instead of Facebook.
- Namdar recruited the women through chats.
- He never showed his face.
- Namdar also spoke to them several times via “video chat”, but each time he refused to show his face under the pretext of a broken phone camera or that he was using a tablet that did not have a camera.
Although some of these women suspected that he might be an Iranian intelligence officer, they were persuaded to continue talking to him using Namdar’s common emotional techniques, and in the end, in exchange for money, they agreed to carry out his requests.
Where is Rambad Namadar now?
Rambad Namdar is currently in prison for security crimes in the country. Israel is trying to transfer him to Israel, which has faced resistance from Portugal.
On the other hand, there is news from Tehran that the Islamic Republic is interested in exchanging him with a Portuguese businessman who is currently in prison in Mashhad on charges of drug trafficking.
Interrogation and Trial
Shin Bet also stated that the operation was neutralized in cooperation with the police and that all five women arrested in connection with the case are currently under interrogation.
The latest reports indicate that indictments have been issued for some of them, but at the request of the defendants’ lawyers, their names have been withheld from publication.
Prime Minister Naftali Bennett praised the Shin Bet for stopping the spy ring.
Bennett, thanking the Israeli security forces and being briefed on this security and cyber operation, said: “Israel is fighting against Iran. We are witnessing the overt and relentless efforts of the Islamic Revolutionary Guard Corps to recruit Israeli citizens.”
The Israeli prime minister also warned that Iran is not only trying to physically attack Israel but is also looking for civilians and the Israeli community to try to sow discord and destabilize Israel politically.
Bennett said: “I urge Israeli citizens to be aware of these efforts. The person behind the information you consume or share online may be Iranian. Make no mistake, the long arm of the Israeli security forces will reach anyone who seeks to harm Israel’s security.”
Who are the defendants?
The names of the defendants have not been released due to the security nature of the case and at the request of their lawyers, but the Israeli Internal Security Agency has released a brief description of the defendants, their recruitment methods, and the services they provided to Namdar.
The first defendant is a 35-year-old married woman. She and her husband have been in contact with Namdar online for several years.
Her 40-year-old husband, although suspicious that Namdar was acting as an intelligence officer for the Iranian authorities, nevertheless could not resist Namdar’s offers and the sums of money he offered them. He took pictures of the US Embassy in Tel Aviv, pictures from inside the buildings of the Ministry of Interior and Social Affairs and Social Services in Tel Aviv, and also provided information about security arrangements and pictures of a shopping mall in Holon.
Shin Bet said: “The investigation shows that the suspect’s husband was aware of his wife’s relationship with Namdar and even spoke to Namdar himself, although he suspected that he was an Iranian intelligence officer.”
It is also said that this woman’s husband, who is a taxi driver, even helped her by bringing her to the US Embassy in Tel Aviv so she could take pictures there.
Namdar not only asked them to gather information about senior IDF officers but also asked her husband to tell their son, who was about to be drafted into the Israeli army, to serve in military intelligence.
The couple received a total of $45,000 in US currency in Bitcoin in exchange for the services they provided to Namdar.