AI Security and Intelligent Operations
How do hackers use AI to wage public opinion warfare?
▌ ASA Threat Group Targeted Olympics, Manipulated French Company's Screens to Condemn Hostile Country
According to researchers, an Iranian cyber group known as "ASA" once targeted the 2024 Summer Olympics, manipulating the dynamic display screens of a French company to issue statements condemning Israel's participation. An Iranian cyber group named "Emennet Pasargad" has been using "Aria Sepehr Ayandehsazan" (ASA for short) as a cover name since mid-2024, and targeted the 2024 Summer Olympics. The group successfully infiltrated the systems of a French commercial dynamic display provider with the intent of displaying messages condemning Israel's participation in this international sporting event.
During mid-2024, the ASA group utilized multiple cover identities and demonstrated high-level cyber skills to execute a series of cyber-enabled operations. Among these, the cyber attack targeting the 2024 Summer Olympics was particularly notable, successfully breaching the systems of a French commercial dynamic display provider in an attempt to spark public controversy.
Additionally, the ASA group stole content from webcams and utilized artificial intelligence (AI) software such as Remini AI Photo Enhancer for image enhancement, Voicemod and Murf AI for voice modulation, and Appy Pie for image generation, to widely disseminate its propaganda messages.
Recent research not only exposes Iran's active operations and potential risks in cyberspace, but also provides valuable guidance and warning for the international community in preventing and responding to such cyber attacks.
▌ The Multifaceted Tactics and Global Cyber Attacks of "Cotton Sandstorm"
Through tracking and analysis by researchers, an Iranian-backed cyber threat group, operating under various aliases such as "Al-Toufan" and "Anzu Team", is actively engaged in cyberspace and influence operations. Known by the moniker "Cotton Sandstorm", the group conducted reconnaissance and initial penetration attempts against election-related websites in a hostile country in April this year. In May this year, the group was also found to be suspected of conducting similar reconnaissance activities against major media publications in the target country.
Particularly noteworthy is the group's recent adoption of an innovative tactical approach, establishing fictitious hosting reseller identities to support its cyber operations infrastructure. Since around mid-2023, the group began utilizing two cover hosting service providers, "Server-Speed" (server-speed[.]com) and "VPS-Agent" (vps-agent[.]net), to manage its infrastructure and obscure its true identity. It cleverly set up its own reseller accounts and procured server space from multiple European providers. Subsequently, the group leveraged these cover reseller accounts to provide the necessary server resources for its own cyber operations teams to execute various malicious cyber activities.
The following are some of Cotton Sandstorm's operations in recent years:
Furthermore, ASA is also linked to the alias "Cyber Court", which promotes the activities of several cover hacktivist groups controlled by ASA on Telegram channels and a dedicated website ("cybercourt[.]io").
