NEWSCASTER: An Iranian Threat Within Social Networks - May 28, 2007

iSIGHT Partners documents a long-running social-engineering driven espionage campaign called NEWSCASTER, active since at least 2011, that uses dozens of fabricated personas and a fake news site (NewsOnAir.org) to befriend and phish senior military, government and defense-contractor personnel; the operators host credential-harvesting sites, distribute data-profiling apps that phone home, and operate an IRC-based bot (channels protected by the Persian password “Parastoo”) tied to domains and IPs linked to Iranian hosting and professional-hours activity consistent with Tehran.