Tortoiseshell__2021__I_Knew_You_Were_Trouble_TA456_Targets_Defense_Contractor_with_Alluring_Social_Media_Persona_Proofpoint_US.pdf

Proofpoint reports a years-long social-engineering campaign by TA456, an Iranian-state affiliated actor, using the persona Marcella Flores to recruit an employee at a defense contractor's subsidiary; the group delivered LEMPO malware to establish persistence, conduct host reconnaissance, and exfiltrate data via SMTPS, while targeting smaller subcontractors to enable broader access, with cross-platform social engineering and open attribution linking TA456 to other Iranian groups.