Hacker Group Creates Network of Fake LinkedIn Profiles

Dell SecureWorks CTU uncovered a coordinated campaign by suspected Iran-linked TG-2889 that built 25+ fake LinkedIn personas (detailed 'Leader' and sparse 'Supporter' accounts) forming a self-referential endorsement network to groom and social-engineer targets—primarily individuals in MENA telecommunication, government, and defense sectors. CTU links this behavior to Operation CLEVER domains and notes active profile maintenance and identity swapping to inherit credibility, increasing the likelihood of successful spearphishing or malicious website compromises.