Referred to as Operation SpoofedScholars, the campaign has been ongoing since at least January 2021, with a focus on harvesting sensitive information from individuals of interest, such as senior professors from well-known academic institutions and people focusing on the Middle East, including experts working with think tanks and journalists.
Believed to be supporting the information collection efforts of the Iranian Revolutionary Guard Corps (IRGC), TA453 engaged in benign conversations with their targets, up to the point when they served a ‘registration link’ leading to a legitimate, albeit compromised website of University of London’s SOAS radio.
