Mike Lennon (2014), SecurityWeek (news) — https://www.securityweek.com/iranian-hackers-targeted-us-officials-ela…
Key takeaways
- The article reports iSIGHT Partners’ account of NEWSCASTER, a multi-year (from 2011) campaign that it believes was run from Iran. Fake personas, including falsified journalist identities and a fictitious news site, befriended more than 2,000 people, including US officials, and then used the social links for credential phishing and reconnaissance.
Seeded from the abstract and a skim, before the reading in NOTE-058. What follows is what the work says about itself.
SecurityWeek reports a campaign that the intelligence firm iSIGHT Partners called NEWSCASTER. More than a dozen fabricated personas on Facebook, Twitter, LinkedIn, Google+, YouTube and Blogger, backed by a fake outlet (NewsOnAir.org), connected with targets such as US military, diplomatic and congressional staff, journalists, think tanks and defence contractors. The connections were then used for spear-phishing and credential harvesting, with some unsophisticated malware. iSIGHT attributed the operators to Iran, but said there was no direct evidence of government sponsorship.
Standing in the record
Filed from the survey of 2026-09-25 of work the anthology set aside as out of scope (tier C): 375 seconds of active reading over 1 session in the papers-feed tracker. It was filed Deferred, unread. NOTE-058 is the close reading of 2026-09-25, and it placed the work: Active — a faithful relay of iSIGHT Partners’ public NEWSCASTER disclosure (28 May 2014), which is the primary source to read and is not held here; every passage this article attributes to a ‘closely held report’ is in that public disclosure, and ‘2,000’ counts connections, not victims.
When seeded, before the reading in NOTE-058, the entry gave a priority for a deeper reading: low — It is a short news item that has been read in full. The survey’s triage (“drop: news”) seems right unless the primary report is wanted.
What the seeding asked a deeper reading to check (NOTE-058 is that reading):
- It is a secondary news report of a vendor’s claims. The primary source would be the iSIGHT NEWSCASTER report, if it can be found, and later academic or government write-ups of the campaign.
- It is an early, well-known case of persona-based social engineering that predates the generative-AI version of the same technique. Useful historical context for an information-operations topic, not evidence.
Access when seeded: The batch URL was truncated. I reconstructed the full slug, which matches the truncated prefix and the title, and fetched the full article (article:published_time 2014-05-29T12:58:23Z; author Mike Lennon). I did not reach the underlying iSIGHT Partners report, which the article calls “closely held”.