WASHINGTON (Sputnik) - An Iranian hacker group with the improbable name Cobalt Dickens, indicted by the United States in March, is likely behind hundreds of fake websites set up to steal research and student passwords from at hundreds of universities, the security firm Secure Works reported on Friday.
"Sixteen domains contained over 300 spoofed websites and login pages for 76 universities located in 14 countries, including Australia, Canada, China, Israel, Japan, Switzerland, Turkey, the United Kingdom and the United States," the release said.
The hacker group was especially active this month, despite a March 2018 indictment by the US Department of Justice of the Mabna Institute and nine Iranian nationals in connection with Cobalt Dickens activity occurring between 2013 and 2017, the release explained.
Secure Works explained that universities are attractive targets for threat actors interested in obtaining intellectual property. In addition to being more difficult to secure than heavily regulated finance or healthcare organizations, universities are known to develop cutting-edge research and can attract global researchers and students.
The bogus websites directed computer users to the official university web pages and then asked users to re-enter their login credentials, the release noted.
The fact of registration and authorization of users on Sputnik websites via users’ account or accounts on social networks indicates acceptance of these rules.
Users are obliged abide by national and international laws. Users are obliged to speak respectfully to the other participants in the discussion, readers and individuals referenced in the posts.
The websites’ administration has the right to delete comments made in languages other than the language of the majority of the websites’ content.
In all language versions of the sputniknews.com websites any comments posted can be edited.
A user comment will be deleted if it:
does not correspond with the subject of the post;
promotes hatred and discrimination on racial, ethnic, sexual, religious or social basis or violates the rights of minorities;
violates the rights of minors, causing them harm in any form, including moral damage;
contains ideas of extremist nature or calls for other illegal activities;
contains insults, threats to other users, individuals or specific organizations, denigrates dignity or undermines business reputations;
contains insults or messages expressing disrespect to Sputnik;
violates privacy, distributes personal data of third parties without their consent or violates privacy of correspondence;
describes or references scenes of violence, cruelty to animals;
contains information about methods of suicide, incites to commit suicide;
pursues commercial objectives, contains improper advertising, unlawful political advertisement or links to other online resources containing such information;
promotes products or services of third parties without proper authorization;
contains offensive language or profanity and its derivatives, as well as hints of the use of lexical items falling within this definition;
contains spam, advertises spamming, mass mailing services and promotes get-rich-quick schemes;
promotes the use of narcotic / psychotropic substances, provides information on their production and use;
contains links to viruses and malicious software;
is part of an organized action involving large volumes of comments with identical or similar content ("flash mob");
“floods” the discussion thread with a large number of incoherent or irrelevant messages;
violates etiquette, exhibiting any form of aggressive, humiliating or abusive behavior ("trolling");
doesn’t follow standard rules of the English language, for example, is typed fully or mostly in capital letters or isn’t broken down into sentences.
The administration has the right to block a user’s access to the page or delete a user’s account without notice if the user is in violation of these rules or if behavior indicating said violation is detected.