Iranian link likely in move to hack Syrian dissident, experts say

Abdul Razzak, a fellow at Internet watchdog group Citizen Lab, quickly determined that the group was bogus.

The email, sent Oct. 3, was an electronic trap — one of hundreds of malicious messages that have flown back and forth as rebels grapple with the government of Bashar Assad in Syria.

Al-Ameer is a well-known opposition figure, and stealing her data or her identity could have been the jumping off point to attack other Syrians in and out of the country.

The group has made a specialty of tracking the hackers who’ve dogged Syria’s opposition, which lead author John Scott-Railton said had turned into “something of a petri dish for threat actors in the Middle East.”

The report says those behind the “Assadcrimes” website appear to have inadvertently exposed their site’s logs, showing evidence that its creators accessed it in part from the Iranian Internet space.

The site itself briefly hosted a Farsi-language email service, and a string of data recovered from the malicious code used to target Al-Ameer appeared to refer to a developer who runs a malicious software site registered in the Iranian city of Shiraz.