Iran Operated Fake Human-Resources Firm to Root Out Unfriendly Spies, Researchers Say
FILE PHOTO: Figurines with computers are seen in front of USA and Iran flags in this illustration taken, September 10, 2022. REUTERS/Dado Ruvic/Illustration/File Photo
Iran Operated Fake Human-Resources Firm to Root Out Unfriendly Spies, Researchers Say
FILE PHOTO: Figurines with computers are seen in front of USA and Iran flags in this illustration taken, September 10, 2022. REUTERS/Dado Ruvic/Illustration/File Photo
An Iranian hacking group ran a fake professional recruiting business to lure national security officials across Iran, Syria and Lebanon into a cyber espionage trap, according to new research by US cybersecurity firm Mandiant, a division of Alphabet's Google Cloud.
Researchers said the hackers are loosely connected to a group known as APT42 or Charming Kitten, which was recently accused of hacking the US presidential campaign of Republican candidate Donald Trump. APT42 is widely attributed to an intelligence division of the Iranian Revolutionary Guard, an expansive military organization based in Tehran. The FBI has said it is investigating APT42’s ongoing efforts to interfere in the 2024 US election, Reuters reported.
The mission uncovered by Mandiant dates back to at least 2017 and was active until recently. At different times, the Iranians made their operation appear as if it was controlled by Israelis. Analysts say the likely purpose of the impersonation was to identify individuals in the Middle East who were willing to sell secrets to Israel and other Western governments. It targeted military and intelligence staff associated with Iran’s allies in the region.
“The data collected by this campaign may support the Iranian intelligence apparatus in pinpointing individuals who are interested in collaborating with Iran’s perceived adversarial countries,” the Mandiant report said. “The collected data may be leveraged to uncover human intelligence (HUMINT) operations conducted against Iran and to persecute any Iranians suspected to be involved in these operations.”
Iran's mission to the United Nations did not immediately respond to a request for comment.
Mandiant found that the digital spies used a network of websites impersonating human resources companies to manipulate Farsi-speaking targets. The bogus firms were named VIP Human Solutions, also known as VIP Recruitment, Optima HR and Kandovan HR, among others. They leveraged dozens of inauthentic online profiles on Telegram, Twitter, YouTube and social media platform Virasty, which is popular in Iran, to promote the front companies. Nearly all the associated internet accounts have since been removed.
“VIP Recruitment, a center for recruiting respected military personnel into the army, security services and intelligence from Syria and Hezbollah, Lebanon,” said a statement on one of the websites. “Join us to help each other impact the world. Our duty is to protect your privacy.”
The hackers cast a wide net by using various social media platforms to disseminate links about their fake HR scheme. It is unclear how many targets ultimately fell for the ruse. The collected data, which included addresses, contact details and other resume-related data, could still be exploited in the future, Mandiant said.
What Does Activating the 7700, 7600 and 7500 Emergency Codes Mean in Aviation?https://english.aawsat.com/world/5324790-what-does-activating-7700-7600-and-7500-emergency-codes-mean-aviation
An illustration showing the layout of a modern glass cockpit, with advanced digital displays and the center pedestal located between the captain's and first officer's seats. The transponder used by pilots to enter the three-digit emergency codes 7700, 7600 and 7500 is located in this area. The codes are then displayed on air traffic controllers' radar screens. (Wikipedia)
What Does Activating the 7700, 7600 and 7500 Emergency Codes Mean in Aviation?
An illustration showing the layout of a modern glass cockpit, with advanced digital displays and the center pedestal located between the captain's and first officer's seats. The transponder used by pilots to enter the three-digit emergency codes 7700, 7600 and 7500 is located in this area. The codes are then displayed on air traffic controllers' radar screens. (Wikipedia)
In aviation, flights operate according to carefully defined scenarios, but behind the apparent calm of the cockpit lies a coded digital language capable of changing the situation in the skies within seconds.
The recent incident involving a Flydubai flight, during which the emergency codes 7700 and then 7500 were activated, has again drawn attention to the strict and largely unseen protocols used by air traffic control centers to manage complex emergencies.
Between the emergency signal for a technical failure and the dramatic shift to the code indicating unlawful interference, how do the "shadow soldiers" on the ground manage a crisis involving an aircraft suspended between the sky and the ground until its wheels reach the safety of the runway?
The Silent Code and the Geography of Risk in Air Traffic Control Centers
Air traffic control centers monitor air traffic through continuous radio signals transmitted by the aircraft's transponder. When a cockpit crew faces a serious predicament, words can become a burden, and pressing buttons on the aircraft's equipment becomes the fastest means of signaling for help.
These distress signals appear on ground radar screens as flashing signals with distinctive colors that immediately draw the controller's attention. Internationally, they are known as "squawk codes," as designated by the International Civil Aviation Organization (ICAO).
Code 7700 represents the first technical and operational line of defense. It signals a major general emergency, which may range from critically low fuel or engine failure to serious medical emergencies, requiring an immediate response to secure a landing route.
But the danger takes on a different dimension when the code changes to 7500, the code for unlawful interference and hijacking. This alarming signal tells ground operations that the cockpit may have fallen under the control of an outside party, or that the safety of the aircraft and its passengers is under an imminent threat involving weapons or intimidation.
An image showing the layout of aircraft cockpits (Wikipedia)
The Mystery of Radio Silence and Decoding Code 7600
Between these two dangers is the other well-known code, 7600, which is used to indicate a complete failure of the aircraft's radio communications systems.
This code presents a unique challenge. The aircraft becomes "deaf and mute" in the sky, unable to receive instructions from the ground or transmit reports, while remaining visible on radar screens. Air traffic control handles code 7600 based on a clear assumption: controllers assume the pilot will follow the original flight plan precisely and begin clearing the airspace ahead of the aircraft based on its expected route.
The greatest danger lies in the overlap between these codes. Code 7600 may result from an innocent electrical failure, but in other scenarios it could be a deliberate maneuver by hijackers who have disconnected communications equipment to isolate the aircraft. This puts air traffic control centers on maximum alert as they work to resolve the ambiguity and determine that it has not developed into a 7500 situation.
Airspace Surgery and Securing Clear Routes
Once air traffic controllers detect the technical emergency code 7700, they begin what amounts to precise surgery in the surrounding airspace. Controllers immediately stop managing normal commercial traffic flow and focus their full attention on securing a route for the aircraft in distress.
All nearby aircraft receive decisive instructions to change altitude and move away from the affected aircraft's flight path, leaving the surrounding airspace completely clear and protected against any potential collision.
Ground authorities give the aircraft in distress absolute priority over all other flights and completely exempt it from the standard speeds and altitudes normally used in air navigation. Within minutes, control towers coordinate with ground authorities at the destination airport, positioning firefighting and rescue vehicles along the runway in preparation for a landing that may require urgent mechanical intervention.
Concealment Protocol and Management of Security Intervention
The situation inside operations centers changes completely if the alert becomes the hijacking code 7500. At that point, the crisis ceases to be a general aviation event and becomes a national security matter subject to the sovereign laws of the countries involved.
Strict international instructions require air traffic controllers to follow a protocol of radio silence and concealment. They are completely prohibited from using language over open radio frequencies that could indicate a hijacking or the presence of a security threat, in order to avoid provoking the perpetrators inside the cabin if they are listening to air traffic communications.
In such circumstances, the controller resorts to routine, coded messages, asking the pilot to reconfirm the aircraft's squawk code as a verification measure. If the pilot re-enters or confirms code 7500, or is unable to respond while the signal continues, the highest-level security plans are activated, and responsibility for managing the crisis immediately shifts from civilian authorities to air defense and armed forces leadership.
The Military Response and the Possibility of Extreme Measures
Fighter jets are deployed under what is known as an immediate scramble as soon as the 7500 security code is confirmed, to intercept and surround the civilian aircraft in the air.
Military pilots maintain carefully calculated safety distances that allow them to observe the cockpit visually, assess the situation inside, and verify the identity of those flying the aircraft amid the imposed radio silence or a communications failure indicated by code 7600.
This military escort is an extremely sensitive precautionary and sovereign measure intended to prevent the aircraft from approaching vital facilities or densely populated major cities.
Countries also take into account extreme scenarios. When conclusive evidence indicates that an aircraft has been turned into a flying bomb directed at destroying a strategic facility, a military shoot-down remains a last and painful option available to senior leaders to protect national security.
The Isolated Parking Area and the Transfer of Authority on the Ground
An aircraft facing a security threat indicated by code 7500 does not take the usual routes toward the airport's main gates. Instead, air traffic control directs it through completely isolated routes toward a remote area within the airport known as the isolated parking area.
This area is located at the far edges of the airfield, away from passenger terminals, critical infrastructure, and major fuel storage facilities, in order to minimize losses in the event of an explosion or act of sabotage.
Once the aircraft's wheels touch down on this isolated section of the airfield and it comes to a complete stop, the legal and operational authority of air traffic controllers ends.
The control tower closes its operational file, and law enforcement forces, counterterrorism units, and security negotiation teams take over on the ground. They begin dealing directly with the hijackers under tactical plans designed to save lives and take control of the cabin.
The Sequence of Codes: Between the Reality of the Threat and Human Error
The sequence and overlap of emergency codes during a single flight raises a state of heightened alert and deep analysis among aviation experts and investigators.
Under aviation conventions, this sequence has two possible explanations. The first points to a genuine escalation of the incident, in which the situation begins with a mechanical or technical failure indicated by code 7700 or a communications failure indicated by code 7600. A party then exploits the resulting chaos or sudden descent to seize control of the cockpit, forcing the crew to escalate the alert to code 7500.
The second explanation involves a technical human error under extreme pressure. Because the numbers on the control panel are close to one another, a pilot under intense fear and nervous stress could enter the hijacking code instead of the general emergency or communications failure code.
Despite the possibility of error, air traffic control protocols and aviation authorities worldwide require the sequence to be treated as a genuine security threat, and the military and security alert is not lifted until the aircraft has landed, been fully searched, and the safety of its passengers and crew has been confirmed.
A Russian Drone Hits a Kyiv School as Moscow Presses Its Aerial Campaign against Ukrainehttps://english.aawsat.com/world/5324701-russian-drone-hits-kyiv-school-moscow-presses-its-aerial-campaign-against-ukraine
A police bomb squad member works at a site of a damaged school hit by a Russian jet-drone strike, amid Russia's attack on Ukraine, in Kyiv, Ukraine October 1, 2026. REUTERS/Gleb Garanich
A Russian Drone Hits a Kyiv School as Moscow Presses Its Aerial Campaign against Ukraine
A police bomb squad member works at a site of a damaged school hit by a Russian jet-drone strike, amid Russia's attack on Ukraine, in Kyiv, Ukraine October 1, 2026. REUTERS/Gleb Garanich
A Russian drone struck a school in Kyiv on Thursday, city officials said, as the Ukrainian capital endured another night and day of relentless aerial attacks.
Children and staff at the school were in shelters when the drone hit, Kyiv Mayor Vitalii Klitschko said, although the drone's warhead didn’t explode. There was no immediate report of casualties. The building’s brick frontage showed a large hole and black burn mark alongside smashed windows.
Kyiv has in recent weeks lived through repeated air raid alerts, punctuated by loud bangs and palls of black smoke as drones and missiles hit, making it feel like a city under siege. The Russian onslaught aims to terrorize civilians, officials and analysts say, and break their will to resist 4 ½ years after Moscow’s full-scale invasion.
The strain is showing among Kyiv residents. Maryna Lystopad, 35, said her hair has started falling out due to the strain of escalating attacks and never knowing where a drone or missile will hit.
"It’s really horrible. I can’t take it anymore. I think, I think that soon we’re all going to leave. I’m really not doing well,” she told The Associated Press.
“I’m constantly anxious. I can’t relax,” she said. “I keep thinking that if something happens, if something hits, one of my relatives could be killed.”
She recently had to go to another part of the city, she said, and was “genuinely stressed the whole way there.”
“I kept checking, like, whether anything was flying in, where it was going, where am I supposed to go? Where am I supposed to run?”
Russia's missiles and drones are stretching Ukraine's air defenses The war on the ground hasn’t seen major shifts since last year, but Ukraine is struggling to fend off Russia’s intensified aerial attacks on cities that include speedy ballistic missiles and high-flying jet-powered drones.
In response, Ukraine has fired its long-range drones at manufacturing plants deep inside Russia and has targeted Russia’s drone launch sites. Ukrainian President Volodymyr Zelenskyy said Thursday that Kyiv’s forces struck a site in Russia’s southwestern Oryol region that is used to store and launch attack drones.
To turn the tide, Ukraine needs US-made Patriot missiles that can effectively defend against ballistic missiles, but they are in short supply since the Iran war began. A plan to produce them inside Ukraine could take years to bear fruit.
Kyiv is currently racing to produce new interceptors that can bring down fast-moving jet-propelled drones as the swift cycle of military innovation during the war continues.
Ukraine also wants tougher sanctions imposed on Russia to prevent it from getting key high-tech components for its arsenal.
Moscow, meanwhile, is pressing its advantage before Ukraine comes up with an answer to the latest challenges.
Russia steps up its campaign against Ukraine's power grid Ukrainian officials didn’t report any energy infrastructure being hit Thursday, a day after what officials said was the biggest Russian attack on the power grid since last spring.
The Institute for the Study of War, a Washington-based think tank, said Wednesday's barrage marked “the beginning of Russia’s strike campaign aimed at degrading Ukraine’s energy security ahead of winter ... and forcing Ukraine to capitulate.”
Russia is expected to step up attacks on the electricity supply as the weather gets colder. It was 19 degrees Celsius (66 F) in Kyiv on Thursday, and mild temperatures were set to continue.
In a surprise development, Russia used a new jet-powered drone for the first time Wednesday, fitting it with a warhead designed to sever high-voltage pylons, said Serhii Beskrestnov, an adviser to Ukraine’s president on defense technology.
Musk Returns to US Govt for Pentagon War Studyhttps://english.aawsat.com/world/5324672-musk-returns-us-govt-pentagon-war-study
Tech billionaire Elon Musk will make a return to officially advising US President Donald Trump's government by co-leading what the Pentagon called a study on the future of war.
Musk served as the head of the Department of Government Efficiency (DOGE) before departing in May 2025, having publicly fallen out with Trump, said AFP.
In a speech at the Quantico military base, Pentagon chief Pete Hegseth said "Project Meridian" will be "an effort led by America's best minds to study the future of warfare".
"We are leveraging a unique source of American advantage, one our adversaries do not have: our innovators, our senior leaders and our technologists," Hegseth said.
Musk will be a co-leader of Project Meridian alongside Palmer Luckey, the 34-year-old co-founder of defense technology company Anduril Industries, and Newt Gingrich, the 83-year-old Republican former House speaker.
Musk threw his support behind Trump and helped his return to the White House, but the men later had a high-profile blow-up over the president's spending legislation.
He later resumed giving to Republican causes, including multimillion-dollar donations to individual candidates and conservative political groups.
Hegseth said the project's purpose is to "creatively look to the future and identify the domains that we must conquer and capabilities we must master".
Project members will include hand-picked private sector leaders and subject matter experts from across the innovation, academic and policy ecosystems.
Hegseth said he has directed Project Meridian's findings to be completed and submitted within 120 days.
لم تشترك بعد
انشئ حساباً خاصاً بك لتحصل على أخبار مخصصة لك ولتتمتع بخاصية حفظ المقالات وتتلقى نشراتنا البريدية المتنوعة
