A group of Iranian hackers has spent years pretending to be a female aerobics instructor living in Liverpool, exchanging flirtatious messages with defence and aerospace workers to try to obtain sensitive information.
The hackers’ false identity has been discovered by Facebook and the cybersecurity company Proofpoint which claims that the operation shows the amount of effort and persistence Iran is putting into targeting individuals of interest.
The hackers have been identified as TA456, who also go by the name of Tortoiseshell. They are believed to be aligned with the Islamic Revolutionary Guard Corps.
Proofpoint describes the group as “one of the most determined Iranian-aligned threat actors” that it tracks due to tactics of spending months or years building up a relationship with targets across various
