Experts: Iranian link to attempted hack of Syrian dissident

Abdul Razzak, a fellow at internet watchdog group Citizen Lab, quickly determined that the group was bogus.

The email, sent on Oct. 3 last year, was an electronic trap — one of hundreds of malicious messages that have flown back and forth as rebels grapple with the government of Bashar Assad in Syria.

Al-Ameer is a well-known opposition figure, and stealing her data or her identity could have been the jumping off point to attack other Syrians in and out of the country.

The group has made a specialty of tracking the hackers who've dogged Syria's opposition, which lead author John Scott-Railton said had turned into "something of a petri dish for threat actors in the Middle East."

The site itself briefly hosted a Farsi-language mail service, and a string of data recovered from the malicious code used to target Al-Ameer appeared to refer to a developer who runs a malicious software site registered in the Iranian city of Shiraz.

The botched cyberespionage attempt "is consistent with Iranian activity we've previous observed, in terms of operational security, social engineering, and technical sophistication," said John Hulquist, a threat intelligence manager at FireEye.

"Not all hacking in a conflict looks like Stuxnet," said Scott-Railton, referring to the complex computer bug widely suspected of being unleashed by the United States to sabotage Iran's nuclear program.