Iranian cyberespionage group masqueraded as aerobics instructor on Facebook in an attempt to infect the machine of an aerospace defense contractor with malware as part of a years-long social engineering and targeted malware campaign. Security firm Proofpoint attributed the covert operation to a state-aligned threat actor it tracks as TA456, and by the wider cybersecurity community under the monikers Tortoiseshell and Imperial Kitten. Facebook has since suspended the Flores account from its platform in a coordinated takedown of users linked to Iranian hacker activity.
Source: https://thehackernews.com/2021/07/hackers-posed-as-aerobics-instructors.html