Hackers have been methodically gaining access to domain name services that allow malware-laden emails to look like they come from legitimate organizations.
Article Link: https://www.nextgov.com/cybersecurity/2019/01/report-iran-likely-setting-stage-international-phishing-campaign/154104/