Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/7/2020
05:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

DHS Warns of Potential Iranian Cyberattacks

Recent US military action in Baghdad could prompt retaliatory attacks against US organizations, it says.

Concerns about an Iranian cyber response to the recent American military strike in Baghdad grew this week with the US Department of Homeland Security urging organizations to be on heightened alert for denial-of-service and other more destructive attacks.

In an alert Monday, the DHS's Cybersecurity and Infrastructure Security Agency (CISA) warned US organizations about Iran's historic use of cyberattacks to retaliate against perceived foes. "Iran has a history of leveraging asymmetric tactics to pursue national interests beyond its conventional capabilities," the CISA alert noted.

In recent years, cyber groups operating on behalf of the Iranian government have improved their offensive capabilities in carrying out denial of service, website defacement attacks, and data theft. "They have also demonstrated a willingness to push the boundaries of their activities, which include destructive wiper malware and, potentially, cyber-enabled kinetic attacks," CISA said.

The CISA alert is the first public acknowledgement from the US government about potential Iranian cyberattacks in response to the US drone strike last week that killed Gen. Qassem Soleimani. Several security vendors, including Crowdstrike and Recorded Future, have noted the possibility of such attacks in recent days, citing past precedent.

According to Crowdstrike, while there is no evidence of a specific threat emanating from Iranian nation-state actors at this time, US organizations should assume a defensive posture all the same. Current intelligence suggests that organizations in the government, defense, financial, and oil and gas sectors will be the most likely targets for attacks, the security vendor said.

Recorded Future said it believes that Iranian cyber groups will try to use networks they already have compromised in previous espionage activities to carry out new attacks. Other likely tactics include the use of web shells, password spraying, and commodity and custom malware to break into target networks. In addition to US-based targets, Iranian cyber operatives likely will target organizations in the Persian Gulf as well as US allies and partners in the region, Recorded Future said.

Multiple Iran-based cyber groups with suspected ties to the government and the country's Islamic Revolutionary Guard Corps are believed to have the capability to disrupt and damage operations at US organizations. Top among them are APT33, one of the most active threat groups operating out of the Middle East; APT34 (aka OilRig/MUDDYWATER); and APT39, a relatively newly surfaced group that targets companies in the technology, travel services, and telecommunications sectors.

"APTs 33 and 34 are primarily focused on financial, energy, telecom, and SCADA/ICS," says Rosa Smothers, a former CIA technical intelligence officer and senior VP of cyber operations at KnowBe4. Private sector companies responsible for critical infrastructure are often unaware these threat actors already might have a presence on their network. That poses a threat because the Iranian government and its hacker proxies are likely to first consider targets where they currently maintain persistence.

"If organizations are fully defending against APTs — utilizing defense-in-depth methods, educating users about how to spot phishing and rejecting known breached and common passwords — then your technical bases should be covered," Smothers says.

Recommended Actions
Organizations in targeted sectors should be keeping an eye out for activities, indicators of compromise, and the tactics, techniques, and procedures associated with these APT groups says Anuj Goel, CEO of Cyware Labs. Examples of tools used by these groups include njRAT, RevengeRAT and NonoCoreRAT, he says. "Most recently, APT33, Iran's most potent cybercriminal group, was found probing physical control systems used in electric utilities, manufacturing, and oil refineries using password-spraying attacks," Goel says.

This week's CISA alert listed multiple Iranian APT group techniques that US organizations should be monitoring for, including credential dumping, file obfuscation, PowerShell misuse, and the abuse of other legitimate system features such as Registry run keys and the startup folder.

The alert also recommended several actions that organizations can take to mitigate their exposure to potential attacks. Among them was the need to disable unnecessary ports and protocols, enhance monitoring of email and network traffic, patch externally facing systems, and limiting and logging PowerShell use.

"Scrub accounts that are no longer active, and investigate accounts that log in at odd hours," Smothers adds. "Iranian activities were previously [discovered] due to activity occurring only during Iranian government business hours."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "What Tools Will Find Misconfigurations in My AWS S3 Cloud Buckets?"

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
tdsan
0%
100%
tdsan,
User Rank: Ninja
1/9/2020 | 1:42:04 PM
Interesting, but this is nothing new
We (US) have been attacking Iran (Stuxnet) and Utility Grid (Nitro-Zeus) for years. We have embedded ASIC chips and software inside their network.



They have reverse engineered this technology and now they are using it against us (have people forgotten where Ramsomeware came from, we initially designed it and now the attackers are using it against us).



That's what happens when nation-states are not upfront with each other and their underhanded tactics cause a ripple effect in the country's economy, the old adage is why not work together to resolve the issues of the people instead of initiating these right-wing, secret wars that we constantly embark on.



At some point, we have to say enough is enough and work together as a country to put an end to all of the underhanded attacks that we have caused, instead of acting like a bully.

T

 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/27/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13643
PUBLISHED: 2020-05-28
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be e...
CVE-2020-13644
PUBLISHED: 2020-05-28
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accord...
CVE-2020-13641
PUBLISHED: 2020-05-28
An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allow...
CVE-2020-13642
PUBLISHED: 2020-05-28
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable allows for malicious JavaScript to be e...
CVE-2020-8603
PUBLISHED: 2020-05-27
A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or ...