The United States Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Department of Defense Cyber Crime Center (DC3) have issued a joint Cybersecurity Advisory warning of persistent cyber threats from Iran-based actors. The advisory highlights the ongoing exploitation of U.S. and foreign organizations across multiple sectors by a group associated with the government of Iran (GOI).
The advisory reveals that these actors are engaged in state-sponsored espionage and financially motivated ransomware attacks. According to the FBI's assessment, "a significant percentage of these threat actors' operations against US organizations are intended to obtain and develop network access to then collaborate with ransomware affiliate actors to deploy ransomware."
The actors have been observed collaborating with notorious ransomware groups such as NoEscape, Ransomhouse, and ALPHV (also known as BlackCat). However, the advisory notes that "the group's ransomware activities are likely not sanctioned by the GOI, as the actors have expressed concern for government monitoring of cryptocurrency movement associated with their malicious activity."
The Iranian cybercriminals primarily gain initial access by exploiting vulnerabilities in public-facing networking devices. The advisory states:
"As of July 2024, these actors have been observed scanning IP addresses hosting Check Point Security Gateways, probing for devices potentially vulnerable to CVE-2024-24919. As of April 2024, these actors have conducted mass scanning of IP addresses hosting Palo Alto Networks PAN-OS and GlobalProtect VPN devices."
Once inside a network, the attackers employ various tactics to maintain access, escalate privileges, and exfiltrate data. These include deploying web shells, creating local accounts, disabling security software, and using remote access tools like AnyDesk.
The advisory provides a comprehensive list of mitigations for organizations to protect themselves against these threats. Key recommendations include:
- Applying patches for known vulnerabilities in networking devices
- Reviewing logs for indicators of compromise provided in the advisory
- Checking systems for specific tactics, techniques, and procedures (TTPs) used by the actors
- Validating security controls against the MITRE ATT&CK techniques described in the advisory
The FBI and CISA emphasize the importance of prompt reporting, stating: "Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to the FBI's Internet Crime Complain Center (IC3), your local FBI Field Office, or CISA."
This joint advisory serves as a timely alert to U.S. organizations regarding Iranian cyber threats. It coincides with recent concerns over the hacking of the Trump campaign, which hinted at potential Iranian involvement. However, the advisory itself does not directly address this specific incident.
As cyber threats evolve, this advisory serves as a crucial reminder of the ongoing need for vigilance and robust cybersecurity practices across all sectors.
Follow SecureWorld News for more stories related to cybersecurity.
