A massive cyberattack hit Albania

guest · Jul 18, 2022

All Albanian government systems shut down following the cyberattack
July 18, 2022

Albania was hit by a massive cyberattack over the weekend, the government confirmed on Monday. A synchronized criminal attack from abroad hit the servers of the National Agency for Information Society (AKSHI), which handles many government services.

“In order to withstand these unprecedented and dangerous strikes, we have been forced to close down government systems until the enemy attacks are neutralized,” the Albanian National Agency for the Information Society (AKSHI) said in a statement.
Government services were all down on Monday after the cyber attack.
Click to expand...

“Albania is under a massive cybernetic attack that has never happened before. This criminal cyber-attack was synchronized… from outside Albania,” the Council of Ministers said in a press release. “In order to not allow this attack to damage our information system, the National Agency of Information Society had temporarily shut down online services and other government websites.”

The Microsoft Jones Group International team is helping AKSHI to mitigate the effect of the attack and restore operations.
Click to expand...

guest · Aug 4, 2022

Disruptive Cyberattacks on NATO Member Albania Linked to Iran
August 4, 2022

The Albanian government announced in mid-July that it was forced to shut down some public online services due to a cyberattack. Mandiant has investigated the incident, which led to the discovery of a new piece of ransomware.

Mandiant researchers came across the ransomware after it had been uploaded from Albania to a public malware repository a few days after the cyberattack was launched. The ransomware has been named Roadsweep.
Click to expand...

While they could not confirm that the ransomware was indeed used in the attack, the malware encrypts files on compromised systems and then drops a ransom note suggesting that its target is the Albanian government.

The cybersecurity firm also spotted a website and Telegram channel named ‘HomeLand Justice’, which took credit for a ransomware operation aimed at the Albanian government.
‘HomeLand Justice’ and the Roadsweep ransomware note, which share the same banner, mentioned Manëz and Durrës.
Click to expand...

An analysis of the Roadsweep ransomware showed that it shares code with a backdoor named Chimneysweep, which has been around since at least 2012, and allows its operators to take screenshots, log keystrokes and steal files. The malware has been observed in attacks targeting Farsi and Arabic speakers, including the MEK organization.

Mandiant researchers also believe other NATO members could be targeted in similar operations.

“The use of ransomware to conduct a politically motivated disruptive operation against the government websites and citizen services of a NATO member state in the same week an Iranian opposition groups’ conference was set to take place would be a notably brazen operation by Iran-nexus threat actors,” they wrote in a blog post published on Thursday.
Click to expand...

Mandiant: Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations

Executive Summary

Mandiant identified the ROADSWEEP ransomware family and a Telegram persona which targeted the Albanian government in a politically motivated disruptive operation ahead of an Iranian opposition organization’s conference in late July 2022.

A previously unknown backdoor CHIMNEYSWEEP and a new variant of the ZEROCLEAR wiper may also have been involved.

CHIMNEYSWEEP malware distribution data and decoy content, the operation’s timing and politically themed content, and the possible involvement of the ZEROCLEAR wiper indicate an Iranian threat actor is likely responsible.

This activity poses an active threat to public and private organizations in other NATO member states.

Please see the Technical Annex for relevant Yara rules and MITRE ATT&CK Techniques
(T1007, T1012, T1027, T1033, T1055, T1057, T1070.004, T1070.006, T1082, T1083, T1087, T1112, T1113, T1134, T1489, T1497.001, T1518, T1543.003, T1569.002, and T1622).

Click to expand...

guest · Sep 7, 2022

White House Plans 'Further Action' After Iranian Cyberattack on Albania
By Dennis Fisher @DennisF - September 7, 2022

Two months after a major cyberattack that took down portions of Albania’s national infrastructure and resulted in sensitive data being leaked, the country’s prime minister has blamed Iran for the intrusion, and the White House is promising “further action to hold Iran accountable”.

In a video message posted Wednesday, Albanian Prime Minister said that the country had “indisputable evidence” that the July 15 attack was the work of Iranian actors and was orchestrated and sponsored by the Iranian government.
Click to expand...

Rama said that Albania has shared the technical evidence it has gathered with NATO countries and other allies. Technical experts from the United States government have been in Albania working with the Albanian government’s security team to recover from the attack, and on Wednesday National Security Council spokesperson Adrienne Watson said the U.S. plans more direct action.

“The United States will take further action to hold Iran accountable for actions that threaten the security of a U.S. ally and set a troubling precedent for cyberspace,” Watson said.
Click to expand...

The public response from the White House is unusual, but so was the effect of the intrusion, which took down quite a few government services and erased some data.
Click to expand...

guest · Sep 8, 2022

NATO Condemns Alleged Iranian Cyberattack on Albania
By AFP - September 8, 2022

NATO on Thursday condemned a cyberattack on Albania that Tirana and Washington blamed on Iran, and pledged to bolster the alliance member's defenses against hackers.

"We stand in solidarity with Albania following the recent cyber attack on its national information infrastructure," NATO allies said.
The alliance pledged to "support Albania in strengthening its cyber defence capabilities to withstand and repel such malicious cyber activities in the future."
Click to expand...

The US warned of "further action" against Iran as it condemned what it called the "unprecedented" cyberattack against ally Albania.

Iran rejected the accusation it was behind the cyberattack as "baseless" and called Albania's decision to sever diplomatic ties "an ill-considered and short-sighted action".
Click to expand...

hawki · Sep 9, 2022

mood said: ↑

White House Plans 'Further Action' After Iranian Cyberattack on Albania
By Dennis Fisher @DennisF - September 7, 2022
Click to expand...

U.S. Imposes Sanctions On Iranian Ministry Over Cyberattack On NATO Ally Albania

"The United States is designating Iran’s Ministry of Intelligence and Security (MOIS) and its Minister of Intelligence, Esmail Khatib, for engaging in cyber-enabled activities against the United States and its Allies.

In July 2022, cyber threat actors assessed to be sponsored by the Government of Iran and its MOIS disrupted Albanian government computer systems, forcing the government to suspend public services for its citizens. Since at least 2007, the MOIS and its cyber actor proxies have conducted malicious cyber operations targeting a range of government and private-sector organizations across various critical infrastructure sectors.

Iran’s cyberattacks targeting civilian government services and critical infrastructure sectors can cause grave damage to these services and disregard norms of responsible peacetime state behavior in cyberspace. The United States will continue to use all appropriate tools to counter cyberattacks against the United States and our Allies..."

https://www.state.gov/sanctioning-i...nce-and-security-for-malign-cyber-activities/

guest · Sep 9, 2022

Iranian Actors Targeted SharePoint Flaw in Attack on Albania
By Dennis Fisher @DennisF - September 9, 2022

The initial intrusion into the Albanian government’s networks that eventually led to ransomware deployment and the theft and destruction of data was accomplished by exploiting an old, known vulnerability in a SharePoint server, researchers at Microsoft who helped investigate the incident said in a new analysis of the attack.

While the disruptive portion of the attack didn’t happen until July 15, one of the four Iranian-affiliated attack groups involved in the operation gained access to the Albanian government’s systems as early as May 2021. That group, known as DEV-0861, is a subset of the APT34 team that is also known as OilRig or Europium, and it exploited CVE-2019-0604 to get an initial foothold on the network.
Microsoft initially disclosed that flaw in February 2019, and warned that it could lead to remote code execution.
Click to expand...

A separate group, DEV-0166, later followed in DEV-0861’s footsteps and exfiltrated data from the network, as well. Two other groups soon came onto the scene, too. All four of the attack groups are affiliated with Iran’s Ministry of Intelligence and Security, MIcrosoft said, and the tools used in the attack have been seen in previous operations by Iranian state-backed actors.

“[...] The wiper that DEV-0842 deployed in this attack used the same license key and EldoS RawDisk driver as ZeroCleare, a wiper that Iranian state actors used in an attack on a Middle East energy company in mid-2019,” Microsoft Security Threat Intelligence researchers said.
Click to expand...

Microsoft: Microsoft investigates Iranian attacks against the Albanian government

Microsoft Security Threat Intelligence - September 8, 2022
Shortly after the destructive cyberattacks against the Albanian government in mid-July, the Microsoft Detection and Response Team (DART) was engaged by the Albanian government to lead an investigation into the attacks.

Microsoft assessed with high confidence that on July 15, 2022, actors sponsored by the Iranian government conducted a destructive cyberattack against the Albanian government, disrupting government websites and public services. At the same time, and in addition to the destructive cyberattack, MSTIC assesses that a separate Iranian state-sponsored actor leaked sensitive information that had been exfiltrated months earlier. Various websites and social media outlets were used to leak this information.
Click to expand...

Microsoft assessed with high confidence that multiple Iranian actors participated in this attack—with different actors responsible for distinct phases:

DEV-0842 deployed the ransomware and wiper malware

DEV-0861 gained initial access and exfiltrated data

DEV-0166 exfiltrated data

DEV-0133 probed victim infrastructure

Click to expand...

guest · Sep 10, 2022

Albania Suffers Renewed Cyberattack, Blames Iran
By AFP - September 10, 2022

Albania has suffered a renewed cyberattack, the country's interior ministry said on Saturday, blaming Iran which Tirana also accused of an earlier assault on its digital systems.

"The national police's computer systems were hit Friday by a cyberattack which, according to initial information, was committed by the same actors who in July attacked the country's public and government service systems," the ministry said in a statement.
"In order to neutralize the criminal act and secure the systems," the authorities have shut down computer control systems at seaports, airports and border posts, the statement said.
Click to expand...

In a tweet, Prime Minister Edi Rama denounced "another cyberattack (committed by) the same aggressors already condemned by Albania's friendly countries and allies."
Click to expand...

Log in or Sign up

A massive cyberattack hit Albania

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

Log in or Sign up

A massive cyberattack hit Albania

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

Useful Searches