Indra — Hackers Behind Recent Attacks on Iran

guest · Aug 15, 2021

Hacker group behind cyberattack on Iran's train system: Israeli cybersecurity firm
August 15, 2021
https://english.alaraby.co.uk/news/hacker-group-behind-cyberattack-iran-train-system-report

An Iranian opposition group is behind a July cyberattack that caused unprecedented chaos at train stations in Iran, a new report by a leading cybersecurity company has claimed.

In a report published on Saturday, Israeli American cybersecurity company Check Point Software Technologies identified the Iranian opposition group "Indra" as the actor behind the July 9 attack.
The attack, initially attributed to Israel, had led Tehran to attack an Israeli-owned ship a few weeks later.
Click to expand...

Hackers caused major disruption to railway services when they posted fake messages about alleged train delays and cancellations on display boards at stations across Iran.

Check Point classified the attack as inflicting “nation-state level damage” despite it not originating from a nation-state level actor.

"We have seen many cyberattacks connected with what are believed to be professional intelligence or military units," Itay Cohen, a senior researcher at Check Point, told The New York Times. "But here, it seems to be something else entirely."
Click to expand...

Check Point: Indra Group Attack on Iran Highlights the Threats to Global Critical Infrastructure

Check Point Research (CPR) warns governments everywhere of the importance of protecting critical infrastructure, as it learns that the July 9 cyber attack on Iran’s train system was carried out by Indra, a group that identifies itself as regime opposition and has the capability to wipe out data without direct means for recovery.
Click to expand...

Check Point Research: Indra — Hackers Behind Recent Attacks on Iran

Key Findings

• On July 9th and 10th, 2021 Iranian Railways and the Ministry of Roads and Urban Development systems became the subject of targeted cyber attacks. Check Point Research investigated these attacks and found multiple evidence that these attacks heavily rely on the attacker’s previous knowledge and reconnaissance of the targeted networks.
• The attacks on Iran were found to be tactically and technically similar to previous activity against multiple private companies in Syria which was carried at least since 2019. We were able to tie this activity to a threat group that identify themselves as regime opposition group, named Indra.
• During these years, the attackers developed and deployed within victims’ networks at least 3 different versions of the wiper dubbed Meteor, Stardust, and Comet. Judging by the quality of the tools, their modus operandi, and their presence on social media, we find it unlikely that Indra is operated by a nation-state actor.
• A technical analysis of the tools, as well as the TTPs used by the underlying actor, are thoroughly described in this article. We share with the public Yara rules and a full list of indicators of compromise.
Click to expand...

Log in or Sign up

Indra — Hackers Behind Recent Attacks on Iran

guest Guest

Log in or Sign up

Indra — Hackers Behind Recent Attacks on Iran

guest Guest

Useful Searches