Iran-Based Threat Actor Exploits VPN Vulnerabilities

ronjor · Sep 15, 2020

Original release date: September 15, 2020

Summary
This product was written by the Cybersecurity and Infrastructure Security Agency (CISA) with contributions from the Federal Bureau of Investigation (FBI). CISA and FBI are aware of an Iran-based malicious cyber actor targeting several U.S. federal agencies and other U.S.-based networks. Analysis of the threat actor’s indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) indicates a correlation with the group known by the names, Pioneer Kitten and UNC757. This threat actor has been observed exploiting several publicly known Common Vulnerabilities and Exposures (CVEs) dealing with Pulse Secure virtual private network (VPN), Citrix NetScaler, and F5 vulnerabilities. This threat actor used these vulnerabilities to gain initial access to targeted networks and then maintained access within the successfully exploited networks for several months using multiple means of persistence.
Click to expand...

Log in or Sign up

Iran-Based Threat Actor Exploits VPN Vulnerabilities

ronjor Global Moderator

Log in or Sign up

Iran-Based Threat Actor Exploits VPN Vulnerabilities

ronjor Global Moderator

Useful Searches