Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Flaws

guest · Nov 17, 2021

Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities
November 17, 2021
https://us-cert.cisa.gov/ncas/curre...onsored-apt-cyber-actors-exploiting-microsoft

CISA, the Federal Bureau of Investigation (FBI), the Australian Cyber Security Centre (ACSC), and the United Kingdom’s National Cyber Security Centre (NCSC) have released a joint Cybersecurity Advisory highlighting ongoing malicious cyber activity by an advanced persistent threat (APT) group that FBI, CISA, ACSC, and NCSC assess is associated with the government of Iran. FBI and CISA have observed this Iranian government-sponsored APT exploit Fortinet and Microsoft Exchange ProxyShell vulnerabilities to gain initial access to systems in advance of follow-on operations, which include deploying ransomware.
Click to expand...

Joint Cybersecurity Advisory AA21-321A provides observed tactics and techniques, as well as indicators of compromise that FBI, CISA, ACSC, and NCSC assess are likely associated with this Iranian government-sponsored APT activity. FBI, CISA, ACSC, and NCSC urge critical infrastructure organizations to apply the recommendations listed in the advisory to mitigate risk of compromise from Iranian government-sponsored cyber actors.
Click to expand...

CISA also recommends reviewing its Iran Cyber Threat Overview and other Iran-related Advisories.
Click to expand...

guest · Nov 18, 2021

Alert over spate of Iran-linked BitLocker attacks
November 18, 2021
https://www.computerweekly.com/news/252509689/Alert-over-spate-of-Iran-linked-BitLocker-attacks

Australian, American and British cyber agencies have warned of a campaign of “ongoing malicious cyber activity” by an Iranian advanced persistent threat (APT) group exploiting well-known vulnerabilities in Fortinet and Microsoft products to conduct ransomware attacks.

The government-sponsored group seems to attack somewhat indiscriminately and appears to be highly focused on exploiting a core set of known bugs, rather than targeting specific sectors, although it has been seen targeting victims in critical such as transport and healthcare.
Click to expand...

After gaining access to its victims’ networks, its follow-on activities lead up include data exfiltration, encryption, and extortion using BitLocker, a legitimate full volume encryption feature that can be turned to malicious purposes such as ransomware.

Defenders should be alert to the use of various malicious and legitimate tools by the group, including the likes of Mimikatz for credential theft, WinPEAS for privilege escalation, WinRAR for archiving data, and FileZilla for file transfer.
The full advisory, including specific indicators of compromise (IoCs) and mitigation advice, can be read here.
Click to expand...

Log in or Sign up

Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Flaws

guest Guest

guest Guest

Log in or Sign up

Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Flaws

guest Guest

guest Guest

Useful Searches