Microsoft warns of the evolution of Iranian hacking groups

guest · Nov 16, 2021

Microsoft warns of the evolution of six Iranian hacking groups
November 16, 2021
https://www.bleepingcomputer.com/ne...-the-evolution-of-six-iranian-hacking-groups/

The Microsoft Threat Intelligence Center (MSTIC) has presented an analysis of the evolution of several Iranian threat actors at the CyberWarCon 2021, and their findings show increasingly sophisticated attacks.

Since September 2020, Microsoft has been tracking six Iranian hacking groups deploying ransomware and exfiltrating data to cause disruption and destruction for victims.
Click to expand...

Over time, these hacking groups have evolved into competent threat actors capable of conducting cyber-espionage, using multi-platform malware, disrupting operations with wipers and ransomware, carrying out phishing and password spraying attacks, and even setting up sophisticated supply chain operations.
Click to expand...

This year, Microsoft observed the actors scanning for many vulnerabilities, including those targeting Fortinet FortiOS SSL VPN, Microsoft Exchange Servers vulnerable to ProxyShell, and more.

Another trend that has emerged this past year is an upgraded level of patience and persistence in social engineering campaigns, indicative of a sophisticated actor.
Click to expand...

Microsoft: Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021

In the early part of 2021, PHOSPHORUS actors scanned millions of IPs on the internet for Fortinet FortiOS SSL VPN that were vulnerable to CVE-2018-13379.
CURIUM – In it for the long run
CURIUM is another Iranian threat actor group that has shown a great deal of patience when targeting users.
Brute force
In 2021, MSTIC observed DEV-0343 aggressively targeting Office 365 tenants via an ongoing campaign of password spray attacks.
Click to expand...

guest · Sep 8, 2022

Microsoft Warns of Ransomware Attacks by Iranian Phosphorus Hacker Group
By Ravie Lakshmanan - September 8, 2022

Microsoft's threat intelligence division on Wednesday assessed that a subgroup of the Iranian threat actor tracked as Phosphorus is conducting ransomware attacks as a "form of moonlighting" for personal gain.

The tech giant, which is monitoring the activity cluster under the moniker DEV-0270 (aka Nemesis Kitten), said it's operated by a company that functions under the public aliases Secnerd and Lifeweb, citing infrastructure overlaps between the group and the two organizations.

"DEV-0270 leverages exploits for high-severity vulnerabilities to gain access to devices and is known for the early adoption of newly disclosed vulnerabilities," Microsoft said.
"DEV-0270 also extensively uses living-off-the-land binaries (LOLBINs) throughout the attack chain for discovery and credential access. This extends to its abuse of the built-in BitLocker tool to encrypt files on compromised devices."
Click to expand...

DEV-0270 is known to scan the internet to find servers and devices susceptible to flaws in Microsoft Exchange Server, Fortinet FortiGate SSL-VPN, and Apache Log4j for obtaining initial access, followed by network reconnaissance and credential theft activities.
Click to expand...

Microsoft: Profiling DEV-0270: PHOSPHORUS’ ransomware operations

Microsoft Security Threat Intelligence - September 7, 2022
Microsoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS. Microsoft assesses with moderate confidence that DEV-0270 conducts malicious network operations, including widespread vulnerability scanning, on behalf of the government of Iran.

This blog profiles the tactics and techniques behind the DEV-0270/PHOSPHORUS ransomware campaigns. We hope this analysis, which Microsoft is using to protect customers from related attacks, further exposes and disrupts the expansion of DEV-0270’s operations.
Click to expand...

guest · Sep 9, 2022

mood said: ↑

Microsoft Warns of Ransomware Attacks by Iranian Phosphorus Hacker Group
By Ravie Lakshmanan - September 8, 2022

Microsoft: Profiling DEV-0270: PHOSPHORUS’ ransomware operations
Click to expand...

Iran-linked DEV-0270 group abuses BitLocker to encrypt victims’ devices
By Pierluigi Paganini - September 9, 2022

Microsoft Security Threat Intelligence researchers reported that Iran-linked APT group DEV-0270 (Nemesis Kitten) has been abusing the BitLocker Windows feature to encrypt victims’ devices.

The researchers tracked multiple ransomware attacks conducted by the DEV-0270 group, which is a unit of the Iranian actor PHOSPHORUS.
Click to expand...

To maintain persistence in a compromised network, the DEV-0270 APT group adds or creates a new user account (i.e. DefaultAccount with a password of P@ssw0rd1234). The the attackers modify the registry to allow remote desktop (RDP) connections for the device, adds a rule in the firewall to allow RDP connections, and add the user to the remote desktop users group. The threat actors use scheduled tasks to maintain access to a device.

“DEV-0270 has been seen using setup.bat commands to enable BitLocker encryption, which leads to the hosts becoming inoperable. For workstations, the group uses DiskCryptor, an open-source full disk encryption system for Windows that allows for the encryption of a device’s entire hard drive.” continues the report. “The group drops DiskCryptor from an RDP session and when it is launched, begins the encryption. This method does require a reboot to install and another reboot to lock out access to the workstation.”
Click to expand...

The group is typically opportunistic in its targeting, it scans the internet to find vulnerable servers and devices.
Click to expand...

Log in or Sign up

Microsoft warns of the evolution of Iranian hacking groups

guest Guest

guest Guest

guest Guest

Log in or Sign up

Microsoft warns of the evolution of Iranian hacking groups

guest Guest

guest Guest

guest Guest

Useful Searches