Iranian Cyber Threats Escalate: Ransomware and Espionage Campaigns Target U.S. and UAE
A recent federal advisory and new research reveal a significant escalation in cyber activities by Iranian threat actors, who have intensified ransomware attacks and cyberespionage efforts against both public and private sectors in the United States and the United Arab Emirates.
According to a joint advisory released by the FBI, Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Defense Cyber Crime Center, the Iranian cyber group known by multiple names—including Pioneer Kitten, UNC757, and Rubidium—has been active since 2017. This group has compromised a range of targets, including U.S. schools, financial institutions, healthcare facilities, and municipal governments. Their operations continue, with recent activity observed as recently as August 2024. The advisory highlights that these actors focus on maintaining technical access to victim networks, which facilitates future ransomware attacks.
The FBI previously tracked Iranian threat actors conducting hack-and-leak attacks, notably the Pay2Key ransomware campaign that exploited vulnerabilities in Remote Desktop Protocol (RDP) connections. These attackers have also targeted sensitive networks, particularly those in the U.S. defense sector, Israel, Azerbaijan, and the U.A.E., seeking to steal critical information.
The advisory further explains that Pioneer Kitten typically infiltrates networks by exploiting vulnerabilities in remote external services. As of July 2024, the group has been observed scanning for vulnerabilities in devices running Check Point Security Gateways and Palo Alto Networks PAN-OS and GlobalProtect VPN.
Adding to the recent wave of cybersecurity revelations, Microsoft’s latest report details the activities of another Iranian state-sponsored group, Peach Sandstorm. This group has deployed a custom multistage backdoor named Tickler and is associated with the Iranian Islamic Revolutionary Guard Corps (IRGC). Peach Sandstorm has targeted sectors including higher education, satellite communications, and defense, using social engineering tactics on LinkedIn.
Mandiant, a Google-owned threat intelligence firm, has also released findings on a suspected Iranian counterintelligence operation. This campaign aimed to identify Iranians potentially interested in collaborating with foreign intelligence agencies, particularly those from Israel. Mandiant linked the operation to the Iranian regime and noted similarities with the threat actor APT42, which is suspected to work for the IRGC Intelligence Organization. The operation, which began around 2017 and continued until March 2024, involved creating fake recruitment websites on social media platforms, such as X (formerly Twitter) and Virasty, to deceive potential targets.
These latest developments underscore the increasing sophistication and persistence of Iranian cyber threat actors, who continue to engage in advanced cyber operations targeting critical sectors and sensitive information worldwide.
Source: https://www.bankinfosecurity.com
No comments:
Post a Comment