United States and Partners Alert Regarding Iranian Cyberattacks on Crucial Infrastructure in Year-Long Operation
Cybersecurity and intelligence agencies from Australia, Canada, and the United States have issued a caution about a prolonged initiative by Iranian cyber operatives to breach essential infrastructure entities through relentless attacks.
“Starting from October 2023, Iranian operatives have utilized aggressive tactics and password spraying to infiltrate user accounts and gain entry into organizations within the healthcare and public health (HPH), government, IT, engineering, and energy fields,” explained the organizations in a collaborative warning statement.
The assaults have focused on healthcare, government, IT, engineering, and energy spheres, according to reports by the Australian Federal Police (AFP), the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), the Communications Security Establishment Canada (CSE), the U.S. Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the National Security Agency (NSA).
Another significant strategy, apart from aggressive attacks and password spraying, revolves around utilizing multi-factor authentication (MFA) for prompt inundation to break into targeted networks.
“Prompt inundation is a maneuver employed by adversary groups that deluge users with MFA push alerts, aiming to coerce the user into allowing the request either inadvertently or due to annoyance,” remarked Ray Carney, Tenable’s research director.
“This approach is also known as MFA exhaustion. Phishing-proof MFA stands as the topmost solution to thwart prompt inundation, but in the absence of such an option, number matching – mandating users to input a time-sensitive code from an enterprise-authorized identity system – serves as an adequate backup. Many identity systems incorporate number matching as a subsidiary attribute.”
The primary objective of these attacks likely centers around acquiring credentials and data pertaining to the network of the victim which can be later traded to facilitate entry for other cyber offenders, reaffirming a notification previously disseminated by the U.S. in August 2024.
The initial infiltration is proceeded by actions to conduct thorough reconnaissance of the entity’s systems and network by utilizing living-off-the-land (LotL) tools, elevating privileges through CVE-2020-1472 (known as Zerologon), and lateral movement via RDP. The threat actor has also been detected registering their personal devices with MFA to uphold continuity.
In certain scenarios, the attacks are distinguished by employing msedge.exe to establish external links to Cobalt Strike command-and-control (C2) infrastructure.
“The threat actors conducted reconnaissance on the penetrated networks to acquire supplementary credentials and pinpoint additional data that could be exploited to access additional entry points,” stated the agencies, adding that they “vend this data on cybercrime forums to entities planning to undertake further illicit activities.”
The alert emerges shortly after government entities from the Five Eyes nations issued guiding principles on the usual methods employed by threat actors to compromise Active Directory.
“Active Directory stands out as the most broadly utilized solution for authentication and authorization across enterprise IT networks on a global scale,” remarked the agencies stating. “Malignant actors habitually target Active Directory as part of schemes to breach enterprise IT networks by escalating privileges and targeting the most confidential user elements.”
This development comes amidst a change in the threat landscape where nation-state hacker groups are increasingly cooperating with cyber criminals, subcontracting certain facets of their activities to advance their geopolitical and financial motives, as per Microsoft declarations.
“Nation-state threat actors are running operations for financial benefits and enlisting assistance from cyber criminals and off-the-shelf malware to gather intelligence,” the tech behemoth highlighted in its Digital Defense Report for 2024.
“Nation-state threat actors engage in operations for financial gains, co-opting cyber criminals to gather intelligence about the Ukrainian military, and harnessing the same intelligence-stealing tools, command-and-control frameworks, and other utilities favored by the cyber criminal community.”
About Author
