DHS tells U.S. organizations to clamp down on cybersecurity in wake of Soleimani killing

The CISA advisory acknowledges the considerable capabilities at Iran’s disposal should the Islamic Republic choose to retaliate in cyberspace.

The Department of Homeland Security on Monday issued guidance to U.S. companies and government agencies on securing their computer networks following the killing last week of a top Iranian general.

The advisory from DHS’s Cybersecurity and Infrastructure Security Agency acknowledges the considerable capabilities at Iran’s disposal should the Islamic Republic choose to retaliate in cyberspace, and urges organizations to consider whether they make an attractive target for Tehran’s hackers.

Iran and its proxies have a history of “disruptive and destructive cyber operations against strategic targets, including finance, energy, and telecommunications organizations, and an increased interest in industrial control systems and operational technology,” the advisory says. Iranian operatives could also steal intellectual property or conduct cyber-espionage “to enable a better understanding of our strategic direction and policy-making,” according to CISA.

“Review your organization from an outside perspective and ask the tough questions—are you attractive to Iran and its proxies because of your business model, who your customers and competitors are, or what you stand for?” the advisory states.

CISA also on Monday released a more technical advisory to security professionals that included a list of techniques associated with Iranian hacking groups and how to combat them.

The U.S. killing of Maj. Gen. Qassem Soleimani, who was the architect of Iran’s foreign military operations, was a major escalation of tensions in an already fraught U.S.-Iran relationship. The primary U.S. concern will be with Iranian retaliation through physical violence carried out on U.S. personnel or allies. But hacking could very well factor into Tehran’s response.

Experts told CyberScoop that U.S. companies and government agencies should be mindful of Iranian operatives’ penchant for data-wiping malware and their recent interest in industrial control systems.

In an assessment of terrorism-related threats from Iran, Acting Homeland Security Secretary Chad Wolf mentioned the role that hacking could play in Iran’s retaliation for Soleimani’s killing.

“Iran is capable, at a minimum, of carrying out attacks with temporary disruptive effects against critical infrastructure in the United States,” Wolf said in an advisory on Saturday.

And, of course, Iran could use cyber-espionage to collect intelligence for a physical attack.

“Iran, like others, has recently focused on moving upstream by compromising telecoms and travel. That way they can identify and track specific people,” tweeted John Hultquist, director of intelligence analysis at security firm FireEye.

To conduct that espionage, Iranian hackers could turn to Domain Name System records. Dubbed the “phone book of the internet,” the DNS system translate a domain name to a valid IP address, sending a user to the website they are trying to access. Hackers have previously used compromised DNS servers to try to steal login credentials and conduct espionage at government agencies in the Middle East, according to private-sector researchers.

A year ago, DHS’s CISA grew so concerned by the threat of DNS hijacking that the agency issued its first emergency order to federal civilian agencies that instructed them to secure their DNS records. The order gave agencies 10 business days to implement important security practices such as adding multi-factor authentication to their DNS accounts.

While U.S. government agencies have made progress on DNS-related security in the year since the DHS directive, Iranian computer operatives could look for another weakness to exploit in future hacking operations.

In the advisory issued Monday, CISA urged companies and government agencies to closely monitor network traffic, including data flowing into industrial control systems.

“Flag any known Iranian indicators of compromise and tactics, techniques, and procedures for immediate response,” the memo says.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure