Iranian government-backed hackers target critical infrastructure with ransomware, US says

The targets include local governments and the health care sector.

U.S., U.K. and Australian cyber agencies on Wednesday accused Iranian government-sponsored hacking groups of exploiting Microsoft and Fortinet vulnerabilities this year in a bid to deploy ransomware against critical infrastructure.

The hackers are interested in taking advantage of known software flaws where they can, the agencies said. The FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency in March, May and June saw Iranian “advanced persistent threat” groups capitalizing on Fortinet vulnerabilities, in one case for a server associated with a U.S. municipal government and in another involving networks associated with a U.S.-based hospital focused on children’s care.

In October the hackers relied on a Microsoft Exchange ProxyShell vulnerability “to gain initial access to systems in advance of follow-on operations,” the subject of another recent CISA alert.

“The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations,” the Wednesday alert states. “These Iranian government-sponsored APT actors can leverage this access for follow-on operations, such as data exfiltration or encryption, ransomware, and extortion.”

While the U.S. government has accused individual Iranian hackers of distributing ransomware in the past — such as with charges filed in the attack on the city of Atlanta — and while the U.S. has criticized the Iranian government for its activities in cyberspace, Wednesday’s alert combines both trends.

The joint alert follows research unveiled on Tuesday at the CyberWarCon conference, where Microsoft and CrowdStrike both revealed details about how suspected Iranian government-linked hackers had used ransomware as a disruptive tool.

The Microsoft research mentions how such hackers were trying to exploit Fortinet and ProxyShell vulnerabilities along the some of the same timelines mentioned in the Wednesday alert — “in the early part of 2021” on Fortinet and “last half of 2021” on ProxyShell.

“They are increasingly utilizing ransomware to either collect funds or disrupt their targets,” the research states. Since September of last year, Microsoft has “observed six Iranian threat groups deploying ransomware to achieve their strategic objectives.”

Those groups include one that Microsoft calls Phosphorus, which others call Charming Kitten or APT35.

CrowdStrike’s research, too said that “evidence points to the  Iranian cyber operations enterprise as having recognized ransomware’s potential as a cyberattack capability able to inflict disruptive impacts on victims with low cost and relatively  plausible deniability.”

This week the U.S. and Israel — a nation with whom Iran has been engaged in a long proxy conflict — announced a ransomware partnership.

Iranian hackers are going after critical infrastructure sector passwords, agencies caution

An international advisory says that the purpose of the “brute force” attacks is to sell the info to cybercrime forums.

Iranian-linked hackers collaborate with ransomware affiliates, feds say

Iranian hackers ‘tickle’ targets in US, UAE with custom tool, Microsoft says

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure