FBI, CISA, Cyber Command take aim at cyber

The group allegedly has targeted the defense, local government, oil and natural gas and telecommunications sectors in places including North America.

U.S. and U.K. government agencies called out Iranian government-affiliated hackers Thursday, accusing them of being behind cyber-espionage targeting the defense, local government, oil and natural gas and telecommunications sectors across the globe.

The joint alert points a finger at MuddyWater, which the U.S. government for the first time last month attributed directly to Tehran. In the latest warning, the government agencies said that they have observed MuddyWater on the move in Africa, Asia, Europe and North America since 2018.

“MuddyWater actors are positioned both to provide stolen data and accesses to the Iranian government and to share these with other malicious cyber actors,” reads the alert.

The bulletin is the joint work of the the FBI, Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, the U.S. Cyber Command Cyber National Mission Force and the U.K.’s National Cyber Security Centre.

MuddyWater has a long history of allegedly spying on primarily Middle East targets, but the two U.S. alerts — one of which, Thursday’s, arrived as Russia’s invasion of Ukraine is preoccupying government officials — indicate an increased focus from the government, given the group’s potential wider reach.

“Iranian government-sponsored actors are consistently targeting government and commercial networks through multiple means, including exploiting known vulnerabilities and spearphishing,” a CISA spokesperson said. “We are committed to identifying nation-state threats to our critical infrastructure and helping organizations reduce their cyber risk.”

Thursday’s warning came the same day that cybersecurity firm Mandiant released research about how a group it said was likely associated with MuddyWater had used Telegram malware to target Middle Eastern technology and government organizations.

While MuddyWater has been active since at least 2017, “We have observed a particularly high tempo over the last year or so,” Emiel Haeghebaert, analyst at Mandiant, told CyberScoop via email.

“In addition to the higher cadence of their operations, a notable development is that the group has increasingly incorporated legitimate tools and resources into their toolkit,”  he said. “The use of legitimate remote access software and the network communication capabilities of common workplace applications like Slack and even Telegram indicates these threat actors are trying to evade detection.”

What will be interesting to watch, Haeghebaert said, is how MuddyWater — which Mandiant also calls TEMP.Zagros — reacts to the government callout.

“A particularly interesting characteristic of this group is their awareness of and responsiveness to public disclosures,” he said. “For example, when security researchers pointed out that their malware included a typo in the word ‘sory’ [sic] on Twitter, a new iteration of the malware seen just days later had this typo corrected to ‘SoRRy’ [sic]. This awareness then begs the question of how TEMP.Zagros will respond to this public disclosure, including whether they will re-build their arsenal from scratch or continue unabated.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure