Iran-based cyber actors are actively targeting U.S. and foreign organizations across various sectors by exploiting vulnerabilities to gain unauthorized access to networks and collaborating with ransomware groups to deploy ransomware.
These actors are believed to be associated with the Iranian government and are also conducting espionage activities against specific countries like Israel and Azerbaijan. The FBI warns that a significant portion of their operations against U.S. organizations is aimed at establishing a foothold for future ransomware attacks.
The Iranian cyber group Pioneer Kitten, known for its high-volume intrusion attempts against U.S. organizations since 2017, has been actively involved in ransomware attacks and hack-and-leak campaigns.
The group, operating under various aliases, has collaborated with ransomware affiliates like NoEscape, Ransomhouse, and ALPHV, offering access to compromised networks in exchange for a share of ransom payments.
Their recent involvement in the Pay2Key campaign, which aimed to undermine Israeli cyber infrastructure, highlights their potential for malicious activities beyond financial gain.
The Iranian cyber actors identified by the FBI are conducting malicious cyber activity in support of the Iranian government by targeting countries and organizations aligned with Iranian interests, stealing sensitive information.
They use Danesh Novin Sahand as a cover IT entity and their ransomware activities are likely not sanctioned by the Iranian government due to concerns about government monitoring of cryptocurrency transactions.
Initially, they exploit remote external services on internet-facing assets to gain initial access to victim networks by using techniques like webshell placement and account creation to maintain persistence and access credentials.
Additionally, they deploy tools like Meshcentral for remote access and leverage scheduled tasks to load malware and maintain persistence.
By leveraging compromised credentials to gain unauthorized access to various network devices and systems, they disabled security measures, escalated privileges, and established remote access to maintain persistence.
They also exfiltrated sensitive data and collaborated with ransomware affiliates to extort victims, which highlights the threat actors’ sophisticated capabilities and their ability to exploit vulnerabilities in network infrastructure to achieve their malicious objectives.
The FBI and CISA have identified new indicators of compromise associated with an Iranian cyber group and their ransomware affiliates. These actors have been observed using cloud infrastructure to target organizations in various sectors.
The actors have used compromised cloud service accounts to conduct further cyber operations, including transmitting stolen data from other victims.
The FBI has provided a list of IP addresses, domains, and bitcoin addresses associated with these actors. Organizations are advised to investigate and vet these indicators to mitigate potential risks.
The mitigations include reviewing logs for suspicious IP addresses and indicators, applying patches for identified vulnerabilities, investigating compromised networks, checking for unique identifiers and TTPs used by the actors, and checking for outbound web requests to specific domains.
Organizations are recommended to validate their security controls against the MITRE ATT&CK for Enterprise framework by testing their existing security technologies against relevant techniques, analyzing performance, and tuning their security program accordingly.
%20(1).webp?w=1200&resize=1200,0&ssl=1 "Qilin ransomware group claims to have breached Performance Therapies")
