DHS Warns of Potential Iranian Cyberattacks

Concerns about an Iranian cyber response to the recent American military strike in Baghdad grew this week with the US Department of Homeland Security urging organizations to be on heightened alert for denial-of-service and other more destructive attacks.

In an alert Monday, the DHS's Cybersecurity and Infrastructure Security Agency (CISA) warned US organizations about Iran's historic use of cyberattacks to retaliate against perceived foes. "Iran has a history of leveraging asymmetric tactics to pursue national interests beyond its conventional capabilities," the CISA alert noted.

In recent years, cyber groups operating on behalf of the Iranian government have improved their offensive capabilities in carrying out denial of service, website defacement attacks, and data theft. "They have also demonstrated a willingness to push the boundaries of their activities, which include destructive wiper malware and, potentially, cyber-enabled kinetic attacks," CISA said.

The CISA alert is the first public acknowledgement from the US government about potential Iranian cyberattacks in response to the US drone strike last week that killed Gen. Qassem Soleimani. Several security vendors, including Crowdstrike and Recorded Future, have noted the possibility of such attacks in recent days, citing past precedent.

According to Crowdstrike, while there is no evidence of a specific threat emanating from Iranian nation-state actors at this time, US organizations should assume a defensive posture all the same. Current intelligence suggests that organizations in the government, defense, financial, and oil and gas sectors will be the most likely targets for attacks, the security vendor said.

Recorded Future said it believes that Iranian cyber groups will try to use networks they already have compromised in previous espionage activities to carry out new attacks. Other likely tactics include the use of web shells, password spraying, and commodity and custom malware to break into target networks. In addition to US-based targets, Iranian cyber operatives likely will target organizations in the Persian Gulf as well as US allies and partners in the region, Recorded Future said.

Multiple Iran-based cyber groups with suspected ties to the government and the country's Islamic Revolutionary Guard Corps are believed to have the capability to disrupt and damage operations at US organizations. Top among them are APT33, one of the most active threat groups operating out of the Middle East; APT34 (aka OilRig/MUDDYWATER); and APT39, a relatively newly surfaced group that targets companies in the technology, travel services, and telecommunications sectors.

"APTs 33 and 34 are primarily focused on financial, energy, telecom, and SCADA/ICS," says Rosa Smothers, a former CIA technical intelligence officer and senior VP of cyber operations at KnowBe4. Private sector companies responsible for critical infrastructure are often unaware these threat actors already might have a presence on their network. That poses a threat because the Iranian government and its hacker proxies are likely to first consider targets where they currently maintain persistence.

"If organizations are fully defending against APTs — utilizing defense-in-depth methods, educating users about how to spot phishing and rejecting known breached and common passwords — then your technical bases should be covered," Smothers says.

Recommended Actions
Organizations in targeted sectors should be keeping an eye out for activities, indicators of compromise, and the tactics, techniques, and procedures associated with these APT groups says Anuj Goel, CEO of Cyware Labs. Examples of tools used by these groups include njRAT, RevengeRAT and NonoCoreRAT, he says. "Most recently, APT33, Iran's most potent cybercriminal group, was found probing physical control systems used in electric utilities, manufacturing, and oil refineries using password-spraying attacks," Goel says.

This week's CISA alert listed multiple Iranian APT group techniques that US organizations should be monitoring for, including credential dumping, file obfuscation, PowerShell misuse, and the abuse of other legitimate system features such as Registry run keys and the startup folder.

The alert also recommended several actions that organizations can take to mitigate their exposure to potential attacks. Among them was the need to disable unnecessary ports and protocols, enhance monitoring of email and network traffic, patch externally facing systems, and limiting and logging PowerShell use.

"Scrub accounts that are no longer active, and investigate accounts that log in at odd hours," Smothers adds. "Iranian activities were previously [discovered] due to activity occurring only during Iranian government business hours."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "What Tools Will Find Misconfigurations in My AWS S3 Cloud Buckets?"