CyberSecurity updates
Updated: 2024-09-12 18:45:19 Pacfic

Flag This

Iranian Hackers Targeting US and UAE Organizations - 13d

Iranian state-sponsored threat actors have been observed utilizing new custom malware and techniques to target organizations across various sectors, including government, education, finance, healthcare, and defense, in both the US and UAE. These actors are actively involved in intelligence gathering and, in some cases, collaborating with ransomware gangs to extort victims. They are known to exploit vulnerabilities in VPNs, Citrix Netscaler, BIG-IP F5 devices, and other security tools, and have also been using fake job offers to recruit potential intelligence agents. This activity highlights the increasing sophistication and persistence of Iranian cyber operations.

References

  • @BleepingComputer - This post on Infosec.exchange provides a concise summary of the Tickler malware and its use by APT33.
  • www.bleepingcomputer.com - This article details the use of the Tickler malware by APT33, including the sectors and countries targeted.
  • www.wired.com - This article provides a detailed overview of the Tickler malware and how it is being used by APT33.
  • SOC Prime Blog - Pioneer Kitten Attack Detection: CISA, DC3, and FBI Warn of Iranian State-Sponsored Actors Collaborating With Ransomware Gangs to Target U.S. and Middle East
  • www.cisa.gov - CISA and Partners Release Advisory: Iran-Based Cyber Actors Enabling Ransomware Attacks on US
  • The Hacker News - U.S. cybersecurity and intelligence agencies have called out an Iranian hacking group for breaching multiple organizations across the country and coordinating with affiliates to deliver ransomware.
  • @patrickcmiller - Iranian Hackers Use New Tickler Malware for Intelligence Gathering on Critical Infrastructure - SecurityWeek
  • Industrial Cyber - Critical infrastructure under attack, as US agencies sound alarm on cyber threat from Iranian-linked groups
  • @patrickcmiller - Critical infrastructure under attack, as US agencies sound alarm on cyber threat from Iranian-linked groups

Classification:

  • Type: Hack
  • Severity: Major
  • Target: US and UAE Organizations
  • Attacker: Iranian






This site is an experimental news aggregator using feeds I personally follow. You can reach me using contacts here if you have feedback. You can also find Flathis at Mastodon.