The FBI, CISA, and DC3 warn that Iran-based cyber actors continue targeting U.S. and international organizations to obtain network access for ransomware affiliates while also conducting espionage for the Iranian government. The advisory details their TTPs, IOCs, and mitigations to help defenders detect and thwart these activities. #FoxKitten #UNC757 #PioneerKitten #NoEscape #RansomHouse #ALPHV #BlackCat #xplfinder #Br0k3r #FBI #CISA
Keypoints
- Iran-based cyber actors continue intrusions against U.S. and foreign organizations since 2017, targeting education, finance, healthcare, and local governments.
- Actors collaborate with ransomware affiliates (e.g., NoEscape, RansomHouse, ALPHV/BlackCat) to deploy ransomware in exchange for a share of gains.
- Multiple CVEs are exploited to gain initial access, including CVE-2019-19781, CVE-2023-3519, CVE-2022-1388, CVE-2024-3400, and CVE-2024-24919.
- Observed MITRE techniques cover initial access, persistence, credential access, defense evasion, discovery, execution, C2, and exfiltration.
- Indicators of compromise include specific IPs (e.g., 138.68.90.19, 167.99.202.130) and domains (e.g., api.gupdate.net, githubapp.net), plus notable webshell and remote-access artifacts.
- Mitigations emphasize patching known CVEs, detecting actor-specific TTPs, and reporting incidents to FBI/CISA; validation of security controls against MITRE techniques is recommended.
MITRE Techniques
- [T1596] Search Open Technical Databases – Iranian cyber actors use Shodan to identify vulnerable internet‑facing devices. ‘Use of Shodan to identify vulnerable devices.’
- [T1190] Exploit Public-Facing Application – They scan and exploit public-facing networking devices (Citrix Netscaler CVEs, F5 BIG-IP CVEs, VPNs, PanOS). ‘Exploitation of Citrix Netscaler, F5 BIG-IP, Pulse Secure/Ivanti VPNs, and PanOS firewalls.’
- [T1133] External Remote Services – Creation of directories on targeted IP addresses to enable access. ‘Creation of directories on targeted IP addresses.’
- [T1505.003] Server Software Component: Web Shell – Deployment of webshells on compromised devices. ‘Deployment of webshells on compromised devices.’
- [T1136.001] Create Account (Local Account) – Creation of local accounts on victim networks. ‘Creation of local accounts on victim networks.’
- [T1098] Account Manipulation – Requesting exemptions to tools for allowlisting or bypassing controls. ‘Request exemptions for tools on victim networks.’
- [T1053] Scheduled Task/Job – Persistence via scheduled tasks and DLL side-loading. ‘Implementation of scheduled tasks for persistence.’
- [T1078.003] Valid Accounts: Local Accounts – Repurposing local credentials to access other apps. ‘Repurposing compromised credentials for access.’
- [T1078.002] Valid Accounts: Domain Accounts – Using admin/domain credentials to log into infrastructure. ‘Repurpose administrative credentials of network administrators to log into domain controllers.’
- [T1562.001] Impair Defenses: Disable or Modify Tools – Disabling antivirus/security software via credential abuse. ‘Disable antivirus and security software.’
- [T1562.010] Impair Defenses: Downgrade Attack – Lowering PowerShell security policies. ‘Lower PowerShell policies to a less secure level.’
- [T1056] Input Capture – Capturing login credentials via webshells. ‘Capture login credentials using webshells on compromised Netscaler devices.’
- [T1059.001] Command and Scripting – PowerShell usage for remote access and execution. ‘Using PowerShell for remote access and command execution.’
- [T1012] Query Registry – Exporting registry hives and configurations. ‘Exporting registry hives and configurations.’
- [T1219] Remote Access Software – Installing AnyDesk for remote access. ‘Installation of AnyDesk for remote access.’
- [T1572] Protocol Tunneling – Ligolo and NGROK used for outbound connections. ‘Ligolo and NGROK for outbound connections.’
- [T1657] Financial Theft – Extortion collaboration with ransomware affiliates. ‘to extort victims’ via ransomware operations.
- [TA0010] Exfiltration – Stealing sensitive data from victims for GOI support. ‘stealing sensitive data from victims.’
Indicators of Compromise
- [IP Address] context – 138.68.90.19, 167.99.202.130, and other addresses observed in 2024 (Table 10 provides several examples).
- [IP Address] context – 78.141.238.182, 51.16.51.81, 51.20.138.134, and additional addresses observed through August 2024 (Table 10).
- [Domain] context – api.gupdate.net, githubapp.net, and 2 more domains observed coordinating activity (Table 10).
- [File Name] context – netscaler.1, netscaler.php, and 1 more file observed in Netscaler webshell deployments (Table 10/11 references).
Read more: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a