Threat Research

Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Operations | CISA

Securonix

IRGC-affiliated cyber actors exploited known Fortinet FortiOS and Microsoft Exchange vulnerabilities, plus VMware Horizon Log4j flaws, to gain initial access and conduct ransomware-like operations involving data encryption and data extortion. The advisory outlines observed tactics, IOCs, and mitigations to defend critical infrastructure and international targets against these IRGC-linked ransom activities. #IRGC #NajeeTechnologyHooshmandFaterLLC #AfkarSystemYazd #ProxyShell #Log4Shell #Fortinet #MicrosoftExchange #VMwareHorizon #BitLocker #DoubleExtortion

Keypoints

  • IRGC-affiliated APT actors have exploited Fortinet FortiOS and Microsoft Exchange vulnerabilities (and VMware Horizon Log4j flaws) since 2021 to gain initial access.
  • Following initial access, actors encrypt data with BitLocker and/or exfiltrate data for ransom or extortion, sometimes employing “double extortion.”
  • The actors target a broad set of entities, including U.S. critical infrastructure sectors and international organizations in Australia, Canada, and the U.K., often operating under Najee Technology Hooshmand Fater LLC and Afkar System Yazd.
  • Malicious and legitimate tools (e.g., FRP, Plink, RDP, BitLocker, SoftPerfect Network Scanner) are used across the enterprise spectrum for C2, lateral movement, and discovery.
  • IOCs include IP addresses, malicious domains, and numerous file-based indicators (e.g., named Windows process masquerades and DLL/EXE artifacts).
  • Mitigations emphasize patching, MFA, offline backups, network segmentation, blocklists/allowlists, and MITRE-aligned testing of security controls.

MITRE Techniques

  • [T1583] Acquire Infrastructure – The IRGC-affiliated actors have used the following malicious and legitimate tools for a variety of tactics across the enterprise spectrum, including Fast Reverse Proxy (FRP) for C2, Plink for C2, RDP for lateral movement, BitLocker for data encryption, and SoftPerfect Network Scanner for system network configuration discovery. “The IRGC-affiliated actors have used the following malicious and legitimate tools [T1588.001, T1588.002] for a variety of tactics across the enterprise spectrum.”
  • [T1190] Exploit Public-Facing Application – The actors gained initial access by exploiting known Fortinet FortiOS and Microsoft Exchange vulnerabilities and observed Log4j vulnerabilities for initial access. “exploiting known Fortinet FortiOS and Microsoft Exchange server vulnerabilities since early 2021 to gain initial access” and “exploiting VMware Horizon Log4j vulnerabilities for initial access.”
  • [T1053.005] Scheduled Task – The actors may have modified the Task Scheduler, with tasks like Wininet, WinLogon, and CacheTask potentially associated with the activity. “The IRGC-affiliated actors may have made modifications to the Task Scheduler [T1053.005].”
  • [T1136.001] Create Account – The actors established new user accounts on domain controllers, servers, workstations, and Active Directory, including Domain Admin, it_admin, DefaultAccount, etc. “The IRGC-affiliated actors established new user accounts on domain controllers, servers, workstations, and active directories [T1136.001, T1136.002].”
  • [T1003.001] LSASS Memory – The actors dumped and exfiltrated LSASS memory for credential harvesting. “dumping and subsequently exfiltrating the Local Security Authority Subsystem Service (LSASS) process memory … for credential harvesting.”
  • [T1486] Data Encrypted for Impact – The actors encrypted data by forcing BitLocker activation and held decryption keys for ransom. “forced BitLocker activation on host networks to encrypt data [T1486] and held the decryption keys for ransom.”
  • [T1016] System Network Configuration Discovery – SoftPerfect Network Scanner was used to discover network configuration. “SoftPerfect Network Scanner for system network configuration discovery.”
  • [T1021.001] Remote Desktop Protocol – RDP used for lateral movement within networks. “Remote Desktop Protocol (RDP) for lateral movement.”

Indicators of Compromise

  • [IP Addresses] context – 54.39.78.148, 95.217.193.86, and 8 more IPs
  • [Malicious Domains] context – newdesk.top, symantecserver.co, msupdate.us, and 7 more domains
  • [Files] context – Wininet.xml, Winlogon.xml, and other files observed (e.g., Wininet.bat, Task_update.exe, lsass.dmp, svchost.exe masquerades)

Read more: https://www.cisa.gov/uscert/ncas/alerts/aa22-257a