iran (26)

12389945471?profile=RESIZE_400xCybersecurity experts are warning that hospitals around the country are at risk for attacks like the one that is crippling operations at a premier Midwestern children’s hospital and that the US government is doing too little to prevent such breaches.  Hospitals in recent years have shifted their use of online technology to support everything from telehealth to medical devices to patient records.  Today, they are a favorite target for internet thieves who hold systems’ data and networks hostage f

12364136897?profile=RESIZE_400xHigh-profile individuals working on Middle Eastern affairs at universities and research organizations in Belgium, France, Gaza, Israel, the UK, and the US have been targeted by an Iranian cyber espionage group called Mint Sandstorm since November 2023.  The threat actor "used bespoke phishing lures in an attempt to socially engineer targets into downloading malicious files," the Microsoft Threat Intelligence team reported in a recent analysis, describing it as a "technically and operationally ma

12330371483?profile=RESIZE_400xAn Israeli-linked hacker group claims to have carried out a major cyber-attack on Iranian petrol stations, knocking 70% of them offline on 18 December.  Predatory Sparrow, or “Gonjeshke Darande” in Persian, said it launched the “controlled” attack in response to “aggression” by the Islamic Republic and its proxies in the region.  “This cyber attack was carried out in a controlled manner to avoid potential damage to emergency services,” the group said.

Addressing Iran’s Ayatollah Ali Khamenei, th

12304767697?profile=RESIZE_400xA water authority in Pennsylvania reportedly suffered a cyberattack, prompting officials to reassure people in the area that drinking water has not been affected by the incident.

The Municipal Water Authority of Aliquippa, which serves thousands of customers in communities northwest of Pittsburgh, did not respond to requests for comment but told local news outlet that computer screens at a facility were plastered with a message from hacking group Cyber Av3ngers. The facility, which contains a co

12264332264?profile=RESIZE_400xUsing a trending item as a malicious lure is relatively common; to do it in a period of military conflict and deliberately target users in the affected region is a different step.  Recently, a genuine app: RedAlert - Rocket Alerts, has been popular among users in the Israel and Gaza region, since it allows individuals to receive timely and precise alerts about incoming airstrikes.  However, a malicious, spoofed version of the app was detected last week, which collected personal information inclu

11029695866?profile=RESIZE_400xThe Iranian nation-state group known as MuddyWater has been observed directing destructive attacks on hybrid environments under the guise of a ransomware operation.  The name is not to be confused with McKinley Morganfield (April 4, 1913 – April 30, 1983), known professionally as Muddy Waters, was an American blues singer and musician.  Iran could be singing the blues if they keep this up.

According to new findings from the Microsoft Threat Intelligence team, which discovered the threat actor ta

10978300654?profile=RESIZE_400xThe current Ukraine crisis has revealed the willingness of state and non-state actors to involve themselves in conducting attacks of various degrees of severity and frequency.  Notably, hacktivists and cybercriminal groups have joined the conflict extending beyond the borders of the two primary combatants, with cyberattacks targeting those governments and private sector organizations perceived to be supporting the other side.  Patriotic hacktivism is not necessarily new, especially in troubled a

10893599672?profile=RESIZE_400xWith women’s rights at issue, hackers have disrupted the works of Iran’s Fars news agency, one of the main sources of news disseminated by the state during protests over Mahsa Amini's death, the agency reported.  Iran has been shaken by numerous in country and international protests since Amini’s death while in custody on 16 September after her arrest for an alleged breach of the country's dress code for women.  Iran’s first protests focused on the state-mandated hijab, or headscarf, for women,

10861060279?profile=RESIZE_400xThe FBI released an alert last week warning of hack-and-leak operations targeting organizations in the US and Israel by a group based in Iran.  The alert centers on Emennet Pasargad, an Iranian company US law enforcement agencies have previously spotlighted for its role in efforts to interfere with the 2020 US presidential election.  Last week, the FBI said the company, which has changed its name several times to avoid sanctions, has targeted entities in Israel since 2020 with attacks that invol

10229169082?profile=RESIZE_400xIran’s Revolutionary Guard has added “smart submarines,” unmanned underwater vehicles, to its navy for the first time, a report presented on Iranian state TV.  Its Guard’s Navy unveiled the vessels, along with new missiles and speedboats, at a ceremony in Iran’s southern port city of Bandar Abbas.[1]

Its new speedboats can travel at up to 95 knots (about 109 mph) and are able to launch missiles and rockets.  The report also said the Guard’s navy was equipped with new maneuverable missiles with a

10065799678?profile=RESIZE_400xPrevious attacks from the Iranian Phosphorus APT (aka Charming Kitten, APT35) are well documented. Recently a new set of tools incorporated into the group's arsenal, and a connection with the Memento ransomware, have been discovered. Researchers from have detected a new and undocumented PowerShell backdoor that supports downloading malware such as a keylogger and an infostealer. The code runs in the context of a .NET app without launching powershell.exe and thus avoiding detection.

See Previous

10024795479?profile=RESIZE_400xIn 2010, Iran’s uranium enrichment centrifuges were attacked and rendered useless through a computer virus that became known as Stuxnet.  It was the first case in which a hacker attack, coordinated by nations (presumably the US and Israel), hit a large military target in the “real world.”  A worldwide race to create or acquire cyber weapons was then just taking shape. 

Fast forward to last week (11 years later), Ukraine was hit by a massive cyber-attack that targeted government websites.  Posted

9936355054?profile=RESIZE_400xActivity Summary - Week Ending on 22 December 2021:

  • Red Sky Alliance identified 30,069 connections from new IP’s checking in with our Sinkholes
  • dauction.ru Still has Issues after 4 weeks !
  • Analysts identified 5,039 new IP addresses participating in various Botnets
  • Log4j Vulnerability
  • BlackCat
  • AgentTesla Additions
  • Iran Hackers
  • Cyber and Medical Devices
  • Attacking K-12 School Apps
  • Cyber Port Protection
  • Finite Recruitment

Link to full report: IR-21-356-001_weekly356.pdf

9840514871?profile=RESIZE_400xActivity Summary - Week Ending on 24 November 2021:

  • Red Sky Alliance identified 26,071 connections from new IP’s checking in with our Sinkholes
  • Analysts identified 2,849 new IP addresses participating in various Botnets
  • DigitalOcean in the Cross-Hairs Again
  • Magniber Ransomware
  • Ransomware Still #1
  • Attack Framework - Left to Right
  • Core to the Edge
  • Iran Cyber Bullies & Mahan Airlines
  • Asia Financial Targets
  • CBDC
  • Environmentalists Sharing the Brave New World

Link to full report: IR-21-328-001_weekl

9153829494?profile=RESIZE_400xThe US has seized the domains of 36 websites linked with Iran and Iraq for allegedly publishing disinformation and running malicious influencing campaigns targeting Americans, the Justice Department says.  Thirty-three of the websites belong to the Iranian Islamic Radio and Television Union, or IRTVU, and three belong to Kata’ib Hizballah, or KH, a paramilitary group based in Iraq.  KH has been designated as a foreign terrorist organization since 2009, and IRTVU was put under sanctions in Octobe

8959865492?profile=RESIZE_400xIranian hackers have reportedly hit multiple Israeli companies with ransomware, in a new campaign of attacks.  A group describing itself as 'N3tw0rm' (Networm) recently added the logo of H&M Israel to their naming and shaming website, just three days after another local firm, Veritas Logistics, was hit.

It is suspected that Iran's Islamic Revolutionary Guard Corps was behind a ransomware campaign that used a contracting company called "Emen Net Pasargard," or ENP, to target over a dozen organiza

8872293089?profile=RESIZE_400xChina, Russia, North Korea, and Iran continue to pose significant cybersecurity threats to the US, because each is capable of launching disruptive attacks, according to a report published 13 April 2021 by the Office of the Director of National Intelligence.

Threats include disinformation campaigns that target elections and try to undermine democratic institutions as well as aggressive hacking campaigns, such as the SolarWinds supply chain attack, according to the report. In many cases, criminal

8837471697?profile=RESIZE_400xThe new cooperation agreement between Russia and Iran on cybersecurity and information technology is likely to create new hurdles for the United States and its allies in the Middle East. In January 2021, Russian Foreign Minister Sergey Lavrov and his Iranian counterpart Javad Zarif signed a cooperation agreement on cybersecurity and information and communications technology (ICT).

The agreement includes cybersecurity cooperation, technology transfer, combined training, and coordination at multil

8011615880?profile=RESIZE_400xOur friends from the US Department of Homeland Security have provided an open source Threat Assessment for October 2020 - which is Cyber Security Awareness Month.  The following is the Cyber Threat Assessment Section. 

Cyber threats to the Homeland from both nation-states and non-state actors will remain acute. U.S. critical infrastructure faces advanced threats of disruptive or destructive cyber-attacks. Federal, state, local, tribal and territorial governments, as well as the private sector, w