{"id":12058,"date":"2022-09-23T02:35:07","date_gmt":"2022-09-23T09:35:07","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=12058"},"modified":"2023-04-05T12:26:19","modified_gmt":"2023-04-05T19:26:19","slug":"cyberwar-bulletin-iran-and-albania","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/cyberwar-bulletin-iran-and-albania\/","title":{"rendered":"Cyberwar Bulletin: Iran and Albania"},"content":{"rendered":"
As the world still reels under the impact of the Ukraine-Russia cyberwar<\/a>, yet another Cyberwar has started between Iran and Albania.\u00a0\u00a0<\/strong><\/p>\n Cybersecurity is today a serious threat. Critical infrastructure, government establishments, public sector companies, and policymakers are all repeatedly targeted by groups affiliated with nation-states. While a cyber war spawns disastrous consequences for the parties involved, the aftermath may lead to disrupting the business functions of those indirectly involved as well. In rare circumstances, unrelated organizations bear the brunt of mass, random rampages undertaken by organized cybercrime operators.<\/p>\n The consequences of the recent Iran-Albania cyberwar started off with critical government service outages like the embassy portal and national websites. It soon spiraled into a full-blown diplomatic incident, cutting ties between the nations and prompting the USA to impose sanctions on Iran. Following this incident, a joint advisory was issued by cybersecurity bigwigs FBI, CISA, NSA, and the US Cyber Command, warning against Iranian threat actors.<\/p>\n <\/p>\n Here is what the Prime Minister of Albania had to say <\/a>about cutting off diplomatic ties with Iran:<\/p>\n \u00a0\u201cThis extreme response … is fully proportionate to the gravity and risk of the cyberattack that threatened to paralyze public services, erase digital systems and hack into state records, steal government intranet electronic communication and stir chaos and insecurity in the country.\u201d<\/strong><\/p>\n<\/blockquote>\n In the wake of the Iran-Albania cyberwar and the scare of further retaliation, Securin experts provide insights into Iranian threats that organizations need to watch out for.\u00a0<\/strong><\/p>\n Firstly, let us look into a timeline of events that triggered the cyber war. The start of this war appears to go way back to 2014, when Albania gave shelter to an Iranian dissident group. More recently, the dissidents were supposedly involved <\/a>in cyber attacks on the Iranian capital. The current war, however, escalated with Iran\u2019s attempts to thwart the networks of Albania.<\/p>\n <\/p>\n Research<\/a> suggests that the successful series of attacks on Albania is the handiwork of a cluster of APT groups, all originating from Iran. The attackers gained entry into networks via CVE-2019-0604, a SharePoint Server vulnerability, through which they exploited a misconfigured service account, and then went on to deploy ransomware, followed by wiper malware. The attackers were persistent in the compromised networks for months together, starting from October 2021 till May 2022, before launching full-fledged attacks.<\/p>\n CVE-2019-0604 is a critical severity vulnerability that exists in SharePoint servers and is capable of being remotely exploited to execute malicious code. The vulnerability is associated with the Iranian threat group DEV-0861, and the Chinese groups UNC215, and APT27 groups. The CVE is also associated with the Hello ransomware and has been part of our ransomware research<\/a> since Q1 2021. We also called out the vulnerability in our blog on FireEye\u2019s stolen pentesting tools<\/a> back in 2020.<\/p><\/blockquote>\n Here are the APT groups deemed responsible:<\/p>\n DEV-0133 \/ Lyceum (probing victim infrastructure)<\/p>\n<\/li>\n DEV-0861 (initial access and data exfiltration)<\/p>\n<\/li>\n DEV-0166 \/ IntrudingDivisor (data exfiltration)<\/p>\n<\/li>\n DEV-0842 (deploying the ransomware and wiper malware)<\/p>\n<\/li>\n<\/ul>\n <\/p>\n DEV-0861 and DEV-0166 are believed to be linked to the OilRig group, also known by popular aliases like APT34, Charming Kitten and Phosphorus. The group has been around since 2011 and is known to target global companies of strategic importance to countries that are contrary to Iranian interests, and Energy-, Financial-, Government-, and Healthcare-related organizations, amongst others, in over 50 target countries.<\/p>\n A leaked tool used by APT34<\/a><\/em><\/span><\/p>\n <\/p>\n If you are a user of any of the below-mentioned products, upgrade to their latest versions without further delay.\u00a0Specific versions of these products are associated with vulnerabilities connected to Iranian APT threats, amounting to 225 different product versions overall. Organizations with unpatched vulnerabilities are exposed to a high risk of compromise and continued persistence of threat actors in their network.<\/p>\n <\/p>\n Securin researchers have collated a list of 28 vulnerabilities that have either previously been exploited by known Iranian APT groups, or were called out in the FBI advisory. With a high possibility of Iranian threat actors retaliating to the imposed sanctions, organizations are warned to check for exposures to these vulnerabilities and patch them before it is too late.<\/p>\n Vulnerabilities exploited by Iranian APT Groups<\/em><\/span><\/p>\n <\/p>\n A notable call-out is CVE-2014-4114. Although an 8-year-old vulnerability, it has been previously exploited by four APT groups, and the Petya ransomware gang. It is of critical severity and is also featured in the CISA KEV. This could well turn out to be a dark horse in this war, considering the vulnerability\u2019s age.<\/strong><\/p>\n Securin has called out 24 of these vulnerabilities in our blogs and reports, of which 19 vulnerabilities with ransomware associations have also been warned about in our Ransomware Reports (first published in 2019).<\/p>\n<\/blockquote>\n We had also warned of these vulnerabilities in our Threat Intelligence blog<\/a> (Sep 15, 2022) in light of the advisory released against Iranian threats. To receive such warnings informing of trending threats, sign up for our Weekly Threat Intelligence Newsletter.<\/em><\/p>\n <\/p>\n The table below details the vulnerabilities, the products they exist in, mitigations, and highlights the early warnings provided by Securin regarding the danger these vulnerabilities pose.<\/p>\nIran-Albania Cyberwar Impact<\/h2>\n
\n
Attack Timeline<\/h2>\n
APT Groups that have played a role<\/h2>\n
\n
Products that put you at risk<\/h2>\n
Vulnerabilities Exploited by Iranian Threat Groups<\/h2>\n
\n