Pierluigi Paganini June 24, 2019

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a significant increase in cyberattacks from Iranian hackers spreading data wipers.

US DHS CISA agency warns of increased cyber-activity from Iran aimed at spreading data-wiping malware through password spraying, credential stuffing, and spear-phishing.

The attacks are targeting U.S. industries and government agencies, the statement was also published by the CISA Director Chris Krebs via his Twitter account.

The statement warns of targeted attacks carried out by the Iranian affiliated actors that leverage data-wiper specifically designed to permanently destroy data of infected systems.

Wiper attacks have been used in the past by state actors or as decoys for other attacks, which are described later in the article.

“CISA is aware of a recent rise in malicious cyber activity directed at United States industries and government agencies by Iranian regime actors and proxies.” reads the CISA Statement on Iranian Cybersecurity Threats.
“We will continue to work with our intelligence community and cybersecurity partners to monitor Iranian cyber activity, share information, and take steps to keep America and our allies safe.”

Experts recommend to have secure working backup procedures, in case of attack, victims could simply recover data from a backup.

The statement also highlights the risks related to account compromise that could represent the entry point in a targeted network.

“What might start as an account compromise, where you think you might just lose data, can quickly become a situation where you’ve lost your whole network.” continues the statement. “In times like these it’s important to make sure you’ve shored up your basic defenses, like using multi-factor authentication, and if you suspect an incident – take it seriously and act quickly.”

Past attacks attributed to Iran-linked hackers are:

• 2012 – Shamoon wiped over 30,000 computers at Saudi Aramco.
• 2016 – Shamoon 2 spread in the wild.
• 2017- NotPetya leveraged the EternalBlue exploit to spread to vulnerable systems.
• 2017 – anti-Israel & pro-Palestinian data wiper dubbed IsraBye that is spread as a ransomware.
• 2018 – KillDisk was involved in a wave of SWIFT attacks against banks worldwide.
• 2018 – Olympic Destroyer malware was used in attacks against Olympic Winter Games in Pyeongchang, and later in a new wave of attacks against organizations in Germany, France, the Netherlands, Russia, Switzerland, and Ukraine.

Pierluigi Paganini

(SecurityAffairs – Data wipers, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]