In response to increased U.S.-Iran tensions stemming from the recent death of Quds Force leader Qasem Soleimani by U.S. forces and concerns of potential retaliatory cyber attacks, we're bringing the latest from our front-line experts on all things Iran. Christopher Glyer and Nick Carr are joined by Sarah Jones (@sj94356) and Andrew Thompson (@QW5kcmV3) to provide a glimpse into Iran-nexus threat groups, including APT33, APT34, APT35, APT39 and TEMP.Zagros—as well as the freshest actionable information on suspected Iranian uncategorized (UNC) groups that are active right now.
We get right into it with a picture of Iranian compromise activity from just a few years ago—what we observed and the basic, cookie-cutter approach to their intrusions—and then begin to walk through the stark contrast to their TTPs today. We discuss how and why their Computer Network Operations (CNO) has evolved quickly and provide a detailed walk through all of the graduated Iranian APT groups.
Our experts share their experiences with each group, moments in time that surprised or impressed us from Iranian threat actors and notable shifts in behavior—as well as our standing questions. Iranian intrusion operators have come a long way from DDoS and defacement, basic scanning, Cain & Abel and ASPXspy to DNS hijacking, social engineering via LinkedIn, information operations and backdoors such as QUADAGENT, SANDSPY, TANKSHELL—then filling in the gaps with the quick adoption of offensive security post-compromise tools and techniques.
We close this first episode of Season 3 with an overview of actionable mitigations to secure against both Iranian intrusions and several other threats, including disruptive and destructive ransomware attacks. For more information on these mitigations as well as our public source material supporting the discussion from the show, please check out:
- APT33 graduation blog post and webinar
- APT34 targeted attack using Microsoft Office vulnerability
- An example TEMP.Zagros phishing campaign
- APT35 highlights in M-Trends 2018
- Iranian information operations
- RULER home page usage by Iranian groups and mitigations
- APT39 graduation
- Iranian DNS Hijacking (DNSpionage)
- More Iranian influence operations
- APT34 social engineering via LinkedIn
- FireEye response to mounting U.S.-Iran tensions
- U.S.-Iran tensions webinar and mitigations overview
State of the Hack® is FireEye's monthly broadcast series, hosted by Christopher Glyer (@cglyer) and Nick Carr (@itsreallynick), that discusses the latest in information security, cyber espionage, attack trends, and tales from the front lines of responding to targeted intrusions. If you want to experience the magic, you can watch all State of the Hack episodes now. All shows are also available as audio-only podcast episodes.