Iranian Hackers Exploiting VPN Flaws to Backdoor Organizations Worldwide

• A new report published by cybersecurity researchers has unveiled evidence of Iranian state-sponsored hackers targeting dozens of companies and organizations in Israel and around the world over the past three years.
• Dubbed "Fox Kitten," the cyber-espionage campaign is said to have been directed at companies from the IT, telecommunication, oil and gas, aviation, government, and security sectors.
• "We estimate the campaign revealed in this report to be among Iran's most continuous and comprehensive campaigns revealed until now," ClearSky researchers said.
• "The revealed campaign was used as a reconnaissance infrastructure; however, it can also be used as a platform for spreading and activating destructive malware such as ZeroCleare and Dustman."
• Tying the activities to threat groups APT33, APT34, and APT39, the offensive — conducted using a mix of open source and self-developed tools — also facilitated the groups to steal sensitive information and employ supply-chain attacks to target additional organizations, the researchers said.

The Work of Multiple Iranian Hacking Groups

• Based on the campaign's use of web shells and overlaps with the attack infrastructure, the ClearSky report highlighted that the attacks against VPN servers are possibly linked to three Iranian groups — APT33 ("Elfin"), APT34 ("OilRig") and APT39 (Chafer).
• What's more, the researchers assessed that the campaign is a result of a "cooperation between the groups in infrastructure," citing similarities in the tools and work methods across the three groups.
  
• Just last month, Iranian state-backed hackers — dubbed "Magnallium" — were discovered carrying out password-spraying attacks targeting US electric utilities as well as oil and gas firms.
• Given that the attackers are weaponizing VPN flaws within 24 hours, it's imperative that organizations install security patches as and when they are available.
• Aside from following the principle of least privilege, it also goes without saying that critical systems are monitored continuously and kept up to date. Implementing two-step authentication can go a long way towards minimizing unauthorized logins.