Iranian International Espionage, APT’s And VPN’s; What In The World Is Going On?

Using cybercrime as a weapon is something that nation-state hackers are very good at. In a recent report by ClearSky, cybercriminals backed by the country of Iran have been busy sharpening their espionage tools. Since 2017, Iranian groups have been attacking international IT companies, seeking to invade their data systems to infiltrate and eavesdrop on their victims. However, Iran is far from the only country using nation-state actors as tools for espionage. It’s no secret that other nations like Russia, China, North Korea and more are also seeking classified information about the U.S. But thanks to this latest report, we know that Iran has brought infiltration to a whole new level.

Iran’s state-backed hacking groups are also called APT (Advanced Persistent Threat) groups. APT’s are often used to describe any nation-state hacking group. The ClearSky report finds the purpose of these APT attacks are to breach and infiltrate business networks. Once inside the network, the APT’s move throughout an enterprise system looking to plant “backdoors” they can exploit at a future time. When Iranian APT’s attack an IT company providing cybersecurity services for thousands of other businesses, there’s a whole lot at stake. Breaching an IT company provides the ability to reach many of its client networks, including compromising sensitive data through espionage tactics.

Earlier this year, the FBI dispatched a security alert to the U.S. private sector about this latest threat. In particular, it warned business entities involved in Industrial Control Systems (ICS) that they are particularly vulnerable to attack. ICS companies that support global energy creation and distribution have been a popular target for Iranian APT's in the past.

Also revealed in the ClearSky report, Iranian APT hacking groups are gaining access to networks by first attacking weaknesses in VPNs (Virtual Private Networks). The purpose of a VPN is to extend private networks across public networks, giving them protection as though their networks were directly connected. In some cases, after a flaw in a VPN was made public but not yet patched, Iranian groups attacked within hours. After a VPN is compromised, the groups move into their lateral infiltration throughout a system. In the past three years, Iran has successfully stolen information from dozens of companies by exploiting unpatched and vulnerable VPNs. Although these attack vectors are not unique to Iran, their APT’s have created tools and techniques showing how advanced (and successful) they have become in a relatively short period of time.

Companies of all types really need to ensure all perimeter security tools are installed correctly and kept updated at all times. In addition, having a well-trained staff on cybersecurity risks is paramount to any cybersecurity plan. Phishing is the number way cybercriminals, regardless of whether they are state-backed or not, infiltrate networks. Awareness training is your key to prevention.