Iranian Cyber Actors Target Critical Infrastructure Sectors

Brute force attacks are currently on the rise and constantly evolving. The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and more, released an advisory on October 16, 2024, warning several large organizations and most especially critical infrastructure sectors on the ongoing brute force attacks being carried out by some Iranian cyber actors to either gain persistent access into organizational networks or sell the compromised data on criminal websites for other cybercriminals to exploit. 

The bad actors used several brute force methods, with two of the most popular techniques being password spraying and MFA push bombing. In this advisory, we are given insights into the Techniques, Tactics, and Procedures (TTPs) discovered by the FBI from victims of the attack for a better understanding and to enhance the measures for safeguarding our data. 

Knowing how attacks work, the attacker has to study their target for a more successful outcome, hence, it is assumed that they likely conduct some reconnaissance to gain more understanding and gather useful information to aid in their goals. Once these bad actors gain access to organizational systems, they proceed further in an attempt to gain further information by moving laterally through the network and downloading information that could assist them further.  

Password spraying is the most common method used to gain unauthorized access as well as other unknown methods that have not been disclosed. This grants them access to Microsoft 365, Azure, and Citrix systems. The interesting fact about this attack is the exploitation of MFA. Although MFA is widely considered globally as an extra layer of security, it is not impenetrable. It is known to the attackers that a large number of accounts out there will have MFA set up, making this a target for them. The particular mode of MFA being targeted is the push notification method, where the only action required from the user is the acceptance of the request. If the attackers are able to gain access to a victim’s account through password spraying, they overwhelm the user with multiple MFA requests hoping the victim accidentally clicks on it due to frustration or fatigue.  

The FBI confirmed two cases where this was successful, and the attackers proceeded to register their own devices for MFA on the users’ accounts. In another case, the bad actors used a password reset tool to reset already-expired passwords and then registered MFA for those accounts without MFA enabled by utilizing Okta. It was also discovered that the majority of these attacks were conducted while using a VPN service for anonymity. There are a wealth of open-source tools that make these exploits easier for the bad actors. These tools help them gather more information to maintain their persistence in the organizational networks.  

To detect and mitigate these attacks, organizations are advised to monitor their logs for suspicious activity such as cases of one IP address being used for multiple login attempts, impossible travel (i.e. a user connects from multiple IP addresses with significantly varying distances), MFA registrations from unexpected locations, suspicious use on accounts with privilege, and any alarming activity on accounts that are typically dormant. 

In addition to having proper measures in place for detecting malicious activity, it is also recommended to have mitigating measures in place to address the concerns, such as ensuring there are strong password management policies in place, proper provisioning and de-provisioning of users upon hire and termination or department change, continuous reviews of MFA settings as well as implementing phishing-resistant MFA such as authentication via a mobile app. MFA push notifications are highly discouraged as they are easily exploitable by these attackers. Finally, the most important mitigation factor is security awareness training because if an organization is lacking in this aspect, all the controls implemented would be rendered irrelevant. It is important for employees to be educated on these attacks, how to potentially identify them, as well as actions to be taken when identified.

References 

Boynton, Sean. “Iranian Hackers Target Critical Sectors with ‘brute Force,’ U.S., Canada Say – National.” Global News, Global News, 16 Oct. 2024, globalnews.ca/news/10814131/cybersecurity-iran-brute-force-canada-us/. 

FBI, et al. “Iranian Cyber Actors’ Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations.” Cybersecurity and Infrastructure Security Agency CISA, 16 Oct. 2024, www.cisa.gov/news-events/cybersecurity-advisories/aa24-290a. 

Özeren, Sıla. “Iranian Cyber Actors’ Brute Force and Credential Access Attacks: CISA Alert AA24-290A.” THE COMPLETE SECURITY VALIDATION PLATFORM, Picus Security, 18 Oct. 2024, www.picussecurity.com/resource/blog/cisa-alert-aa24-290a-iranian-cyber-actors-brute-force-and-credential-access-attacks.