Attacks/Breaches

12/3/2014
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

With Operation Cleaver, Iran Emerges As A Cyberthreat

A hacker group's actions suggest that it is laying the groundwork for a future attack on critical infrastructure targets.

Iran has never been considered quite as much of a cyberthreat to the US as China and Russia have been in recent years. That could be a mistake.

A report released this week by Cylance suggests that state sponsored cybergroups in Iran can be just as dangerous as some of their better-regarded counterparts in other countries.

Over the past two years, researchers at Cylance have been following a hacker group dubbed Operation Cleaver that they believe has quietly infiltrated about 50 companies in critical infrastructure industries in 16 countries. The group's victims have included companies in the oil and gas sector, the energy industry, airports and the transportation sector, government and defense, and the telecommunications and technology industries.

About 10 of the victims are based in the US and include a major airline, an energy company, a medical university, and an automobile manufacturer. Many of the other firms targeted by the group are based in Middle Eastern countries like Kuwait, the United Arab Emirates, Saudi Arabia, and Qatar. Cylance also found a significant number of victims in Canada, Germany, England, France, India, Israel, Pakistan, and Turkey.

Cylance believes there's a strong likelihood there are more victims out there that the company does not know about.

What makes Operation Cleaver noteworthy is not just what the group has done so far, but also what it hasn't done, said Jon Miller, vice president of strategy at Cylance.

Like many other criminal groups in recent years, Operation Cleaver -- a moniker Cylance chose because the term appears frequently in the group's code -- has broken into systems containing a lot of confidential data, trade secrets, and intellectual property at the companies it has infiltrated.

But unlike their Russian and Chinese counterparts, which tend to grab IP and financial data where they can, the Iranian group has mostly avoided stealing such data, Miller said. Instead it has focused on gathering as much information as it can about network topologies, sensitive employee information and schedule details, identification photos, and documents pertaining to housing, telecom, and electricity infrastructures.

The pattern of compromise and the nature of the data being exfiltrated suggest that the group is scoping networks and conducting reconnaissance on them as if in preparation for a major assault at some point in the future.

The group's compromise of networks and systems in airlines and airports in South Korea, Saudi Arabia, and Pakistan is particularly troubling, Cylance said in its report. "The level of access seemed ubiquitous: Active Directory domains were fully compromised, along with entire Cisco Edge switches, routers, and internal networking infrastructure."

In some cases, the Iranian group gained complete control of the remote access infrastructures and supply chains at these organizations. In one airport, the group achieved complete access to airport gates and security control systems, potentially allowing members to spoof gate credentials.

"What they are doing right now is getting as much information as they can on as many critical infrastructure industries as they can," Miller said. "It gives them the capability to affect a very serious breach of cyber security."

For the most part, the tactics used by the group to infiltrate networks are similar to those employed by other groups. The tactics have included SQL injection attacks, spear phishing, and water holing attacks using a combination of custom-designed and publicly available malware tools.

The 20-person group, which masquerades as a construction engineering firm in Tehran, has grown considerably in sophistication over the time that Cylance has been tracking it, Miller said. The increasing sophistication of its malware code and its obfuscation techniques prompted Cylance to go public with its findings.

John Hultquist, cyber espionage practice lead at iSight Partners, which reported this year on another Iranian cyberthreat dubbed Newscaster, shared Cylance's assessment of Operation Cleaver's success at infiltrating critical infrastructure networks. But he differed somewhat in his assessment of the group's technical sophistication.

He said that iSight has been tracking Operation Cleaver for some time, as well, but under another name. From what iSight been observed so far, Cleaver appears to be a modestly funded, modestly resourced group with average skills that has nonetheless had a lot of success compromising critical systems. Many of the tools used by the group are openly available, and the attack methods themselves have been fairly common.

What it has been good at is in lying low and carrying out most of its operations clandestinely, Hultquist said. "They have made headway into very sensitive areas where they can do a lot of damage. We do have some concerns that they are carrying out reconnaissance for a major attack."

Find out how vulnerable ICS and SCADA systems are in Infographic: 70 Percent of World's Critical Utilities Breached.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
7 Free (or Cheap) Ways to Increase Your Cybersecurity Knowledge
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19349
PUBLISHED: 2018-11-17
In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php.
CVE-2018-19350
PUBLISHED: 2018-11-17
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.
CVE-2018-19341
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader...
CVE-2018-19342
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation starting at U3DBrowser+0x00000000...
CVE-2018-19343
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read), obtain sensitive information, or possibly have unspecified other impact via a U3D sample because of a "Data from Faul...