Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/3/2014
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

With Operation Cleaver, Iran Emerges As A Cyberthreat

A hacker group's actions suggest that it is laying the groundwork for a future attack on critical infrastructure targets.

Iran has never been considered quite as much of a cyberthreat to the US as China and Russia have been in recent years. That could be a mistake.

A report released this week by Cylance suggests that state sponsored cybergroups in Iran can be just as dangerous as some of their better-regarded counterparts in other countries.

Over the past two years, researchers at Cylance have been following a hacker group dubbed Operation Cleaver that they believe has quietly infiltrated about 50 companies in critical infrastructure industries in 16 countries. The group's victims have included companies in the oil and gas sector, the energy industry, airports and the transportation sector, government and defense, and the telecommunications and technology industries.

About 10 of the victims are based in the US and include a major airline, an energy company, a medical university, and an automobile manufacturer. Many of the other firms targeted by the group are based in Middle Eastern countries like Kuwait, the United Arab Emirates, Saudi Arabia, and Qatar. Cylance also found a significant number of victims in Canada, Germany, England, France, India, Israel, Pakistan, and Turkey.

Cylance believes there's a strong likelihood there are more victims out there that the company does not know about.

What makes Operation Cleaver noteworthy is not just what the group has done so far, but also what it hasn't done, said Jon Miller, vice president of strategy at Cylance.

Like many other criminal groups in recent years, Operation Cleaver -- a moniker Cylance chose because the term appears frequently in the group's code -- has broken into systems containing a lot of confidential data, trade secrets, and intellectual property at the companies it has infiltrated.

But unlike their Russian and Chinese counterparts, which tend to grab IP and financial data where they can, the Iranian group has mostly avoided stealing such data, Miller said. Instead it has focused on gathering as much information as it can about network topologies, sensitive employee information and schedule details, identification photos, and documents pertaining to housing, telecom, and electricity infrastructures.

The pattern of compromise and the nature of the data being exfiltrated suggest that the group is scoping networks and conducting reconnaissance on them as if in preparation for a major assault at some point in the future.

The group's compromise of networks and systems in airlines and airports in South Korea, Saudi Arabia, and Pakistan is particularly troubling, Cylance said in its report. "The level of access seemed ubiquitous: Active Directory domains were fully compromised, along with entire Cisco Edge switches, routers, and internal networking infrastructure."

In some cases, the Iranian group gained complete control of the remote access infrastructures and supply chains at these organizations. In one airport, the group achieved complete access to airport gates and security control systems, potentially allowing members to spoof gate credentials.

"What they are doing right now is getting as much information as they can on as many critical infrastructure industries as they can," Miller said. "It gives them the capability to affect a very serious breach of cyber security."

For the most part, the tactics used by the group to infiltrate networks are similar to those employed by other groups. The tactics have included SQL injection attacks, spear phishing, and water holing attacks using a combination of custom-designed and publicly available malware tools.

The 20-person group, which masquerades as a construction engineering firm in Tehran, has grown considerably in sophistication over the time that Cylance has been tracking it, Miller said. The increasing sophistication of its malware code and its obfuscation techniques prompted Cylance to go public with its findings.

John Hultquist, cyber espionage practice lead at iSight Partners, which reported this year on another Iranian cyberthreat dubbed Newscaster, shared Cylance's assessment of Operation Cleaver's success at infiltrating critical infrastructure networks. But he differed somewhat in his assessment of the group's technical sophistication.

He said that iSight has been tracking Operation Cleaver for some time, as well, but under another name. From what iSight been observed so far, Cleaver appears to be a modestly funded, modestly resourced group with average skills that has nonetheless had a lot of success compromising critical systems. Many of the tools used by the group are openly available, and the attack methods themselves have been fairly common.

What it has been good at is in lying low and carrying out most of its operations clandestinely, Hultquist said. "They have made headway into very sensitive areas where they can do a lot of damage. We do have some concerns that they are carrying out reconnaissance for a major attack."

Find out how vulnerable ICS and SCADA systems are in Infographic: 70 Percent of World's Critical Utilities Breached.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31664
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-33185
PUBLISHED: 2021-06-18
SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
CVE-2021-33186
PUBLISHED: 2021-06-18
SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-31272
PUBLISHED: 2021-06-18
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.
CVE-2021-31660
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information.