Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/3/2014
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

With Operation Cleaver, Iran Emerges As A Cyberthreat

A hacker group's actions suggest that it is laying the groundwork for a future attack on critical infrastructure targets.

Iran has never been considered quite as much of a cyberthreat to the US as China and Russia have been in recent years. That could be a mistake.

A report released this week by Cylance suggests that state sponsored cybergroups in Iran can be just as dangerous as some of their better-regarded counterparts in other countries.

Over the past two years, researchers at Cylance have been following a hacker group dubbed Operation Cleaver that they believe has quietly infiltrated about 50 companies in critical infrastructure industries in 16 countries. The group's victims have included companies in the oil and gas sector, the energy industry, airports and the transportation sector, government and defense, and the telecommunications and technology industries.

About 10 of the victims are based in the US and include a major airline, an energy company, a medical university, and an automobile manufacturer. Many of the other firms targeted by the group are based in Middle Eastern countries like Kuwait, the United Arab Emirates, Saudi Arabia, and Qatar. Cylance also found a significant number of victims in Canada, Germany, England, France, India, Israel, Pakistan, and Turkey.

Cylance believes there's a strong likelihood there are more victims out there that the company does not know about.

What makes Operation Cleaver noteworthy is not just what the group has done so far, but also what it hasn't done, said Jon Miller, vice president of strategy at Cylance.

Like many other criminal groups in recent years, Operation Cleaver -- a moniker Cylance chose because the term appears frequently in the group's code -- has broken into systems containing a lot of confidential data, trade secrets, and intellectual property at the companies it has infiltrated.

But unlike their Russian and Chinese counterparts, which tend to grab IP and financial data where they can, the Iranian group has mostly avoided stealing such data, Miller said. Instead it has focused on gathering as much information as it can about network topologies, sensitive employee information and schedule details, identification photos, and documents pertaining to housing, telecom, and electricity infrastructures.

The pattern of compromise and the nature of the data being exfiltrated suggest that the group is scoping networks and conducting reconnaissance on them as if in preparation for a major assault at some point in the future.

The group's compromise of networks and systems in airlines and airports in South Korea, Saudi Arabia, and Pakistan is particularly troubling, Cylance said in its report. "The level of access seemed ubiquitous: Active Directory domains were fully compromised, along with entire Cisco Edge switches, routers, and internal networking infrastructure."

In some cases, the Iranian group gained complete control of the remote access infrastructures and supply chains at these organizations. In one airport, the group achieved complete access to airport gates and security control systems, potentially allowing members to spoof gate credentials.

"What they are doing right now is getting as much information as they can on as many critical infrastructure industries as they can," Miller said. "It gives them the capability to affect a very serious breach of cyber security."

For the most part, the tactics used by the group to infiltrate networks are similar to those employed by other groups. The tactics have included SQL injection attacks, spear phishing, and water holing attacks using a combination of custom-designed and publicly available malware tools.

The 20-person group, which masquerades as a construction engineering firm in Tehran, has grown considerably in sophistication over the time that Cylance has been tracking it, Miller said. The increasing sophistication of its malware code and its obfuscation techniques prompted Cylance to go public with its findings.

John Hultquist, cyber espionage practice lead at iSight Partners, which reported this year on another Iranian cyberthreat dubbed Newscaster, shared Cylance's assessment of Operation Cleaver's success at infiltrating critical infrastructure networks. But he differed somewhat in his assessment of the group's technical sophistication.

He said that iSight has been tracking Operation Cleaver for some time, as well, but under another name. From what iSight been observed so far, Cleaver appears to be a modestly funded, modestly resourced group with average skills that has nonetheless had a lot of success compromising critical systems. Many of the tools used by the group are openly available, and the attack methods themselves have been fairly common.

What it has been good at is in lying low and carrying out most of its operations clandestinely, Hultquist said. "They have made headway into very sensitive areas where they can do a lot of damage. We do have some concerns that they are carrying out reconnaissance for a major attack."

Find out how vulnerable ICS and SCADA systems are in Infographic: 70 Percent of World's Critical Utilities Breached.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3154
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
CVE-2019-17190
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
CVE-2014-8161
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVE-2014-9481
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVE-2015-0241
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...