38.2 F
Washington D.C.
Thursday, February 29, 2024

CISA Warns Wide Range of Industries to Get Ready for Potential Iran Cyberattacks

The cybersecurity community from energy to healthcare should prepare for a virtual strike from Iran by taking several technical actions “that will likely have the highest return on investment,” the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency said in a Monday alert.

Iran’s supreme leader, Ayatollah Ali Khameni, reportedly wants an attack to avenge the targeted killing of IRGC Quds Force commander Qassem Soleimani to be directly carried out by Iran instead of proxies, to be openly claimed and to be targeted at U.S. interests, according to a New York Times report.

That could include cyber attacks in addition to or instead of physical attacks. The CISA notice cites “Iran’s historic use of cyber offensive activities to retaliate against perceived harm,” and urges entities to adopt a state of heightened awareness, increase organizational vigilance, confirm reporting processes and exercise organizational incident response plans.

“Iranian cyber threat actors have continuously improved their offensive cyber capabilities,” said CISA. “They continue to engage in more ‘conventional’ activities ranging from website defacement, distributed denial of service (DDoS) attacks, and theft of personally identifiable information (PII), but they have also demonstrated a willingness to push the boundaries of their activities, which include destructive wiper malware and, potentially, cyber-enabled kinetic attacks.”

A cyber attack could have special symbolism for avenging an IRGC leader’s death, as “the U.S. intelligence community and various private sector threat intelligence organizations have identified the Islamic Revolutionary Guard Corps (IRGC) as a driving force behind Iranian state-sponsored cyberattacks – either through contractors in the Iranian private sector or by the IRGC itself.”

In the past, various industries have been targeted by Iran cyber operations “including financial services, energy, government facilities, chemical, healthcare, critical manufacturing, communications, and the defense industrial base.” CISA noted the 2011-13 DDoS attack targeting the financial sector, the 2013 access attack on the Bowman Dam in Rye, N.Y., the hacking of Sands Las Vegas in February 2014, and the 2013-17 cyber theft campaign that hit 144 U.S. universities, 47 domestic and foreign private-sector companies, and multiple government agencies.

CISA recommended that entities focus on vulnerability mitigation and incident preparation to improve cyber posture. Steps include disabling all unnecessary ports and protocols, enhancing monitoring of network and email traffic, patching externally facing equipment, limiting usage of PowerShell, and ensuring backups are up to date.

The guidance also breaks down mitigations and detection recommendations for publicly known Iranian advanced persistent threat techniques: credential dumping, obfuscated files or information, data compressed, PowerShell, user execution, scripting, registry run keys/startup folder, remote file copy, spearphishing link, and spearphishing attachment.

Even with security enhancements, users should be “trained to identify social engineering techniques and spearphishing emails” with malicious links and attachments.

CISA encourages reporting any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams, at http://www.us-cert.gov/.

DHS to Businesses: ‘Are You Attractive to Iran’ as a Target and Prepared for Terror?

Bridget Johnson
Bridget Johnson
Bridget Johnson is the Managing Editor for Homeland Security Today. A veteran journalist whose news articles and analyses have run in dozens of news outlets across the globe, Bridget first came to Washington to be online editor and a foreign policy writer at The Hill. Previously she was an editorial board member at the Rocky Mountain News and syndicated nation/world news columnist at the Los Angeles Daily News. Bridget is a terrorism analyst and security consultant with a specialty in online open-source extremist propaganda, incitement, recruitment, and training. She hosts and presents in Homeland Security Today law enforcement training webinars studying a range of counterterrorism topics including conspiracy theory extremism, complex coordinated attacks, critical infrastructure attacks, arson terrorism, drone and venue threats, antisemitism and white supremacists, anti-government extremism, and WMD threats. She is a Senior Risk Analyst for Gate 15 and a private investigator. Bridget is an NPR on-air contributor and has contributed to USA Today, The Wall Street Journal, New York Observer, National Review Online, Politico, New York Daily News, The Jerusalem Post, The Hill, Washington Times, RealClearWorld and more, and has myriad television and radio credits including Al-Jazeera, BBC and SiriusXM.

Related Articles

- Advertisement -

Latest Articles