Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks

Testo acquisito dalla fonte

Cybersecurity Advisory Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks Last Revised February 24, 2022 Alert Code AA22-055A Summary Actions to Take Today to Protect Against Malicious Activity * Search for indicators of compromise. * Use antivirus software. * Patch all systems. * Prioritize patching known exploited vulnerabilities . * Train users to recognize and report phishing attempts . * Use multi-factor authentication . Note: this advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework, version 10. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Cyber Command Cyber National Mission Force (CNMF), and the United Kingdom’s National Cyber Security Centre (NCSC-UK) have observed a group of Iranian government-sponsored advanced persistent threat (APT) actors, known as MuddyWater, conducting cyber espionage and other malicious cyber operations targeting a range of government and private-sector organizations across sectors—including telecommunications, defense, local government, and oil and natural gas—in Asia, Africa, Europe, and North America. Note: MuddyWater is also known as Earth Vetala, MERCURY, Static Kitten, Seedworm, and TEMP.Zagros. MuddyWater is a subordinate element within the Iranian Ministry of Intelligence and Security (MOIS).[ 1 ] This APT group has conducted broad cyber campaigns in support of MOIS objectives since approximately 2018. MuddyWater actors are positioned both to provide stolen data and accesses to the Iranian government and to share these with other malicious cyber actors. MuddyWater actors are