Iran-backed hackers exploiting Microsoft, Fortinet bugs


San Francisco, Nov 18 (IANS): Federal cyber agencies across the US, the UK and Australia have warned that the Iranian government-sponsored hackers are exploiting several vulnerabilities in Microsoft Exchange email server and cyber security company Fortinet to perform malicious activities, which include deploying ransomware.

In an advisory, The US Cybersecurity and Infrastructure Security Agency (CISA) said that they have highlighted the ongoing malicious cyber activity by an advanced persistent threat (APT) group associated with the government of Iran.

"The Federal Bureau of Investigation (FBI) and CISA have observed this Iranian government-sponsored APT exploit Fortinet and Microsoft Exchange ProxyShell vulnerabilities to gain initial access to systems in advance of follow-on operations, which include deploying ransomware," the CISA said in a statement late on Wednesday.

By breaking into systems through Fortinet vulnerabilities, cybercriminals can "conduct data exfiltration, data encryption, or other malicious activity."

The CISA, the FBI, the Australian Cyber Security Centre (ACSC), and the UK's National Cyber Security Centre (NCSC) have released the joint cybersecurity advisory.

"ACSC is also aware this APT group has used the same Microsoft Exchange vulnerability in Australia," it read.

The Iranian government-sponsored APT group has exploited Fortinet vulnerabilities since at least March 2021 and a Microsoft Exchange ProxyShell vulnerability since at least October 2021.

The APT actors are actively targeting a broad range of victims across multiple US critical infrastructure sectors, including the transportation sector and the healthcare and public health sector, as well as Australian organisations.

"These Iranian government-sponsored APT actors can leverage this access for follow-on operations, such as data exfiltration or encryption, ransomware, and extortion," the advisory read.

In April this year, the FBI and CISA issued warnings about the vulnerabilities in Fortinet gear being actively exploited.

Microsoft on Wednesday issued its own warning of six Iranian groups using vulnerabilities in the same pair of products to deploy ransomware.

 

  

Top Stories


Leave a Comment

Title: Iran-backed hackers exploiting Microsoft, Fortinet bugs



You have 2000 characters left.

Disclaimer:

Please write your correct name and email address. Kindly do not post any personal, abusive, defamatory, infringing, obscene, indecent, discriminatory or unlawful or similar comments. Daijiworld.com will not be responsible for any defamatory message posted under this article.

Please note that sending false messages to insult, defame, intimidate, mislead or deceive people or to intentionally cause public disorder is punishable under law. It is obligatory on Daijiworld to provide the IP address and other details of senders of such comments, to the authority concerned upon request.

Hence, sending offensive comments using daijiworld will be purely at your own risk, and in no way will Daijiworld.com be held responsible.