Iranian Attackers Continue Attacks: Agencies

This advisory comes on the heels of a Trend Micro report saying a cyber espionage group linked to Iran is targeting organizations in the energy sector, particularly those involved in oil and gas, as well as other critical infrastructure. The attack group – known as Earth Simnavaz, APT34 and OilRig – uses sophisticated tactics, techniques, and procedures (TTPs) to gain unauthorized access to networks and exfiltrate sensitive information, according to the report.

Brute Force
In this advisory, global security agencies said since October 2023, Iranian actors used brute force, such as password spraying, and multifactor authentication (MFA) ‘push bombing’ to compromise user accounts and obtain access to organizations.

The threat actors frequently modify MFA registrations, enabling persistent access. The actors performed discovery on the compromised networks to obtain additional credentials and identify other information that could gain additional points of access. The authoring agencies assess the Iranian actors sell this information on cybercriminal forums to actors who may use the information to conduct additional malicious activity.

The threat actors conduct reconnaissance operations to gather victim identity information. Once obtained, the attackers gain persistent access to victim networks frequently via brute force. After gaining access, attackers use a variety of techniques to further gather credentials, escalate privileges, and gain information about the entity’s systems and network. In addition, they also move laterally and download information that could assist other actors with access and exploitation.

The actors use valid user and group email accounts, frequently obtained via brute force such as password spraying to obtain initial access to Microsoft 365, Azure, and Citrix systems. In some cases where there was push notification-based MFA, the actors send MFA requests to legitimate users seeking acceptance of the request.

This technique – bombarding users with mobile phone push notifications until the user either approves the request by accident or stops the notifications – ends up called “MFA fatigue” or “push bombing.”

MFA Registration
Once the threat actors gain access to an account, they frequently register their devices with MFA to protect their access to the environment via the valid account:

• In two confirmed compromises, the actors leveraged a compromised user’s open registration for MFA to register the actor’s own device to access the environment.
• In another confirmed compromise, the actors used a self-service password reset (SSPR) tool associated with a public facing Active Directory Federation Service (ADFS) to reset the accounts with expired passwords and then registered MFA through Okta for compromised accounts without MFA already enabled.

Attackers frequently conduct their activity using a virtual private network (VPN) service. Several of the IP addresses in the actors’ malicious activity originate from exit nodes tied to the Private Internet Access VPN service.

In addition, attackers use Remote Desktop Protocol (RDP) for lateral movement. In one instance, the actors used Microsoft Word to open PowerShell to launch the RDP binary mstsc.exe.

The actors likely use open-source tools and methodologies to gather more credentials, according to the advisory. The actors performed Kerberos Service Principal Name (SPN) enumeration of several service accounts and received Kerberos tickets.

In one instance, the actors used the Active Directory (AD) Microsoft Graph Application Program Interface (API) PowerShell application likely to perform a directory dump of all AD accounts. Also, the actors imported the tool DomainPasswordSpray.ps1, which is openly available on GitHub, likely to conduct password spraying. The actors also used the command Cmdkey/list, likely to display usernames and credentials.

In one case, the actors attempted impersonation of the domain controller, likely by exploiting Microsoft’s Netlogon (also known as ”Zerologon”) privilege escalation vulnerability (CVE-2020-1472).

Furthermore, the attackers leverage living off the land (LOTL) to gain knowledge about the target systems and internal networks. The actors used the following Windows command-line tools to gather information about domain controllers, trusted domains, lists of domain administrators, and enterprise administrators.

To detect brute force activity, the authoring agencies recommend reviewing authentication logs for system and application login failures of valid accounts and looking for multiple, failed authentication attempts across all accounts.

Detecting Compromise
To detect the use of compromised credentials in combination with virtual infrastructure, the authoring agencies recommend the following steps:

• Look for “impossible logins,” such as suspicious logins with changing usernames, user agent strings, and IP address combinations or logins where IP addresses do not align to the user’s expected geographic location.
• Look for one IP used for multiple accounts, excluding expected logins.
• Look for “impossible travel.” Impossible travel occurs when a user logs in from multiple IP addresses with significant geographic distance (i.e., a person could not realistically travel between the geographic locations of the two IP addresses during the period between the logins).
• Look for MFA registrations with MFA in unexpected locales or from unfamiliar devices.
• Look for processes and program execution command-line arguments that may indicate credential dumping, especially attempts to access or copy the ntds.dit file from a domain controller.
• Look for suspicious privileged account use after resetting passwords or applying user account mitigations.
• Look for unusual activity in typically dormant accounts.
• Look for unusual user agent strings, such as strings not typically associated with normal user activity, which may indicate bot activity.

Mitigations
In terms of mitigations, organizations should implement the following to improve organizations’ cybersecurity posture:

• Review IT helpdesk password management related to initial passwords, password resets for user lockouts, and shared accounts. IT helpdesk password procedures may not align to company policy for user verification or password strength, creating a security gap. Avoid common passwords (e.g. “Spring2024” or “Password123!”).
• Disable user accounts and access to organizational resources for departing staff. Disabling accounts can minimize system exposure, removing options actors can leverage for entry into the system. Similarly, create new user accounts as close as possible to an employee’s start date.
• Implement phishing-resistant MFA. See CISA’s resources “Phishing-Resistant Multifactor Authentication” and “More than a Password” for additional information on strengthening user credentials.
• Continuously review MFA settings to ensure coverage over all active, Internet-facing protocols to ensure no exploitable services are exposed.
• Provide basic cybersecurity training to users covering concepts such as: Detecting unsuccessful login attempts; having users deny MFA requests they did not generate, and ensuring users with MFA-enabled accounts have MFA set up appropriately.
• Ensure password policies align with the latest NIST Digital Identity Guidelines.
• Disable the use of RC4 for Kerberos authentication.

“There’s nothing particularly groundbreaking from this alert as it follows a series of common patterns you could describe as ‘textbook APT,'” said John Terrill, CISO of Phosphorus Cybersecurity. “I think what’s interesting is how common MFA bypass has become. Push bombing or MFA fatigue was really only observed in account takeovers related to crypto accounts. This could be a natural progression of the actors’ TTPs but it could also signal an escalation which is why CISA felt necessary to publish this alert.”