iran
Ex-NSA Chief Urges Disconnecting Water Controllers from Internet
Following suspected cyberattacks on water systems across at least 12 US states, likely perpetrated by Iran, a former NSA chief has strongly advised that industrial control systems like programmable logic controllers (PLCs) should not be connected to the internet. He emphasized the need for higher cybersecurity standards to defend these critical infrastructure components, noting that Iranian actors have a history and capability for such attacks.
Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks
An Iran-linked threat actor is using an adaptable modular command-and-control framework in cyberattacks. It compromised IT service providers to reach high-value targets primarily in Israel.
Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
A new modular command-and-control framework, dubbed 'Cavern Manticore,' has been observed in the wild, attributed to an Iran-nexus threat actor targeting Israeli government and IT sectors. The framework utilizes a .NET foundation but employs diverse compilation formats to evade analysis. Attackers gain initial access by exploiting legitimate software deployment features, such as RMM tools, to infiltrate victim environments.
Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool
A threat group linked to Iran, known as TAG-182, is actively distributing a surveillance tool called MarkiRAT. This malware is being spread through fake applications disguised as VPNs and download tools, primarily targeting Iranian citizens both within and outside the country. The operations appear to be conducted via social media platforms and are likely part of Iran's intensified cyber surveillance efforts.