Iranian Hackers Exploiting VPN Flaws to Backdoor Organizations Worldwide

Dubbed “Fox Kitten,” the cyber-espionage campaign is said
to have been directed at companies from the IT, telecommunication,
oil and gas, aviation, government, and security sectors.

“We estimate the campaign revealed in this report to be among
Iran’s most continuous and comprehensive campaigns revealed until
now,” ClearSky researchers said^[1].

“The revealed campaign was used as a reconnaissance
infrastructure; however, it can also be used as a platform for
spreading and activating destructive malware such as ZeroCleare and
Dustman.”

Tying the activities to threat groups APT33, APT34, and APT39, the
offensive — conducted using a mix of open source and self-developed
tools — also facilitated the groups to steal sensitive information
and employ supply-chain attacks to target additional organizations,
the researchers said.

Exploiting VPN Flaws to Compromise Enterprise Networks

The primary attack vector employed by the Iranian groups has been
the exploitation of unpatched VPN vulnerabilities to penetrate and
steal information from target companies. The prominent VPN systems
exploited this way included Pulse Secure Connect (CVE-2019-11510), Palo Alto Networks’ Global
Protect (CVE-2019-1579),
Fortinet FortiOS (CVE-2018-13379), and Citrix (CVE-2019-19781).

ClearSky noted that the hacking groups were able to successfully
acquire access to the targets’ core systems, drop additional
malware, and laterally spread across the network by exploiting
“1-day vulnerabilities in relatively short periods of time.”

Furthermore, the backdoor code in itself is downloaded in chunks
so as to avoid detection by antivirus software installed on the
infected computers. It’s the job of a separate downloaded file —
named “combine.bat” — to stitch together these individual files and
create an executable.

To perform these tasks and achieve persistence, the threat actors
exploited tools such as Juicy Potato and Invoke the Hash to
gain high-level privileges and laterally move across the network.
Some of the other tools developed by the attackers include:

• STSRCheck – A tool for mapping databases, servers, and open
  ports in the targeted network and brute-force them by logging with
  default credentials.
• Port.exe – A tool to scan predefined ports and servers.

Once the attackers gained lateral movement capabilities, the
attackers move to the final stage: execute the backdoor to scan the
compromised system for relevant information and exfiltrate the
files back to the attacker by establishing a remote desktop
connection (using a self-developed tool called POWSSHNET) or
opening a socket-based connection to a hardcoded IP address.

The Work of Multiple Iranian Hacking Groups

Based on the campaign’s use of web shells and overlaps with the
attack infrastructure, the ClearSky report highlighted that the
attacks against VPN servers are possibly linked to three Iranian
groups — APT33 (“Elfin”), APT34 (“OilRig”) and APT39 (Chafer).

What’s more, the researchers assessed that the campaign is a
result of a “cooperation between the groups in infrastructure,”
citing similarities in the tools and work methods across the three
groups.

Just last month, Iranian state-backed hackers — dubbed “Magnallium^[9]” — were discovered
carrying out password-spraying attacks targeting US electric
utilities as well as oil and gas firms.

Given that the attackers are weaponizing VPN flaws within 24
hours, it’s imperative that organizations install security patches
as and when they are available.

Aside from following the principle of least privilege, it also
goes without saying that critical systems are monitored
continuously and kept up to date. Implementing two-step
authentication can go a long way towards minimizing unauthorized
logins.

^{[2][3][4][5][6][7][8]}