Iranian hacking group targets Israel with wiper disguised as ransomware
By
11:00 AM
An Iranian hacking group has been observed camouflaging destructive attacks against Israeli targets as ransomware attacks while maintaining access to victims networks for months in what looks like an extensive espionage campaign.
The threat actor, tracked as
Agrius by SentinelLabs researchers, has targeted Israel starting with December 2020. Initially engaged in espionage activity, Agrius deployed a set of destructive wiper attacks against Israeli targets, masquerading the activity as ransomware attacks, said Amitai Ben Shushan Ehrlich, Threat Intelligence Researcher at SentinelOne.
From wiper to fully functional ransomware
At first, the group deployed a wiper malware known as DEADWOOD (or Detbosit) designed to destroy data on infected devices and previously used in attacks against Saudi Arabian targets in 2019.
Get Permission
Iran s Islamic Revolutionary Guard Corps was behind a ransomware campaign that used a contracting company called Emen Net Pasargard, or ENP, to target over a dozen organizations, according to three leaked intelligence documents assessed by the security firm Flashpoint.
Based on its analysis of documents leaked by the Iranian dissident group “Lab Dookhtegan,” Flashpoint says this ENP attack campaign, dubbed Project Signal, began with research conducted between July and September 2020. A leaked internal ENP spreadsheet showed that during this time, the group was researching three to four websites per day, and that at the time the spreadsheet was written, around 20 sites had been reviewed and analyzed by ENP’s internal research organization, the Studies Center, the report notes.
What’s new? The 2015 Iran nuclear deal has looked at best shaky since the Trump administration withdrew from it in 2018, imposing damaging economic sanctions on the Islamic Republic. In response, Tehran ramped up its nuclear activity in contravention of its obligations under the agreement. President-elect Joe Biden’s inauguration could mark an inflection point.
Why does it matter? Having failed to achieve its objectives, Trump’s “maximum pressure” strategy may be nearing an end. Restoring the nuclear deal, with its considerable non-proliferation benefits, could lead to wider U.S.-Iran diplomatic engagement. But one or both sides may be tempted to make additional demands, which would be a recipe for deadlock.
Iranian hackers aim to sow panic in Israel - report
Israeli company ClearSky Cyber Security has traced recent attacks on Israeli companies to a known Iranian hacker group.
Have the hackers who attacked software company Amital and Intel s AI chips company Habana Labs last week been exposed? A report by Israeli company ClearSky Cyber Security Ltd. confirms the news reports of the past few days that behind the group that publicly claimed responsibility for these two attacks, called Pay2Kitten, are the Iranians.
In the past two weeks, the high-profile cyber attacks have taken place in Israel. It started with a break-in at insurance company Shirbit by a group calling itself BlackShadow. Then came an attack that was thwarted on the servers of Amital Data, an attack that also hit dozens of Amital s customers, followed by the attack on Habana Labs.