
Andy Greenberg is a WIRED security writer and author of the forthcoming book, Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers.
Some signs suggest the new targeting campaign is indeed a cyberespionage operation, an expected step from Iran given the rising saber-rattling between its government and that of the US—amidst Iran's claim to have downed a US drone that breached its airspace , and the Trump administration issuing warnings that it may retaliate. But the researchers also note that APT33 has links to data-destroying malware, and warn that the intrusion attempts could be the first step in that sort of more aggressive cyberwar operation.FireEye has previously warned that while APT33 has in prior operations largely focused on traditional spying, it has also at times appeared to have destructive tools in its arsenal. In 2017, FireEye reported that APT33 infected some victims with "dropper" malware that had in other attacks been used to plant a piece of data-destroying code known as ShapeShift. Crowdstrike, too, says it has seen APT33's fingerprints appear in some intrusions where another piece of destructive malware known as Shamoon had been used, a wiper tool tied to a collection of sometimes-devastating Iranian sabotage campaigns across the Middle East.In at least some of last week's intrusion attempts, the hackers sent potential victims an email lure posing as a job opening from the Council of Economic Advisors, an organization within the White House's Executive Office of the President. The email contained a link that, if clicked, opened a so-called HTML application or HTA. That in turn launched a Visual Basic script on the victim's machine that installed a malware payload known as Powerton, a kind of all-purpose remote access trojan. That Powerton malware, the HTA trick, and the job lure all fit the modus operandi of APT33, which in previous operations has used those techniques against oil and gas targets around the Persian Gulf region. Dragos also notes that the naming conventions for domains used in the phishing attacks' infrastructure match those earlier attacks.The web page used as a lure for victims as part of a recent phishing campaign launched by APT33 hackers.
Dragos/CrowdStrikeJohn Hultquist, FireEyeWhatever its current intentions, Iran has a long history of disruptive and destructive cyberattacks on American targets and US allies. After the Stuxnet malware was revealed in the summer of 2012 to be a joint US-Israeli operation aimed at sabotaging an Iranian nuclear enrichment facility, Iranian hackers launched an unprecedented attack on Saudi Aramco, using the Shamoon wiper malware to destroy 30,000 computers, leaving an image on their screens of a burning American flag. The next month it launched a series of sustained distributed denial of service attacks hitting the websites of almost every major US bank, and in 2014 launched another data-destroying attack on the Las Vegas Sands Casino, after the casino's owner Sheldon Adelson publicly suggested the US launch a nuclear weapon against Iran.But after the Obama Administration signed an agreement with Iran that lifted many of the sanctions against the country in exchange for Iran's promise to halt its nuclear development, those attacks against the West largely ceased, though they continued against some Middle Eastern targets. When Trump scrapped that agreement last year, however, cybersecurity experts warned that Iran would likely restart its destructive hacking operations against the West. In December of 2018, another Shamoon attack hit the network of Italian oil firm Saipem , whose largest customer is Saudi Aramco, though that attack wasn't clearly attributed to Iran.The latest phishing campaign, in the context of the heated military rhetoric from both Iran and the US, raises fears again that the lull in Iran's cyberattacks on the West may be over. "The gloves may already be off," says FireEye's John Hultquist. "We’re probably headed for a place very, very soon, where the days of aggressive Iranian activity are likely to return. If we’re trading blows with them in the Gulf, i don’t see them holding back.""The gloves may already be off."
- Jigsaw bought a Russian troll campaign as an experiment
- You could live forever with this sci-fi time hack
- A very fast spin through the hills in a hybrid Porsche 911
- A search for San Francisco's lost authenticity
- The quest to make a bot that can smell as well as a dog
- 💻 Upgrade your work game with our Gear team’s favorite laptops , keyboards , typing alternatives , and noise-canceling headphones
- 📩 Want more? Sign up for our daily newsletter and never miss our latest and greatest stories