San Francisco, November 18th : .Federal cyber agencies in the US, UK, and Australia warned that Iranian-sponsored hackers exploited several weaknesses in Microsoft Exchange and Fortinet cyber security companies to carry out malicious activities.US Cybersecurity and Infrastructure Security Agency, (CISA), stated in an advisory that they had highlighted ongoing malicious cyber activities by an advanced persistent Threat (APT) group affiliated with the Iranian government.
CISA released a statement on Wednesday late night stating that the Federal Bureau of Investigation and CISA had observed an Iranian-sponsored APT exploit Fortinet vulnerabilities and Microsoft Exchange ProxyShell vulnerability to gain access to initial systems before proceeding to follow-on operations.
Cybercriminals have the ability to hack into Fortinet systems and “conduct malicious activity such as data exfiltration or encryption” by “breaking into them through Fortinet weaknesses.”
CISA, FBI, Australian Cyber Security Centre, (ACSC) and UK’s National Cyber Security Centre, (NCSC), have published the joint cybersecurity advisory.
It stated that the APT group had used the Microsoft Exchange vulnerability in Australia to which “ACSC” was also alert.
Iranian government-sponsored APT groups have exploited Fortinet vulnerabilities at minimum March 2021, and Microsoft Exchange ProxyShell vulnerabilities at least October 2021.
APT actors actively target a wide range of victims in multiple US critical infrastructure sector sectors including transportation, healthcare, and public health, and Australian organizations.
The advisory stated that “these Iranian-sponsored APT actors could leverage this access to carry out follow-on operations such as ransomware or data exfiltration, encryption, and extortion.”
CISA and the FBI issued warnings in April about vulnerabilities found in Fortinet gear that were being actively exploited.
Microsoft issued Wednesday its own warning about six Iranian organizations using vulnerability in the same products to distribute ransomware.
na/dpb #Iranbacked #hackers #Microsoft #Fortinet #bugs
