DHS warns critical sectors about pro-Iranian cyberattacks

On Sunday, the American Department of Internal Security published a bulletin of the national system of terrorism consulting, following the current conflict with Iran.

Alert – intended for critical sectors, including health care – details how pro -Iranian hacktivists and threat actors sponsored by the state use malware to have access to networks and devices, including firewalls, Internet objects (IoT) and operational platforms.

Why it matters

After the Iranian government has publicly condemned direct participation in the United States in the conflict and promised reprisals of US air strikes during the weekend, DHS declared in the new threat notice that anti-Israeli feeling and the current Israeli-Iran conflict could contribute to American attacks by hacktivists and actors affiliated to the Iranian government.

These threat actors “regularly target poorly insured American networks and internet -connected devices for disturbing cyberattacks”, according to the new summary of the threat.

“Low-level cyber attacks against American networks by pro-Iranian hacktivists are likely, and cyber-actors affiliated to the Iranian government can carry out attacks on American networks,” said DHS.

During the publication, the bulletin is in force until September 22.

Jen Easterly, former director of Cybersecurity and Infrastructure Security Agency, advised organizations to “patcher each internet oriented active”, in a list of actions in an article on social networks on Sunday.

The biggest trend

In October, the American Hospitals Association warned against Iranian cyber-actors compromising health care infrastructure.

After accessing a system initial, they sell access to other threat actors, who put more sophisticated attacks, notably Ransomware, Scott Gee, AHA National Advisor for Cybersecurity and Risk, in the announcement of the organization.

“Hospitals should require the use of unique and complex passwords, which are changed regularly and use the multi-cost-effective phishing authentication to help defend themselves against these attacks,” Gee said.

He stressed that organizations should implement the objectives of voluntary performance of the voluntary cybersecurity of the Ministry of Health and Social Services as a “best first line of defense” against the actors of the threat to access the first access.

Then, in December, the CISA updated its opinion to all the critical sectors urging action to combat all operational technologies linked to the Internet after observing the tactics of cyberavgers of the Islamic group affiliated with the Islamic guard of Iran.

CISA, the FBI, national security agency, environmental protection agency, Israel National Cyber ​​Directorate, Canadian Center for Cybersecurity and the National Cybersecurity Center in the United Kingdom updated their opinion in 2023 on the threat.

The creation agencies observed threat stakeholders by supplanting existing scale logic files with their own devices to rename, reset software versions to old versions, deactivate the download and download functions and modification of default port numbers.

“With this type of access, access to devices and network levels are available and could make additional and deeper cyber-physical effects on processes and equipment,” they said in the alert.

Cyberav3ngers have been active since 2020, according to Miter, a non -profit organization that operates research and development centers funded by the federal government.

In 2023, the Cyberav3ngers would be responsible for a series of attacks on American water and wastewater installations which targeted programmable logical controllers with malware called iocontrol in the context of a wider cyber campaign against tactics and group procedures and techniques.

After having compromised the PLCs of the Unitronics Vision series from Israeli unity and human machinery interfaces, Cisa said that threat actors had left a message:

“You have been hacked, with Israel. Each equipment” manufactured in Israel “is the legal target of Cyberav3ngers”.

Thanks to its programs for justice awards, the US government offers a bonus of up to $ 10 million for information leading to the identification or location of actors in the threat of cyberav3ngers.

It should be noted that TelTonika, a telemedicine supplier and remote patient monitoring devices to detect cardiovascular disease, is appointed in the announcement of reward.

At the same time as

“The conflict could also motivate violent extremists and the authors of hatred crime seeking to attack the objectives perceived as Jews, pro-Israelis or linked to the American government or military of the fatherland,” said DHS in the bulletin.

Andrea Fox is editor -in -chief of Healthcare It News.
E-mail: [email protected]
Healthcare It News is a publication of the Himss media.