The attacks aimed to – steal and exfiltrate sensitive information as well as encrypt the data and hold it for a ransom.

critical infrastructure sectors, including the transportation sector, healthcare and public health sector, as well as several Australian organizations. Details of the various tactics, techniques, and procedures (TTPs) are described in US-CERT Alert (AA21-321A) – Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities.Īccording to the information available, these state-sponsored threat actors have targeted a broad range of victims across multiple U.S.

On November 17th, the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), the Federal Bureau of Investigation (FBI), the Australian Cyber Security Centre (ACSC), and the United Kingdom’s National Cyber Security Centre (NCSC) issued an alert to highlight ongoing malicious cyber activity by an advanced persistent threat (APT) group that FBI, CISA, ACSC, and NCSC assess is associated with the government of Iran. Author: Tomer Bar, Director of Security Research, SafeBreach

Filezilla malware 2021