You're listening to the CyberWire Network, powered by N2K.

This is a CISA Cybersecurity Alert.

ID number Alpha Alpha 2-2-TAC 257 Alpha,

Original release date, September 14, 2022.

This joint Cybersecurity Advisory highlights continued malicious cyber activity by advanced

persistent threat actors affiliated with the Iranian government's Islamic Revolutionary

Guard Corps.

The IRGC affiliated actors are actively targeting a broad range of entities, including entities

across multiple U.S. critical infrastructure sectors, as well as Australian, Canadian, and United Kingdom organizations.

These actors often operate under the auspices of Naji Technology Hushman Fattir LLC,

based in Karaj, Iran, and Af-KAR System Yazd Company, based in Yazd, Iran.

The authoring agencies assess the actors are exploiting known vulnerabilities on unprotected networks

rather than targeting specific entities or sectors.

The authoring agencies have observed the cyber actor scanning for and exploiting known vulnerabilities

in Fortinette Fort IOS, Microsoft Exchange Server, proxy shell, and Log 4J to gain initial

access to a broad range of targeted entities.

This alert documentation listed in the show notes provides observed tactics, techniques, and

indicators of compromise that the authoring agencies assess are likely associated with this IRGC

affiliated APT.

The authoring agencies urge organizations, especially critical infrastructure organizations

to apply the recommendations listed in the mitigation section of the alert documentation to mitigate

risk of compromise from these IRGC affiliated cyber actors.

...