Cyberwar Bulletin: Iran and Albania

As the world still reels under the impact of the Ukraine-Russia cyberwar, yet another Cyberwar has started between Iran and Albania.

Cybersecurity is today a serious threat. Critical infrastructure, government establishments, public sector companies, and policymakers are all repeatedly targeted by groups affiliated with nation-states. While a cyber war spawns disastrous consequences for the parties involved, the aftermath may lead to disrupting the business functions of those indirectly involved as well. In rare circumstances, unrelated organizations bear the brunt of mass, random rampages undertaken by organized cybercrime operators.

Iran-Albania Cyberwar Impact

The consequences of the recent Iran-Albania cyberwar started off with critical government service outages like the embassy portal and national websites. It soon spiraled into a full-blown diplomatic incident, cutting ties between the nations and prompting the USA to impose sanctions on Iran. Following this incident, a joint advisory was issued by cybersecurity bigwigs FBI, CISA, NSA, and the US Cyber Command, warning against Iranian threat actors.

Here is what the Prime Minister of Albania had to say about cutting off diplomatic ties with Iran:

In the wake of the Iran-Albania cyberwar and the scare of further retaliation, Securin experts provide insights into Iranian threats that organizations need to watch out for.

Attack Timeline

Firstly, let us look into a timeline of events that triggered the cyber war. The start of this war appears to go way back to 2014, when Albania gave shelter to an Iranian dissident group. More recently, the dissidents were supposedly involved in cyber attacks on the Iranian capital. The current war, however, escalated with Iran’s attempts to thwart the networks of Albania.

APT Groups that have played a role

Research suggests that the successful series of attacks on Albania is the handiwork of a cluster of APT groups, all originating from Iran. The attackers gained entry into networks via CVE-2019-0604, a SharePoint Server vulnerability, through which they exploited a misconfigured service account, and then went on to deploy ransomware, followed by wiper malware. The attackers were persistent in the compromised networks for months together, starting from October 2021 till May 2022, before launching full-fledged attacks.

Here are the APT groups deemed responsible:

DEV-0133 / Lyceum (probing victim infrastructure)
DEV-0861 (initial access and data exfiltration)
DEV-0166 / IntrudingDivisor (data exfiltration)
DEV-0842 (deploying the ransomware and wiper malware)

DEV-0861 and DEV-0166 are believed to be linked to the OilRig group, also known by popular aliases like APT34, Charming Kitten and Phosphorus. The group has been around since 2011 and is known to target global companies of strategic importance to countries that are contrary to Iranian interests, and Energy-, Financial-, Government-, and Healthcare-related organizations, amongst others, in over 50 target countries.

Products that put you at risk

If you are a user of any of the below-mentioned products, upgrade to their latest versions without further delay. Specific versions of these products are associated with vulnerabilities connected to Iranian APT threats, amounting to 225 different product versions overall. Organizations with unpatched vulnerabilities are exposed to a high risk of compromise and continued persistence of threat actors in their network.

Vulnerabilities Exploited by Iranian Threat Groups

Securin researchers have collated a list of 28 vulnerabilities that have either previously been exploited by known Iranian APT groups, or were called out in the FBI advisory. With a high possibility of Iranian threat actors retaliating to the imposed sanctions, organizations are warned to check for exposures to these vulnerabilities and patch them before it is too late.

A notable call-out is CVE-2014-4114. Although an 8-year-old vulnerability, it has been previously exploited by four APT groups, and the Petya ransomware gang. It is of critical severity and is also featured in the CISA KEV. This could well turn out to be a dark horse in this war, considering the vulnerability’s age.

We had also warned of these vulnerabilities in our Threat Intelligence blog (Sep 15, 2022) in light of the advisory released against Iranian threats. To receive such warnings informing of trending threats, sign up for our Weekly Threat Intelligence Newsletter.

The table below details the vulnerabilities, the products they exist in, mitigations, and highlights the early warnings provided by Securin regarding the danger these vulnerabilities pose.

Of the 28 vulnerabilities, 22 are already listed on the CISA KEVs. However, we would like to call out six vulnerabilities that are yet to make it to the list. We urge CISA to add these vulnerabilities to their catalog for organizations to take notice.

Vulnerability	CVSS Severity	Threat Actor Associations
CVE-2021-31196	High	Under Research
CVE-2021-31206	High	AvosLocker Ransomware
CVE-2021-33768	High	Under Research
CVE-2021-34470	High	Under research
CVE-2021-45046	Critical	MuddyWater, DEV-0270, and OilRig APT groups
CVE-2021-45105	Medium	Under Research

Indicators of Compromise

If you are worried about your networks being infiltrated by the Iranian threat groups, you can use the IoCs listed below to check for signs of intrusion in your network.

Have cyberwars now become a precursor to physical wars?

At the same time as the Iran-Albania war, a digital war has been looming in the western Balkan nations. A massive, coordinated cyberattack against Montenegro was launched by the Cuba ransomware group, a part of the Hive ransomware family. Public institutions from Kosovo were targeted in a largely unsuccessful cyber attack as well. The website of the Ministry of Education and Science in North Macedonia was hit as a result of yet another cyberattack.

Seven months ago, the Russia-Ukraine war began with back-and-forth cyber attacks by the two countries, which then turned into a full-blown physical war that is still going on. Are cyber wars soon becoming the first arsenal to be fired when two nations are up against each other? A cyber war could cripple critical entities, disarming the opposition of its primary weaponry in the event of a war.

Here are some measures we recommend that organizations adopt to catch such issues early on and secure their networks from cyber attackers.

Continuously identify exposures in attack surfaces that could allow for a network compromise – including unpatched vulnerabilities, misconfigurations, and exposed ports.
Prioritize the vulnerabilities with a higher threat context first – these could be due to associations with ransomware or APT groups, or ones with a high likelihood of exploitation or impact potential.
Sign up for continuous pentesting or red teaming exercises to know the reality of your exposures and rid your network of the lapses that allow attackers to establish a strong foothold in your network.