CISA Cybersecurity Alerts · N2K Networks

CISA Alert AA22-257A – Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Operations.

·3 min

The episode is a cybersecurity alert from CISA, released on September 14, 2022, with ID AA22-257A. It focuses on malicious activity by advanced persistent threat actors linked to Iran's Islamic Revolutionary Guard Corps. These actors are targeting entities across multiple U.S. critical infrastructure sectors, as well as organizations in Australia, Canada, and the United Kingdom. They often operate under the guise of two Iranian companies: Najee Technology Houshmand Fateh LLC in Karaj and Afkar System Yazd Company in Yazd. The authoring agencies assess that these actors exploit known vulnerabilities on unprotected networks rather than conducting targeted attacks against specific entities or sectors. Specifically, they scan for and exploit vulnerabilities in Fortinet FortiOS, Microsoft Exchange Server, Proxyshell, and Log4j to gain initial access. The alert documentation includes observed tactics, techniques, and indicators of compromise associated with this IRGC-affiliated APT. It urges organizations, especially critical infrastructure ones, to apply the mitigation recommendations listed in the alert. All organizations are advised to report incidents and anomalous activity to CISA's 24/7 Operations Center at [email protected] or 888-282-0870 and to the FBI via local field offices or the FBI's CyWatch. The episode is presented as a public service by N2K Networks, adapted from official government advisories. It serves as a timely warning for cybersecurity professionals to bolster defenses against these threats. The tone is formal and informational, typical of government alerts. No guest interviews or narrative elements are present; it is a direct reading of the advisory. The content emphasizes the broad targeting and specific technical methods used by the threat actors. It concludes with actionable steps for reporting and mitigation, making it a practical resource for incident response.

Listen to the show on

Apple Podcasts Spotify