Iran-Linked Hackers Deploy New Ransomware Against Israeli Organizations
A group linked to Iran is using new ransomware against a Middle Eastern adversary, researchers said.
A group linked to Iran is using new ransomware against a Middle Eastern adversary, researchers said.
The group calling itself Moneybird allegedly deployed the ransomware against Israeli organizations, CheckPoint's Incident Response Team investigated.
Researchers found that it resembled Agrius, a hacker group that has been around since 2020 and disguised itself with aliases like BlackShadow.
In late 2020, the group released ransomware on Shirbit, an Israeli insurance company. It also released wiper attacks on Bar-Ilan University in 2021.
Researchers at CheckPoint report that Moneybird is a new product for the group. Previous attacks were mostly carried out using ransomware known as Apostle.
Though the researchers didn't specify what types of organizations were targeted, they emphasized that the techniques used were Agrius-approved.
Threat actors gained entry via public-facing web servers and “unique variants of ASPXSPY” -- a malicious script hidden inside a “Certificate” text file.
It then moved laterally within networks, conducting reconnaissance and exfiltrating data. CheckPoint reports that the group uses "targeted paths," which allow the ransomware to disregard most files within targeted networks.
“Moneybird, like many other ransomwares, is a grim reminder of the importance of good network hygiene, as significant parts of the activity could have been prevented early on,” the researchers said.
According to Microsoft Threat Intelligence, the Iranian government is increasingly combining influence operations with cyberattacks.
Last year, they identified 24 "cyber-enabled operations" linked to the Iranian government, compared to seven the year before, and found a decline in the types of ransomware and wiper attacks Agrius usually employs.
"These activities are all the more worrying in the context of the continuing escalation of Iran's nuclear program", French foreign ministry spokesperson Anne-Claire Legendre told reporters at a daily briefing.
In response to Iran International, State Department spokesperson Matthew Miller said, “Despite restrictions on Iran’s missile-related activities under UN Security Council resolution 2231, Iran continues to seek a range of missile technologies from foreign suppliers and to conduct ballistic missile tests in defiance of the resolution.”
United Nations Security Council resolution 2231 was passed in 2015 to endorse the Iran nuclear deal -- the Joint Comprehensive Plan of Action (JCPOA), through which the Islamic Republic is obligated not to conduct “any activity” related to ballistic missiles capable of delivering nuclear weapons.However, the language of the resolution is ambiguous, leaving it open to interpretation.
Earlier in the day, Iran successfully test-launched the fourth generation of its Khorramshahr ballistic missile, called Kheibar, with a range of 2,000 kilometers (about 1242.74 miles).
Miller warned that "Iran’s development and proliferation of ballistic missiles poses a serious threat to regional and international security and remains a significant nonproliferation challenge."
Western officials say that although the launches go against 2231, they are not a violation of the core nuclear agreement between Iran, Britain, China, France, Germany, Russia and the United States.
Since the US has withdrawn from the deal, it reneged its right to dictate any course of action and European countries have only months to do anything because UN Security Council restrictions on missiles and related technologies last only until October 2023, after which time Iran is free to pursue its ballistic missile activity.
The US state department spokesperson, however, told Iran International that Washington "continues to use a variety of nonproliferation tools, including sanctions, to counter the further advancement of Iran’s ballistic missile program and its ability to proliferate missiles and related technology to others."
The United States, France, and the United Kingdom are also arguing that Russia and Iran are violating UN Security Council Resolution 2231 by Tehran sending military drones to Moscow. While US spokesman Vedant Patel said in December that he was “not going to get ahead of the UN internal deliberations,” there has been chatter for months that the US wants to restore UN sanctions against Iran under a ‘snapback’ procedure in the JCPOA.
The JCPOA lifted international sanctions against Iran in return for strict limits on the Iranian nuclear program. Under the terms of the JCPOA, the sanctions can ‘snapback’ if Iran violates the agreement.
"Iran's activities pose serious and increased non-proliferation risks without any credible civilian justification," the French spokeswoman said."We expect Iran to respect its international obligations ... and carry out concrete and tangible progress before the Board of Governors meeting," Legendre added.
Iran began breaching JCPOA limits such as enriching uranium to 60 percent rather than the permitted 3.67 percent, and by using more advanced centrifuges, in 2019, the year after former President Donald Trump withdrew the US from the 2015 agreement and imposed ‘maximum pressure’ sanctions.
Legendre's reference to the escalation of Iran's nuclear program comes just 10 days before the International Atomic Energy Agency's 35-nation Board of Governors meets in Vienna.
Ahead of the last board meeting in March, the IAEA and Iran said they had agreed to make progress on various issues, including a long-stalled IAEA inquiry into uranium particles found at three undeclared sites in Iran. They also agreed to re-install all extra monitoring equipment, such as surveillance cameras, at nuclear sites that was put in place under the JCPOA, but then removed last year as the deal unraveled following the US withdrawal in 2018.
