NCSC-TAD-2106-001
الرقم المرجعي: NCSC-TAD-2106-001CVSS 0
Agrius Employed Wipers Disguised as Ransomware
- نوع التهديد:
- غير متوفر
- مستوى المشاركة (TLP):
- CLEAR
- CVE:
- CVE-2018-13379
نظرة عامة
An Iranian threat group called Agrius hides behind ransomware to launch destructive wiper attacks against IT infrastructure targets. For initial access, the attackers exploit CVE-2018-13379 in FortiOS and various web-based vulnerabilities. The group uses Apostle and Deadwood malware for destructive activity and deploys a customized .NET backdoor called IPsec Helper to establish persistence and communicate with a command-and-control server.
إجراءات الحد من المخاطر والإجراءات الفورية
- 01
Immediately patch the vulnerability (CVEs 2018-13379).
- 02
If FortiOS is not used by your organization, add key artifact files used by FortiOS to your organization’s execution-deny list. Any attempts to install or run this program and its associated files should be prevented.
- 03
Regularly back up data, airgap and password/protect backup copies offline.
- 04
Implement network segmentation.
- 05
Require administrator credentials to install software.
- 06
Implement a recovery plan to restore sensitive or proprietary data from physically separate hard drive.
- 07
Install updates/patch operating systems, software, and firmware as soon as updates/patches are released.
- 08
Disable unused remote access.
- 09
Audit user accounts with administrative privileges.
- 10
Install and regularly update antivirus and anti-malware.
المراجع
- From Wiper to Ransomware: The Evolution of Agrius. (2021, May 25). Retrieved from SentinelLabs(يفتح في علامة تبويب جديدة)
- Iranian hacking group Agrius pretends to encrypt files for a ransom, destroys them instead. (2021, May 25). Retrieved from ZDNet(يفتح في علامة تبويب جديدة)
- New Iranian Group 'Agrius' Launches Destructive Cyberattacks on Israeli Targets. (2021, May 26). Retrieved from SecurityWeek(يفتح في علامة تبويب جديدة)
- Threat Actor 'Agrius' Emerges to Launch Wiper Attacks Against Israeli Targets. (2021, May 25). Retrieved from Threatpost English Global threatpostcom(يفتح في علامة تبويب جديدة)