NCSC-TAD-2505-001
الرقم المرجعي: NCSC-TAD-2505-001CVSS 0
FortiGuard Incident Response Team Detects Intrusion into Middle East Critical National Infrastructure
- نوع التهديد:
- غير متوفر
- مستوى المشاركة (TLP):
- CLEAR
- CVE:
- غير متوفر
نظرة عامة
A cyber intrusion targeting Critical Infrastructure in the Middle East continued through February 2025. Attackers used stolen VPN credentials, web shells, and backdoors, including Havoc, HanifNet, HXLibrary, and NeoExpressRAT, to maintain access and bypass network segmentation. After containment, they attempted to regain access by exploiting vulnerable applications and conducting targeted phishing attacks.
إجراءات الحد من المخاطر والإجراءات الفورية
- 01
Require MFA for VPN and privileged accounts; rotate credentials.
- 02
Strengthen segmentation and layered access controls.
- 03
Regularly check internet-facing services for unauthorized changes and allow only approved applications to run.
- 04
Use EDR and behavior monitoring to detect suspicious activity.