NCSC-TAD-2307-001
الرقم المرجعي: NCSC-TAD-2307-001CVSS 0
Iran-linked APT TA453 targets Windows and macOS
- نوع التهديد:
- غير متوفر
- مستوى المشاركة (TLP):
- CLEAR
- CVE:
- غير متوفر
نظرة عامة
The Iranian APT “TA453”, that targets Middle East and US, sends a spear-phishing email that is disguised as a pleasant conversation starter and focuses on foreign policy. In addition, emails are sent requesting feedback on the project "Iran in the Global Security Context" as well as authorization to submit a draft for review. TA453 is a threat organization associated with Iran's Islamic Revolutionary Guard Corps (IRGC) that has been active at least since 2011. The researchers discovered that the TA453 was distributing a new infection chain intended for the deployment of a new PowerShell backdoor known as GorjolEcho by leveraging a range of cloud hosting providers. In addition, the threat actors first exchanged a benign email with the target recipient before sending a malicious link that leads to a Google Script macro. After the macro has been run, the recipient is taken to a Dropbox URL hosting a password-protected .rar file containing a dropper used to download additional stages from a cloud hosting service.
إجراءات الحد من المخاطر والإجراءات الفورية
- 01
Educate users on malware threats, train your users on techniques that can help them avoid social engineering schemes, such as phishing attacks, and report suspicious communication or system behavior to the security team.
- 02
Strong passwords and software updates, ensure all users create strong, unique passwords, and regularly change passwords. Use a password manager to make it easier for users to use and remember secure passwords. Update your systems as quickly, as security flaws become known and patches are released.
- 03
Back up your data and your test restore procedures, backup is a critical practice that can help to protect against data loss. It can help ensure that normal operations can be maintained even if the organization is attacked by network-based ransomware worms or other destructive cyber attacks.
- 04
Partition your network, you should use network segmentation to isolate important parts of your network from each other. This can significantly reduce the “blast radius” of successful attacks, because attackers will be limited to a specific network segment and cannot move laterally to other parts of the network.
- 05
Implement a layered security approach, including a secure email solution, a company-sanctioned file-sharing solution, and endpoint protection on user devices.
- 06
Continuously monitor network traffic.