Skip to main content
عربي
logo

NCSC-TAD-2106-001

Severity Level: Critical
Ransomware

Reference No.: NCSC-TAD-2106-001CVSS 0

Agrius Employed Wipers Disguised as Ransomware

Threat Type:
N/A
TLP:
CLEAR
CVE:
CVE-2018-13379

Overview

An Iranian threat group called Agrius hides behind ransomware to launch destructive wiper attacks against IT infrastructure targets. For initial access, the attackers exploit CVE-2018-13379 in FortiOS and various web-based vulnerabilities. The group uses Apostle and Deadwood malware for destructive activity and deploys a customized .NET backdoor called IPsec Helper to establish persistence and communicate with a command-and-control server.

Mitigation and Immediate Actions

  1. 01

    Immediately patch the vulnerability (CVEs 2018-13379).

  2. 02

    If FortiOS is not used by your organization, add key artifact files used by FortiOS to your organization’s execution-deny list. Any attempts to install or run this program and its associated files should be prevented.

  3. 03

    Regularly back up data, airgap and password/protect backup copies offline.

  4. 04

    Implement network segmentation.

  5. 05

    Require administrator credentials to install software.

  6. 06

    Implement a recovery plan to restore sensitive or proprietary data from physically separate hard drive.

  7. 07

    Install updates/patch operating systems, software, and firmware as soon as updates/patches are released.

  8. 08

    Disable unused remote access.

  9. 09

    Audit user accounts with administrative privileges.

  10. 10

    Install and regularly update antivirus and anti-malware.

References