NCSC-TAD-2309-001
Reference No.: NCSC-TAD-2309-001CVSS 0
An Iranian APT Behind Recent Password Spray Attacks
- Threat Type:
- N/A
- TLP:
- CLEAR
- CVE:
- CVE-2022-47966, CVE-2022-26134
Overview
Iran-linked APT33 (aka Peach Sandstorm) has conducted global password spray attacks since February 2023, primarily targeting organizations in the satellite, defense, and pharmaceutical sectors. The threat actor uses password spraying, exploitation of unpatched internet-facing applications, and open-source security frameworks for reconnaissance and data collection. After obtaining access, the group leverages tools including AnyDesk, Azure Arc, AzureHound, Roadtools, and the custom EagleRelay tunneling tool to gather information, maintain persistence, and move laterally within victim environments. The campaign also involved attempts to exploit CVE-2022-47966 in Zoho ManageEngine and CVE-2022-26134 in Atlassian Confluence. The primary objective is believed to be intelligence collection in support of Iranian state interests.
Affected Technologies
- Microsoft 365 / Office 365 accounts targeted through password spray attacks.
- Microsoft Entra ID (formerly Azure Active Directory).
- Azure Resource Manager.
- Zoho ManageEngine.
- Atlassian Confluence.
- Azure subscriptions and Azure resources.
- On-premises environments connected through Azure Arc.
Mitigation and Immediate Actions
- 01
Check and monitor your Office 365 Security and Compliance Center for any suspicious events.
- 02
Enforce password reset for all users. Please enforce a strong password policy as well.
- 03
Ensure that your entity is using MFA for all logins. MFA using number matching is recommended to improve the sign-in security.
- 04
Disable Legacy Authentication for all users on your environment, this type of authentication could allow attackers to bypass MFA authentication.
- 05
Remove any inactive/old accounts from your Active Directory.