Skip to main content
عربي
logo

NCSC-TAD-2211-003

Severity Level: Low
Threat

Reference No.: NCSC-TAD-2211-003CVSS 0

Emennet Pasarged Iranian Threat Group

Threat Type:
N/A
TLP:
CLEAR
CVE:
N/A

Overview

Emennet Pasarged (aka Eeleyanet Gostar) is a private Iranian threat group conducting hack-and-leak cyber operations against the United States, Israel, Europe, and the Middle East. The main purposes of their campaigns are to embarrass the victims and support the political aims of the Iranian government. The group is known for cybercrimes during the 2020 US presidential election, including hacking voting records, running disinformation campaigns, targeting government officials, sending threatening emails to intimidate voters, and impersonating The Proud Boys. Emennet Pasarged conducts hack-and-leak operations, social media manipulation, and false-flag activities using fake social media accounts, impersonated accounts, dedicated leak websites, Telegram channels, and online hacking forums. The group exploits known vulnerabilities in WordPress, Drupal, Apache Tomcat, CKEditor, FCKeditor (Roxy Fileman), PHP applications, phpMyAdmin, and utilizes tools such as SQLmap, Acunetix, DefenseCode Web Security Scanner, Wappalyzer, Dnsdumpster, TinyMCE Scanner, Netsparker, WPScan, and Shodan.

Affected Technologies

  • WordPress (revslider and layerslider plugins)
  • Drupal
  • Apache Tomcat
  • Ckeditor
  • FCKeditor (exploitation of Roxy Fileman)
  • Webpages running PHP code
  • MySQL databases (particularly phpMyAdmin)

Mitigation and Immediate Actions

  1. 01

    Ensure that all your systems have endpoint protection software installed and up to date.

  2. 02

    Regularly run vulnerability assessments on your internet facing systems.

  3. 03

    Regularly review your systems, especially internet facing systems, for misconfigurations.

  4. 04

    Make sure that accounts do not use the default password.

  5. 05

    Ensure that all server components are up to date.

  6. 06

    Ensure that the admin page is not accessible to the public.

  7. 07

    Ensure that directory traversal is not allowed.

  8. 08

    Ensure that services are running using service accounts. Never run services using administrator accounts.

  9. 09

    For WordPress: Make sure WordPress, plugins, and themes are up to date. Only install trustable WordPress plugins and themes.

  10. 10

    Ensure backup of important data.

References