Iran-affiliated advanced persistent threat (APT) actors are conducting exploitation activity targeting internet-facing operational technology (OT) devices, including programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley. This activity has led to PLC disruptions across several U.S. critical infrastructure sectors through malicious interactions with the project file and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.

U.S. organizations should urgently review the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) in this advisory for indications of current or historical activity on their networks, and apply the recommendations listed in the Mitigations section of the advisory to reduce the risk of compromise.

Source: CISA

IC News delivers the situational awareness you need to get ahead and stay ahead in the IC contracting space. Subscribe today for full access to 10,000+ articles, plus new articles each weekday.

The post CISA warns of programmable logic controller exploitation appeared first on Intelligence Community News.

Despite a declared ceasefire and ongoing negotiations towards a permanent solution, Iranian Islamic Revolutionary Guard Corps (IRGC)-affiliated cyber actors—including hacktivists and Iranian government-affiliated actors—may target U.S. devices and networks for near-term cyber operations. These actors have historically targeted poorly secured U.S. networks and internet-connected devices for disruptive cyberattacks, often exploiting targets of opportunity, outdated software, and the use of default or common passwords on internet-connected accounts and devices.

Due to recent events, Iranian state-sponsored or affiliated threat actors are likely to significantly increase their Distributed Denial of Service (DDoS) campaigns, and potentially also conduct ransomware attacks. The authoring agencies urge organizations, especially those within U.S. critical infrastructure, to remain vigilant for the outlined potential targeted malicious cyber activity.

The CSI outlines the actors commonly used techniques and provides several examples of their previous cyber campaigns. Organizations should review this information to become familiar with the tactics utilized by these malicious cyber actors.

Critical infrastructure asset owners and operators should review this guidance to assess their cybersecurity weaknesses and update incident response plans. Further, the CSI provides detailed mitigations for at-risk organizations to implement to harden their cyber defenses against malicious actors.

Read the full report here.

Source: NSA

Like IC News? Then please consider subscribing. You’ll get full access to our searchable library of 10,000+ articles, plus new articles each weekday.

The post Iranian cyber actors could target US networks, according to NSA appeared first on Intelligence Community News.

“CIA can confirm that a body of credible intelligence indicates Iran’s nuclear program has been severely damaged by the recent, targeted strikes. This includes new intelligence from a historically reliable and accurate source/method that several key Iranian nuclear facilities were destroyed and would have to be rebuilt over the course of years.

CIA continues to collect additional reliably sourced information to keep appropriate decision-makers and oversight bodies fully informed. When possible, we will also provide updates and information to the American public, given the national importance of this matter and in every attempt to provide transparency.”

Source: CIA

IC News delivers the situational awareness you need to get ahead and stay ahead in the IC contracting space. Subscribe today for full access to 10,000+ articles, plus new articles each weekday.

The post CIA director issues statement on Iran appeared first on Intelligence Community News.

Since October 2023, Iranian cyber actors have used a technique known as brute force to compromise user accounts and obtain access to organizations to modify MFA registrations, enabling persistent access.

“Our agencies are sharing detailed insight into this malicious cyber activity and what organizations can do to shore up their defenses,” said Dave Luber, NSA Cybersecurity Director. “We explain the tactics, techniques, and procedures used by the Iranian actors, as well as indicators of compromise.”

Once they have access, the Iranian actors obtain additional credentials and sell the information to users on cybercriminal forums who conduct further malicious activities. The Iranian actors have targeted multiple critical infrastructure sectors, including healthcare, government, information technology, engineering, and energy.

To detect brute force activity such as password spraying, the report’s authors recommend reviewing authentication logs for system and application login failures of valid accounts and looking for multiple, failed authentication attempts across all the accounts.  To mitigate against this activity, the CSA recommends measures such as implementing phishing-resistant multi factor authentication (MFA), continuously reviewing MFA settings, providing cybersecurity training to users, and ensuring password policies meet minimum password strength guidelines.

The other authoring agencies are the Communications Security Establishment Canada (CSE), the Australian Federal Police (AFP), and the Australian Signals Directorate Australian Cyber Security Centre (ASD ACSC).

Read the full report here.

Source: NSA

IC News delivers the situational awareness you need to get ahead and stay ahead in the IC contracting space. Subscribe today for full access to 10,000+ articles, plus new articles each weekday.

The post NSA issues warning of Iranian brute force cyber attacks appeared first on Intelligence Community News.

“Since the 19 August 2024 joint ODNI, FBI, and CISA public statement on Iranian Election Influence Efforts, the FBI has learned additional details about Iran’s efforts to sow discord and shape the outcome of U.S. elections.”

“Iranian malicious cyber actors in late June and early July sent unsolicited emails to individuals then associated with President Biden’s campaign that contained an excerpt taken from stolen, non-public material from former President Trump’s campaign as text in the emails. There is currently no information indicating those recipients replied. Furthermore, Iranian malicious cyber actors have continued their efforts since June to send stolen, non-public material associated with former President Trump’s campaign to U.S. media organizations.”

“This malicious cyber activity is the latest example of Iran’s multi-pronged approach, as noted in the joint August statement, to stoke discord and undermine confidence in our electoral process. As the lead for threat response, the FBI has been tracking this activity, has been in contact with the victims, and will continue to investigate and gather information in order to pursue and disrupt the threat actors responsible. Foreign actors are increasing their election influence activities as we approach November. In particular, Russia, Iran, and China are trying by some measure to exacerbate divisions in U.S. society for their own benefit, and see election periods as moments of vulnerability. Efforts by these, or other foreign actors, to undermine our democratic institutions are a direct threat to the U.S. and will not be tolerated.”

The FBI and CISA encourage campaigns and election infrastructure stakeholders to report information concerning suspicious or criminal activity to their local Election Crimes Coordinators via FBI field office, by calling 1-800-CALL-FBI (1-800-225-5324), or online at https://www.ic3.gov.

Source: ODNI

Stay in the know with breaking news from across the IC and IC contracting landscape by becoming a paid subscriber to IC News. Your support makes our work possible.

The post ODNI issues statement on Iran’s malicious cyber efforts to affect US elections appeared first on Intelligence Community News.

“As each of us has indicated in prior public statements, Iran seeks to stoke discord and undermine confidence in our democratic institutions. Iran has furthermore demonstrated a longstanding interest in exploiting societal tensions through various means, including through the use of cyber operations to attempt to gain access to sensitive information related to U.S. elections. In addition to these sustained efforts to complicate the ability of any U.S. administration to pursue a foreign policy at odds with Iran’s interests, the IC has previously reported that Iran perceives this year’s elections to be particularly consequential in terms of the impact they could have on its national security interests, increasing Tehran’s inclination to try to shape the outcome. We have observed increasingly aggressive Iranian activity during this election cycle, specifically involving influence operations targeting the American public and cyber operations targeting Presidential campaigns.

This includes the recently reported activities to compromise former President Trump’s campaign, which the IC attributes to Iran. The IC is confident that the Iranians have through social engineering and other efforts sought access to individuals with direct access to the Presidential campaigns of both political parties. Such activity, including thefts and disclosures, are intended to influence the U.S. election process. It is important to note that this approach is not new. Iran and Russia have employed these tactics not only in the United States during this and prior federal election cycles but also in other countries around the world.

Protecting the integrity of our elections from foreign influence or interference is our priority. As the lead for threat response, the FBI has been tracking this activity, has been in contact with the victims, and will continue to investigate and gather information in order to pursue and disrupt the threat actors responsible. We will not tolerate foreign efforts to influence or interfere with our elections, including the targeting of American political campaigns. As an interagency we are working closely with our public and private sector partners to share information, bolster security, and identify and disrupt any threats. Just as this activity demonstrates the Iranians’ increased intent to exploit our online platforms in support of their objectives, it also demonstrates the need to increase the resilience of those platforms. Using strong passwords and only official email accounts for official business, updating software, avoiding clicking on links or opening attachments from suspicious emails before confirming their authenticity with the sender, and turning on multi-factor authentication will drastically improve online security and safety.”

Source: ODNI

Your competitors read IC News each day. Shouldn’t you? Learn more about our subscription options, and keep up with every move in the IC contracting space.

The post ODNI warns of Iranian election influence efforts appeared first on Intelligence Community News.

“The Intelligence Community recognizes the importance of informing the public of foreign efforts to influence our democratic processes and, consequently, leading into the presidential and congressional elections this year, we are launching today the first of what will be regular updates regarding such threats.

Our updates can be expected to cover a range of foreign malign activities and election security threats, as you will see in today’s update. In particular, I would like to take this opportunity to draw your attention to concerning Iranian activity.

As I noted in testimony to the Congress in May, Iran is becoming increasingly aggressive in their foreign influence efforts, seeking to stoke discord and undermine confidence in our democratic institutions, as we have seen them do in the past, including in prior election cycles. They continue to adapt their cyber and influence activities, using social media platforms and issuing threats. It is likely they will continue to rely on their intelligence services in these efforts, as well as Iran-based online influencers, to promote their narratives.

In recent weeks, Iranian government actors have sought to opportunistically take advantage of ongoing protests regarding the war in Gaza, using a playbook we’ve seen other actors use over the years. We have observed actors tied to Iran’s government posing as activists online, seeking to encourage protests, and even providing financial support to protesters.

I want to be clear that I know Americans who participate in protests are, in good faith, expressing their views on the conflict in Gaza – this intelligence does not indicate otherwise. Moreover, the freedom to express diverse views, when done peacefully, is essential to our democracy, but it is also important to warn of foreign actors who seek to exploit our debate for their own purposes.

Furthermore, Americans who are being targeted by this Iranian campaign may not be aware that they are interacting with or receiving support from a foreign government. We urge all Americans to remain vigilant as they engage online with accounts and actors they do not personally know.”

Source: ODNI

Your competitors read IC News each day. Shouldn’t you? Learn more about our subscription options, and keep up with every move in the IC contracting space.

The post DNI Haines issues statement on Iranian influence efforts appeared first on Intelligence Community News.

In “Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disc Encryption for Ransom Operations,” agencies from four nations provide specific examples of IRGC-affiliated cyber actors exploiting Fortinet, Microsoft Exchange and VMware Horizon log4j vulnerabilities to gain initial access to systems. The actors then leveraged the access for disk encryption and data extortion to support ransom operations.

The advisory release is part of a U.S. Government effort to eradicate this malicious activity and hold the IRGC-affiliated actors responsible. The malicious actors are actively targeting a broad range of victims, including entities across multiple U.S. critical infrastructure sectors as well as Australian, Canadian and United Kingdom organizations. The Cybersecurity Advisory provides tactics, techniques and procedures and indicators of compromise.

NSA and its partners recommend that organizations, especially those with ties to critical infrastructure networks, use the guidance to mitigate risk of compromise. A patch has been released for each vulnerability identified in the advisory and the most effective mitigation is to patch and update operating systems, software and firmware.

The agencies also recommend that organizations using Microsoft Exchange servers, Fortinet devices and/or VMware Horizon investigate suspicious activity in their networks using the detection guidance in the advisory.

Read the full report here.

Source: NSA

Help IC News continue to bring you breaking news from across the IC and IC contracting landscape. Join our paid subscribers today.

The post NSA, partners issue warning regarding Iranian cyber exploitation appeared first on Intelligence Community News.

This volume in DIA’s series of military power reports provides details on Iran’s defense and military goals, strategy, plans, and intentions. It examines the organization, structure and capability of the military supporting those goals, as well as the enabling infrastructure and industrial base.

“As Tehran expands its capabilities and role as both an unconventional and conventional threat in the Middle East, it is more important than ever that we understand Iran’s military power and the threat it poses to our interests, our allies, and our own security,” Defense Intelligence Agency Director Lt. Gen. Robert P. Ashley, Jr. said in his introduction.

Throughout its 40-year history, the Islamic Republic of Iran has remained implacably opposed to the United States and its presence in the Middle East. Iran has built its military power primarily to serve two important goals: ensuring the survival of the regime and securing a dominant position in the region.

“Iran sees itself as closer than ever to achieving its goals, Ashley said. “Tehran has played the cards dealt it by the fall of Saddam, the uprising in Syria, the rise and retreat of ISIS, and the conflict in Yemen.”

“By applying a rigorous lessons-learned process during decades of conflict in the Middle East, Iran has adapted its military capabilities and doctrine to account for developments by the United States and its allies. Although still technologically inferior to most of its competitors, the Iranian military has progressed substantially over the past few decades,” Ashley added.

The military power series of unclassified overviews is designed to help the public achieve a deeper understanding of key challenges and threats to U.S. national security and focus on near-peer competitors and challengers such as Russia, China, Iran and North Korea.

“This product and other reports in this series are intended to inform our public, our leaders, the national security community, and partner nations about the challenges we face in the 21st century,” Ashley said.

DIA has a long history of producing comprehensive and authoritative defense intelligence overviews. In 1981, DIA published the first unclassified “Soviet Military Power” report, which was translated into eight languages and distributed around the world.

Two years ago, in the spirit of “Soviet Military Power,” DIA decided to once again produce and publish unclassified defense intelligence overviews of the major foreign military challenges we face.

LINK to report: https://www.dia.mil/Military-Power-Publications/

Source: DIA

The post DIA releases Iran Military Power report appeared first on Intelligence Community News.

A bi-partisan review of the House Permanent Select Committee on Intelligence’s oversight activities in 2013 determined that the panel held 63 closed hearings and briefings during the year, along with only four open hearings.

Committee chairman Mike Rogers (R-MI) and ranking member C.A. Dutch Ruppersberger (D-MD) on January 14 highlighted what they called “the extensive oversight work” conducted by the committee in 2013. The first session of the 113th Congress was another productive year for the committee, which has been hailed for its bipartisanship on national security issues, said a news release issued by the committee.

“The Committee’s vigorous oversight work in calendar year 2013 demonstrates our commitment to meaningful oversight,” said Rogers. “We left no stone unturned in asking the necessary questions to ensure comprehensive review of our nation’s intelligence apparatus. We will carry forward our hard work into 2014 to ensure our nation and our citizens in the United States and around the world are protected.”

“The Committee worked hard this past year to conduct thorough oversight of the intelligence agencies and will continue to do so in 2014,” Ruppersberger added. “Over the past year, we held many hearings and Committee events to hold agencies accountable, to ensure our civil liberties, and to enhance our security. Whenever possible, we included the public, and facilitated the communication of vital intelligence to all Members of Congress on critical policy issues.”

In calendar year 2013, the HPSCI passed two major pieces of legislation out of Committee that directly impact the intelligence community and our country’s national security:  The Intelligence Authorization Act (IAA) for fiscal year 2014 on November 21 and the Cyber Intelligence Sharing and Protection Act (CISPA) on April 14.

Additionally, Rogers and Ruppersberger continued to lead the charge to pass meaningful cyber security legislation into law. CISPA was approved by the full committee with a vote of 18-2, and overwhelmingly passed by the full House of Representatives with a strong bipartisan vote of 288-127 on April 18.

The Committee oversees a wide and diverse range of intelligence issues within the nation’s 17 intelligence agencies. Some of the oversight highlights of 2013, as included in the panel’s press release, are below:

NSA — With regard to the National Security Agency, the House Intelligence Committee held 35 member oversight hearings or briefings, three open hearings, four member visits to NSA headquarters, and 84 staff briefings and oversight meetings on NSA programs.

Syria — In response to the escalating crisis in Syria, the committee held multiple classified member-level briefings. Additionally, staff held one-on-one meetings with members. The committee went to great lengths to ensure that all members were well informed on the matter, so that they could make informed policy decisions on potential U.S. involvement in Syria, said the news release.

Benghazi — The committee continues its thorough investigation into the attacks in Benghazi on September 11, 2012. In 2013, the HPSCI held 11 full committee oversight events, including with CIA Director John Brennan and then-Acting CIA Director Mike Morell. The committee has conducted in-depth interviews with many of the CIA security officials on the ground in Benghazi and in the fight.

The committee also fully reviewed the intelligence from FBI interviews with officers on the ground in Benghazi, thousands of pages of documents relating to the attacks, and sent three committee oversight letters on Benghazi to senior intelligence community officials. The investigation is ongoing and the HPSCI’s oversight will continue until the terrorists who killed four brave Americans in Benghazi in 2012 are brought to justice, pledged the press statement.

Iran — The HPSCI continues rigorous oversight of the intelligence community’s implementation of the Administration’s policy on Iran. In 2013, the committee conducted 11 oversight activities on Iran, including the annual open Worldwide Threats Hearing.

Al Qa’ida — The committee conducted 17 full committee oversight activities relating to counterterrorism and AQ in 2013. The committee will continue to provide thorough oversight of the Administration’s counter-terrorism policy in 2014 to ensure the U.S. retains the tools it needs to disrupt terrorists around the world who seek to kill Americans and our allies.

The post Reps. Rogers and Ruppersberger issue bi-partisan review of intelligence panel’s oversight in 2013 appeared first on Intelligence Community News.