Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Brief: Iranian-Linked Cyber Operations

Summary: Unit 42's threat brief summarizes a decade of campaigns publicly attributed to Iran, noting that direct attribution to the nation-state is still largely lacking and that most private-sector attribution rests on tactical evidence of targeting and possible motivation. The brief describes two motivators, espionage in most observed campaigns and destruction in a smaller set beginning with the 2012 Shamoon disk-wiping attack and later StoneDrill and ZeroCleare, and profiles groups including OilRig, Magic Hound, APT33, DarkHydrus, Shamoon and MuddyWater.

What you should know: Unit 42 states that a consistent theme across these groups is the abuse of poorly implemented IT and security policies, and that MFA, network segmentation, limits on macro-enabled documents and blocking traffic to unknown domains could have helped neutralize their actions.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related