The Federal Bureau of Investigation (FBI) has issued a Private Industry Notice on protecting against malicious activity by Iranian cyber company Emennet Pasargad (formerly known as Eeleyanet Gostar).

Two Iranian nationals employed by the company were indicted on October 20 2021 by a grand jury in the US District Court for the Southern District of New York over their alleged involvement in a campaign to influence and interfere with the outcome of the 2020 US presidential election.

Seyyed Mohammad Hosein Musa Kazemi and Sajjad Kashian were accused of conspiring with others to run a sophisticated campaign that included sending threatening emails to voters, hacking into the computer networks of an American media company and impersonating a far-right organization to cast doubt over the integrity of electoral ballots.

The Department of the Treasury Office of Foreign Assets Control sanctioned Emennet, four members of the company’s management team and Kazemi and Kashian for attempting to influence the same election.

The Notice states that Emmenet also previously conducted cyber-enabled information operations that used a false flag persona to spread propaganda via text message.

“According to FBI information, in late 2018, the group masqueraded as the ‘Yemen Cyber Army’ and crafted messaging critical of Saudi Arabia,” states the Notice. 

“Emennet also demonstrated interest in leveraging bulk SMS services, likely as a means to mass-disseminate propaganda or other messaging.”

Included in the Notice was a summary of Emennet’s past tactics, techniques and procedures (TTPs), which included using virtual private network services to obfuscate the origin of their activity. 

Over the past three years, Emennet has selected potential victims by performing web searches for leading businesses in various sectors. The group would then scan the websites of the businesses that appeared in the search results for vulnerable software that could be exploited to establish persistent access.

Information gathered by the FBI indicates that Emennet also attempted to leverage cyber intrusions conducted by other actors for its own benefit. 

“This includes searching for data hacked and leaked by other actors and attempting to identify webshells that may have been placed or used by other cyber-actors,” said the FBI.

New research from managed detection and response (MDR) provider Expel found that most ransomware attacks in 2021 were self-installed. 

The finding was included in the company’s inaugural annual report on cybersecurity trends and predictions, Great eXpeltations, published on Thursday. 

Researchers found eight out of ten ransomware infections occurred after victims unwittingly opened a zipped file containing malicious code. Abuse of third-party access accounted for 3% of all ransomware incidents, and 4% were caused by exploiting a software vulnerability on the perimeter.

The report was based on the analysis of data aggregated from Expel’s security operations center (SOC) concerning incidents spanning January 1 2021 to December 31 2021. 

Other key findings were that 50% of incidents were BEC (business email compromise) attempts, with SaaS apps a top target. 

More than 90% of those attacks were geared towards Microsoft O365, while assaults against Google Workspace accounted for fewer than 1% of incidents. The remaining 9% targeted Okta.

Ransomware attacks accounted for 13% of all opportunistic attacks. The five most targeted industries in descending order were legal services, communications, financial services, real estate and entertainment. 

In addition, 35% of web app compromises Expel responded to resulted in the deployment of a crypto miner.

To protect against threats in 2022, Expel recommended implementing network layer controls to detect and block network communications to crypto mining pools and confirming event data recorder (EDR) coverage across all endpoints. 

The company also advised forwarding computing resource alarms to a security information and event management (SIEM) software solution to flag overtaxed resources potentially deployed for crypto-jacking. 

Other advice included defending the self-installation attack surface on Windows, deploying MFA everywhere, especially for remote access, patching and updating regularly and deploying EDR policies in block mode. 

Users were also advised not to expose RDP (remote desktop protocol) directly to the internet. 

“We founded Expel with a goal of bringing more transparency to security,” said Dave Merkel, CEO of Expel, on Thursday. 

“Today we reach a new milestone tied to that commitment – we’re sharing the most important threats and trends our SOC identified last year and their advice on what to do about them.”

The United States Environmental Protection Agency (EPA) has drawn up a 100-day game plan to help protect the nation’s water systems from cyber-attacks.

The Industrial Control Systems Cybersecurity Initiative – Water and Wastewater Sector Action Plan focuses on high-impact acts that can be performed within 100 days to improve cybersecurity across the water sector.

Strategies detailed in the roadmap promote and support the early detection of cyber-threats and the rapid sharing of data across the government to speed up cyber-threat analysis and action.

The plan advocates the establishment of a cybersecurity task force comprising leaders from the water sector. It also calls for the implementation of pilot projects to demonstrate and accelerate the adoption of incident monitoring.

“Cyber-attacks represent an increasing threat to water systems and thereby the safety and security of our communities,” said EPA administrator Michael S. Regan. 

“As cyber-threats become more sophisticated, we need a more coordinated and modernized approach to protecting the water systems that support access to clean and safe water in America.”

The plan was announced on Thursday by the EPA and its federal partners. It was developed by the EPA, the National Security Council (NSC), the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) and the Water Sector Coordinating Council and Water Government Coordinating Council (WSCC/GCC).

“The action plans for the electric grid and pipelines have already resulted in over 150 electricity utilities serving over 90 million residential customers and multiple critical natural gas pipelines deploying additional cybersecurity technologies,” said deputy national security advisor for cyber and emerging technology, Anne Neuberger.  

She added: “This plan will build on this work and is another example of our focus and determination to use every tool at our disposal to modernize the nation’s cyber defenses, in partnership with private sector owners and operators of critical infrastructure.”

The EPA said it intends to “encourage, incentivize and assist” water sector stakeholders to rapidly deploy industrial control systems (ICS) cybersecurity monitoring technologies. 

“Public-private sector collaboration like this initiative is central to protecting the American public and their ability to safely access critical services,” said secretary of homeland security Alejandro Mayorkas.

The White House has unveiled its strategy to embed a zero trust approach to cybersecurity across the federal government.

The memorandum, published by the Office of Management and Budget (OMB), sets out a series of specific security goals for agencies to establish a ‘never trusted, always verified’ model. This includes introducing stronger enterprise identity and access controls, such as multi-factor authentication (MFA). It also wants federal agencies to have a complete inventory of every device it operates and authorizes for government use and encrypt all DNS requests and HTTP traffic within their environment.

The strategy represents a key component of delivering President Joe Biden’s Executive Order last year, which mandated a drive to secure cloud services and zero trust across federal government departments and their suppliers.

Federal agencies must incorporate the additional requirements identified in the new memorandum into their plans to develop zero trust architecture within 60 days. In addition, they need to designate and identify a zero trust strategy implementation lead for their organization.

The latest requirements were developed in response to increasingly sophisticated cyber-attacks, including the Log4j vulnerability. The OMB said such incidents have demonstrated that the federal government can no longer depend on conventional perimeter-based defenses to protect critical systems and data.

Federal chief information officer Clare Martorana commented: “Security is the cornerstone of our efforts to build exceptional digital experiences for the American public.

“Federal agency CIOs and IT leadership are leaning into this challenge, and the zero trust strategy provides a clear roadmap for deploying technology that is secure by design and responsive to the needs of our workforce so they can better deliver for the American public.”

Responding to the memorandum, Vats Srivatsan COO of ColorTokens, pondered whether the UK will take a similar approach to mandating zero trust principles across the government. “This week the United States took a proactive step towards safeguarding the nation with resilient security. Government-wide zero trust mission completion will be a journey, and the path has been laid out in a set of goals and implementation efforts outlined in the OMB’s strategy. This undoubtedly sets a precedent for other countries and is a well laid-out model of implementation that the UK can and should borrow from.

“Zero trust is widely recognized as a highly effective, long-term approach to breach resilience; however, zero trust architecture can’t be achieved overnight. The sooner any institution embarks on a zero trust journey to modernize its cyber-defenses, the sooner zero trust maturity and breach resilience can be achieved. Boris Johnson is known to keep his eye on modern technology, so it is a surprise that the UK appears to be kicking the zero trust can down the road. That being said, the UK frequently follows suit on US policy, oftentimes with some initial hesitation. If the UK plans to stay ahead of the threat environment, it will certainly want to follow the US’s lead.”

Earlier this week, the UK government announced a new cybersecurity strategy designed to protect essential public sector services from being shut down by hostile actors.

The National Cyber Security Centre (NCSC) has warned UK organizations to prepare for Russian cyber-attacks amid ongoing geopolitical tensions in Ukraine.

The new guidance follows numerous malicious cyber-incidents in Ukraine in the past month, which the NCSC said corresponds with past Russian behavior. These include more than a dozen Ukrainian government websites getting taken offline in a cyber-attack, while a major malware wiper campaign targeting government, IT and non-profit organizations across the country was recently detected by Microsoft.

The agency noted that such incidents resemble high-profile attacks like NotPetya in 2017 and cyber-attacks against Georgia in 2019, which the UK government attributes to the Russian government.

While no specific threats to the UK have currently been identified, the UK government’s support for Ukraine in the crisis is likely to make it a target of Russian threat actors.

The dispute revolves around Russian concerns that Ukraine will join NATO, and it has built up a substantial force on the border, leading to fears of invasion.

To prepare for potential attacks, the NCSC has urged UK organizations to take action to secure their systems. These include patching systems, enabling multi-factor authentication, implementing an effective incident response plan and checking that backups and restore mechanisms are working. This guidance is primarily aimed at larger organizations. The NCSC has also advised any organization that has fallen victim to a cyber-attack to report the incident to the NCSC’s 24/7 Incident Management team.

Paul Chichester, NCSC director of operations, commented: “The NCSC is committed to raising awareness of evolving cyber-threats and presenting actionable steps to mitigate them. While we are unaware of any specific cyber threats to UK organizations in relation to events in Ukraine, we are monitoring the situation closely and it is vital that organizations follow the guidance to ensure they are resilient.

“Over several years, we have observed a pattern of malicious Russian behavior in cyberspace. Last week’s incidents in Ukraine bear the hallmarks of similar Russian activity we have observed before.”

Commenting on the guidance, David Carroll, MD of Nominet Cyber, said: “Organizations should take heed of the NCSC’s warning today and prioritize its recommendations to increase their cyber-resilience in the wake of worsening relations with Russia. This guidance is in line with the cybersecurity reality that has emerged over the past decade, where geopolitical activity and real-world warfare are increasingly mirrored in the cyber sphere.

“Experience has taught us that government, public sector and private sector organizations can become targets for malicious activity from hostile states and the UK government is right to take a proactive approach to protection. Organizations should prioritize identifying and patching vulnerabilities in their software, which have traditionally been a vector for large-scale attacks in the past, and be actively monitoring for breaches or potentially suspicious activity.”

Bulgarian law enforcement has successfully taken down a network of online investment fraudsters responsible for losses of more than €10m.

The operation, supported by Europol and Eurojust, took place on January 26. This resulted in the arrest of one individual by the Bulgarian National Police on suspicion of defrauding mainly German and Greek investors out of at least €10m. In addition, 24 locations were searched, police officers interviewed 66 witnesses in Sofia and Burgas and a variety of electronic equipment, financial information and recordings were seized.

The scam was conducted by an organized crime group that set up bogus websites and call centers. Call operators speaking German, Greek, English and Spanish posed as financial consultants and contacted potential investors with promises of significant profits. This led to several hundred victims making substantial investments, which they lost entirely.

German and Greek investors who lost their investments notified law enforcement, leading to the investigation and subsequent action.

During the operation, two experts from Europol were on the ground to facilitate the information exchange and provide real-time operational analysis and technical expertise. The joint action was coordinated by Eurojust, who also provided cross-border judicial support.

Europol explained: “In 2019, Bulgarian authorities started investigations and Eurojust set up a joint investigation team (JIT) between Bulgaria, Germany, Greece, Serbia and Europol. Following five coordination meetings with Europol and Eurojust, the JIT members were able to identify the two fraudulent call centers in Bulgaria. The Bulgarian police, supported by the Serbian authorities, dismantled both call centers on the action day.”

Last November, Proofpoint warned consumers of a significant rise in call center threat activity, in which attackers use email alongside call center customer service agents to scam victims, sometimes out of tens of thousands of dollars.