cyber.hendryadrian.com
Security News · therecord.media

Officials Say Iranian Cyber Threat Is More Likely “Low and Slow” Than “Shock and Awe”

· Original article ↗

Summary

At a Nashville security summit, Tim Haugh and Kevin Mandia said Iranian-linked actors are more likely to exploit basic security gaps and valid credentials, then amplify intrusions with information operations, than launch novel, large-scale attacks.

Key points

  • Haugh and Mandia assessed that Iranian-linked actors are more likely to conduct targeted, opportunistic intrusions than large-scale destructive campaigns.
  • They identified social engineering and valid credentials as likely ways attackers gain access, rather than custom exploits or novel malware.
  • Discussing Stryker, they said attackers used social engineering and legitimate credentials to delete data they were authorized to access; thousands of devices were reportedly disabled.
  • They said attackers may pair intrusions with information operations or public claims to make activity appear larger or faster.
  • Mandia urged organizations to check login pages and APIs and use multifactor authentication broadly.

Article Details

Event Type
U.S. officials' assessment of Iranian-linked cyber threat tactics, with the Stryker incident cited as an example
Impact
Officials said Iranian-linked actors are more likely to exploit basic security gaps and use social engineering and valid credentials than to launch a single large-scale destructive attack. In the Stryker incident, hackers reportedly disabled thousands of devices; Tim Haugh and Kevin Mandia said the operation used legitimate access to delete things the attackers were permitted to delete. Kevin Mandia said the credentials had been purchased on the dark web.

MITRE ATT&CK

T1078 · Valid AccountsThe article describes attackers using legitimate, valid credentials to access systems, including in the Stryker incident.

People

Kevin MandiaCyber first responder and founder of a new AI cybersecurity venture who discussed Iranian cyber operations, the Stryker incident, and the use of purchased valid credentials.Tim HaughFormer NSA director who discussed Iranian cyber operations and the Stryker incident at the Asness Summit on Modern Conflict and Emerging Threats.

Countries

Iranand Kevin Mandia, a longtime cyber first responder and founder of a new AI cybersecurity venture, said Iran’s cyber operations have tended to rely less on novel capabilities than on exploiting basic security gaps —IsraelRather than attempting large-scale, disruptive attacks on critical infrastructure, Iran is more likely to focus on specific organizations with ties to Israel or the U.S.United StatesU.S. officials warn that Iranian-linked cyber actors are more likely to conduct opportunistic intrusions that exploit basic security gaps than to launch a single large-scale destructive attack.