Iranian Hackers Compromised a Federal Agency’s Network, CISA and FBI Say

Iranian government-sponsored hackers were able to exploit an unaddressed vulnerability in a federal agency’s network to compromise users’ credentials and install cryptocurrency mining software on its system, according to a joint cybersecurity advisory released by the Cybersecurity and Infrastructure Security Agency and FBI on Wednesday.

CISA and the FBI said the unnamed “federal civilian executive branch organization” was compromised “as early as February 2022.” The advisory did not attribute the breach to any particular group, beyond saying that it was conducted by “Iranian government-sponsored [advanced persistent threat] actors.” But the advisory said that the hackers were able to exploit the Log4Shell vulnerability—a software flaw in Log4j, a popular open-source logging library—in an “unpatched VMware Horizon server.” 

CISA said it first became aware of the breach in April, when it conducted an analysis of the agency’s network using EINSTEIN—a “[federal civilian executive branch]-wide intrusion detection system”—and identified “bi-directional traffic between the network and a known malicious IP address associated with exploitation of the Log4Shell vulnerability.” CISA said it conducted “an incident response engagement” at the agency from mid-June through mid-July 2022, where it observed “suspected advanced persistent threat activity.”

The advisory said that the threat actors “installed XMRig crypto mining software” on the agency’s network, and also “implanted Ngrok reverse proxies on several hosts to maintain persistence.” The hackers also installed the open-source app Mimikatz to “harvest credentials” and create “a rogue domain administrator account.”

The breach occurred just months after CISA issued an emergency directive in December 2021, requiring federal agencies to assess their networks for the Log4Shell vulnerability and “immediately patch these systems or implement other appropriate mitigation measures.” The directive gave agencies until 5 p.m. on Dec. 23 of that year to identify whether their software was affected by the vulnerability, by using a CISA-managed GitHub repository “to determine whether Log4j is present in those assets and if so, whether those assets are affected by the vulnerability.” Agencies were also given a Dec. 28 deadline to report back to CISA on “all affected software,” as well as the steps they had taken to address the vulnerability.

“CISA has issued this emergency directive to drive federal civilian agencies to take action now to protect their networks, focusing first on internet-facing devices that pose the greatest immediate risk,” CISA Director Jen Easterly said in a statement at the time. “CISA also strongly urges every organization large and small to follow the federal government’s lead and take similar steps to assess their network security and adapt the mitigation measures outlined in our emergency directive.”

Alongside the recent compromise advisory, CISA also shared a malware analysis report on the XMRig cryptocurrency mining software to help users and network administrators identify and defend against similar intrusions into their systems. 

"CISA and FBI encourage all organizations with affected VMware systems that did not immediately apply available patches or workarounds to assume compromise and initiate threat hunting activities," the advisory added.