Federal Agencies Say Iran-Linked Hackers May Target US Firms

The threat landscape for US firms has taken a concerning turn, with federal agencies warning of potential cyberattacks from Iran-linked hackers despite the ongoing ceasefire and negotiations between the two countries.

The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), FBI, and Department of Defense Cyber Crime Center (DC3) have issued a joint statement outlining their concerns in a Cybersecurity Information Sheet (CSI). According to the release, Iranian state-sponsored or affiliated threat actors are likely to increase their distributed denial of service (DDoS) campaigns and potentially conduct ransomware attacks.

"Due to recent events, these threat actors are likely to significantly increase their DDoS campaigns, and potentially also conduct ransomware attacks," said the agencies. "We urge organizations, especially those within U.S. critical infrastructure, to remain vigilant for the outlined potential targeted malicious cyber activity."

A History of Targeting Poorly Secured Networks

In the past, these fraudsters have targeted US networks and internet-connected devices that were poorly secured, seeking targets of opportunity, outdated software, and the use of default or common passwords. By understanding the tactics, techniques, and procedures (TTPs) used by these threat actors, organizations can assess their own cybersecurity weaknesses and take steps to harden their defenses.

The agencies recommend that organizations review the CSI to learn more about the fraudsters' commonly used techniques, update their incident response plans, and implement advanced safeguards. This is especially crucial in light of the FBI's recent report that ransomware remains the top threat to American infrastructure, with complaints in 2024 rising 9% above 2023's total.

Ransomware: The Top Threat to American Infrastructure

Nearly half of all ransomware complaints received by the FBI's Internet Crime Complaint Center (IC3) in 2024 involved critical infrastructure organizations in sectors like manufacturing, financial services, information technology, healthcare, and government. This highlights the need for robust cybersecurity measures to protect these sensitive industries.

Advanced Safeguards in AI-Integrated Sectors

The CISA released recommendations in April 2024 aimed at helping companies navigate the complex landscape of cybersecurity, including the dangers lurking in artificial intelligence (AI). The agencies emphasized the need for advanced safeguards as AI increasingly integrates into essential sectors like energy, transportation, and healthcare.

A Defining Threat to National Security

In February 2024, it was reported that the Chinese government's attempt to virtually attack US infrastructure had reached new levels, becoming a defining threat to national security. A Chinese hacking network was revealed to be dormant inside US critical infrastructure, with malware that needed only to be triggered to disrupt that infrastructure.

Staying Vigilant in a Challenging Cyber Landscape

In light of these developments, it is essential for organizations to remain vigilant and proactive in their cybersecurity efforts. By staying informed about emerging threats and taking steps to harden their defenses, US firms can minimize the risk of cyberattacks from Iran-linked hackers and other adversaries.