Prepare for heightened risk of Iranian cyberattacks

Following last weekend’s American military strikes in Iran, the Department of Homeland Security has issued a warning for companies to be vigilant in defending their information security systems and infrastructure. The warning says “low-level cyberattacks against U.S. networks by pro-Iranian ‘hacktivists’ are likely” with a particular focus on “poorly secured U.S. networks and internet-connected devices.”

The Cybersecurity and Infrastructure Security Agency (CISA) has urged companies to improve resilience against nation-state cyber threats by proactively assessing their cyber preparedness, enhancing defenses, monitoring suspicious activity, and educating employees on reporting suspicious emails and links.

“It is important to be on the lookout for retaliation through cyberattacks directed at U.S. critical infrastructure and organizations,” said Paul Tucker, chief information security officer at BOK Financial®.

Cybersecurity experts have identified multiple distinct Iranian state-sponsored or pro-Iran hacktivist threat actor groups who are financially motivated cybercriminals and have historically targeted U.S. organizations during heightened conflicts. Preparedness is crucial, as cyberattacks targeting other countries, like Israel, could indirectly affect U.S. companies due to network interconnectedness.

Historically, Iranian state-sponsored advanced persistent threat (APT) actors have used common but effective tactics to gain initial access to target networks including:

• Spear phishing: An attack involving emails that are highly customized to the individual, making it appear like it's coming from one of your providers or vendors.
• Brute force: A hacking method using trial and error to crack passwords, login credentials and encryption keys.
• Exploiting known vulnerabilities against accounts and networks with weak security.

Recent Iranian state-sponsored activity has included malicious cyber activity against operational technology devices by Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT cyber actors. The following actions are key to strengthening operational resilience against this threat:

• Implement multifactor authentication for all accounts, especially privileged ones.
• Use strong, unique passwords.
• Set account lockout policies after a limited number of failed login attempts.
• Check systems for default passwords still in use.

"Businesses and local municipalities should remain vigilant to Iranian threats and remind employees to stay alert," emphasized Tucker. "Cybersecurity today means protecting what we cannot see, in places we cannot reach. The best defense against attacks is preventing them."

Be proactive
The heightened risk of attacks also can serve as a reminder for cybersecurity best practices. CISA's checklist for organizations of all sizes provides guidance on being prepared, detection and response if an intrusion occurs.

"In today's rapidly changing landscape, businesses must ensure their employees are well trained and vigilant against cyberattacks, especially phishing attacks,” Tucker said.

“It’s imperative that employees take a moment to verify emails before interacting with them and report suspicious activity. A single click can have far-reaching consequences.”

- Paul Tucker, chief information security officer at BOK Financial

But it's more than just monitoring emails. Preventative measures also include:

• Be prepared. Make sure you have an incident response and business continuity plan, and routinely test it, so you are ready in the event of ransomware.
• Minimize your attack surface. Keep systems and software up to date and remediate known system vulnerabilities. Enforce multi-factor authentication for remote access and update known vulnerabilities (use CISA free tools if needed).
• Evaluate the security of your supply chain. Actors have gained initial access to victim organizations by compromising trusted third-party software.
• Increase employee awareness. Cybersecurity awareness training plays a crucial role in preventing cyberattacks of any kind, especially to prevent phishing attacks and password compromises.
• Vet your suppliers. Make certain your critical vendors have strong security measures and contingency plans to ensure continued service if an incident occurs.
• Monitor CISA guidance. The Shields Up site provides guidelines for companies of all sizes plus detailed recommendations for business leaders.

"Being prepared, having a cybersecurity playbook and robust programs, and investing in educating employees about the importance of cybersecurity safety will go far in protecting your business and clients," Tucker said.