A coalition of threat information groups on Wednesday warned that the U.S. and Israeli bombing campaign has led to increased risk of retaliatory cyberattacks from Iran-linked actors as well as physical attacks from violent extremists.
The coalition, led by the Food and Agriculture Information Sharing and Analysis Center and the Information Technology-ISAC, warned that state-sponsored groups, hacktivists and criminal groups are likely to target critical infrastructure sites in the U.S. using various tactics, including spear-phishing or stolen credentials.
“Iranian actors have formidable capabilities and tend to be more active during times of geopolitical conflict,” Scott Algeier, executive director of IT-ISAC, told Cybersecurity Dive.
The goal of the advisory is to help bridge the gap in intelligence between what the government issues and the collective resources of the various ISAC groups. Ten information-sharing groups participated in the joint advisory, including Health-ISAC, WaterISAC, National Defense ISAC and others.
Information security teams are being urged to take precautionary measures, monitor for anomalous activity, back up data, enable multifactor authentication and prepare for incident response.
The warning comes amid confirmed attacks claimed by pro-Iran hacktivists and some groups linked to the Iranian regime.
Several U.S. companies have been targeted for attack in recent weeks by either hacktivist groups or state-linked threat actors.
On Wednesday, medical device maker Stryker was the target of a suspected wiper attack that disrupted its Microsoft environment.
The Cybersecurity and Infrastructure Security Agency said it is closely tracking the Iran threat amid the partial government shutdown, which is directly impacting the Department of Homeland Security.
“We are working shoulder-to-shoulder with our public- and private‑sector partners as we continue to uncover relevant information and provide technical assistance for the targeted attack on Stryker, while steadfastly standing at the ready to defend our nation’s critical infrastructure,” CISA Acting Director Nick Andersen told Cybersecurity Dive. “As with all cyber incidents, we have launched an investigation into this matter.”
A state-backed threat actor tracked as Seedworm or MuddyWater installed malicious backdoors on the networks of several U.S. companies dating back to early February, according to researchers at Symantec and Carbon Black.
The advisory also references specific attacks since early March, including a DDoS attack from the pro-Russia hacktivist NoName057 (16) targeting Israeli organizations on March 4.
The coalition also warns that government-backed sleeper cells, lone wolf sympathizers and others may engage in physical attacks related to the conflict. At least two clerics in Iran have issued fatwas, or religious edicts, for Muslims to take revenge for the killing of Iran’s former Supreme Leader Ali Khamenei at the beginning of the bombing campaign.
Editor’s note; Updates with comment from CISA.
