Nice job to Hacker News for picking this up…

Initial findings from publicly available sources connect these attacks to an Iranian hacking group operating under various aliases, including "Agonizing Serpens," "Agrius," "BlackShadow," "Pink Sandstorm," "Americium," "DEV-0022," and "MuddyWater." These threat actors are tied to Iran's Ministry of Intelligence and Security (MOIS) and have maintained their operations since approximately 2017.

The primary targets of this group extend across multiple countries, encompassing Turkey, Pakistan, the United Arab Emirates, Iraq, Israel, Saudi Arabia, Jordan, the United States, Azerbaijan, and Afghanistan.

The attacks orchestrated by this group typically pursue two main objectives. First, they aim to exfiltrate sensitive information, such as personally identifiable information (PII) and valuable intellectual property. Subsequently, the threat actors often publish this stolen data on social media platforms or Telegram channels to instill fear and inflict reputational damage. Secondly, the group seeks to create chaos and inflict substantial harm by wiping out as many endpoints as possible.

Activities of this Iranian hacking group, linked to MOIS, present a serious and ongoing cybersecurity threat. Trusted Internet believes their broad range of targets, combined with their dual objectives of data theft and infrastructure disruption, underscores the need for heightened vigilance and robust cybersecurity measures. As cyber threats move beyond the boundaries of the battlespace, cyber tools tend to take on a life of their own. Anyone may be at risk, so we remain vigilant in defending against this evolving threat landscape.

Trusted Internet has compiled a list of open-source indicators and tactics used by this group in targeting Israeli targets and have applied them to the defenses in your homes and offices. We continue to monitor the unfolding cyber battlespace in the Middle East and keep your in-home and organizational defenses up to date and protected.

For those of you not Trusted Internet clients, we recommend you place these in your own defenses. Need help? Contact us at staysafeonline@trustedinternet.io.