Iranian hackers target critical sectors with ‘brute force,’ U.S., Canada say

The joint advisory released by the U.S., Canada and Australia says the actors have targeted the health-care, government, information technology, engineering and energy sectors.

Iranian cyber actors have spent the past year using “brute force” and other techniques to gain access to multiple critical infrastructure organizations and steal information, an advisory from the U.S., Canada and Australia says.

The joint advisory released Wednesday by the U.S. Cybersecurity and Infrastructure Agency and the Federal Bureau of Investigation says the actors have targeted organizations within the health-care, government, information technology, engineering and energy sectors.

“The actors likely aim to obtain credentials and information describing the victim’s network that can then be sold to enable access to cybercriminals,” the advisory says.

Canada’s Communications Security Establishment, the Australian Cyber Security Centre and the Australian Federal Police joined the U.S. agencies in authoring the joint advisory, which says the activity dates back to October 2023.

“Brute force” techniques involve systematically guessing passwords in order to gain access to victims’ user and group email accounts, or using a password resetting tool.

The advisory says the Iranian actors also used “push bombing” on accounts protected by multi-factor authentication (MFA) — bombarding users with notifications until either the request is approved by mistake or MFA is turned off.

The actors then register their own devices with MFA to ensure they remain connected to the hacked account, according to the advisory.

Once logged in, the agencies say the Iranian actors performed “discovery” on the compromised networks to obtain additional credentials and other information that would allow access.