TIRANA, Nov. 25/ATA/-U.S. The Cybersecurity and Infrastructure Security Agency (CISA) announced on Friday that Iranian government-sponsored threat actors have compromised a United States federal agency.
On the list of federal agencies are the Department of Homeland Security, the Department of the Treasury and the Federal Trade Commission.
CISA declined to identify which of the agencies on the list was compromised, but it confirmed that Iranian hackers sponsored by Iran’s Islamic Revolutionary Guard Corps carried out the offensive cyber operation.
Threat actors exploited a server vulnerability by compromising Active Directory and moving laterally in the network in order to steal credentials to expand their operations. They bypassed the federal agency’s security safeguards by disabling Windows Defender and implemented various custom codes to have persistence and access in the future.
They are the same threat actors who conducted destructive cyber attack against Albania and used more or less the same methods and tools.//a.i/
