Amazon Says Drone Strikes Disrupted Middle East Data Centers

Physical effects rather than cyber strikes are triggering Middle Eastern connectivity problems during day four of a sustained U.S. and Israeli bombing campaign against Iran.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

Data center giant Amazon on Tuesday reported drone attacks affecting multiple regional Amazon Web Services facilities, causing it to recommend that “customers with workloads running in the Middle East take action now to migrate those workloads to alternate AWS Regions.”

American and Israeli forces continue to bomb multiple targets across Iran, which is responding with a high volume of drone and missile attacks targeting U.S. military as well as British bases in Bahrain and Cyprus. Iran is also targeting military and civilian locations, including airports, in Middle Eastern nations that house U.S. bases, including Bahrain, Iraq, Jordan, Kuwait, Oman, Qatar and the United Arab Emirates.

“In the UAE, two of our facilities were directly struck, while in Bahrain, a drone strike in close proximity to one of our facilities caused physical impacts to our infrastructure,” Amazon said.

The strikes “caused structural damage, disrupted power delivery to our infrastructure and in some cases required fire suppression activities that resulted in additional water damage,” the company disclosed.

The resulting outages underscore “how kinetic incidents can rapidly translate into regional cloud availability risks due to infrastructure concentration,” said threat intelligence firm Kela.

Threat intel firm Flashpoint has stressed that an apparent lack of activity by Iranian nation-state threat groups could easily have its origin in the physical safety concerns of individual hackers. “We cannot ignore the human and physical elements of cyberwarfare,” said Kathryn Raines, a senior threat intelligence analyst at Flashpoint during Monday call. “The people who normally run these keyboards, they’re taking shelter from air strikes” (see: Iranian Cyber Proxies Active But Not Nation-State Hackers).

Iranian hackers or their proxies “as of today, have not yet manifested in any significant disruptive or destructive campaigns with any meaningful impact on the conflict,” said Alexander Leslie, senior adviser at threat intelligence firm Recorded Future, in a Monday post to LinkedIn.

“The intelligence we have currently points towards muted cyber retaliation and a defensive Iranian posture,” he said, but warned that “this is a fluid situation.”

The absence of Iranian cyber activity extends to the major cyberespionage group commonly tracked as MuddyWater. A researcher at threat intelligence firm Ctrl-Alt-Int3l told Information Security Media Group that it infiltrated infrastructure that appears to be operated by MuddyWater, also tracked as Earth Vetala, Static Kitten and Mango Sandstorm.

The infrastructure showed evidence of extensive attack activity in the weeks leading up to the conflict, although apparently none since bombing began in the early hours of Saturday.

The researcher, who asked not to be named, said the infrastructure uses an IP address previously tied to the APT group by cybersecurity firm Group-IB as well as malware also previously seen in its attacks.

The operators of the infrastructure used it for mass scanning of known vulnerabilities, employing the Shodan internet of things search engine and the Nuclei vulnerability scanner, the researcher said.

Researchers recovered stolen data from state-owned carrier EgyptAir, as well as signs of reconnaissance activities targeting numerous organizations, including U.S. facial recognition software provider Clearview AI, the Jewish Agency of Israel – the world’s largest Jewish non-profit organization – as well as an Israeli private intelligence provider and a UAE-based platform for selling gold and silver.

They also tied the infrastructure to password-spraying attacks against Outlook Web Access and SMTP services at a number of organizations, including the Jordanian government’s webmail, an urgent-care clinic, rehabilitation and nursing center in Israel, as well as managed IT hosting provider.

MuddyWater has been tied to numerous cyberespionage operations as well as the theft of intellectual property.

If nation-state attack teams appear to have been absent, analysts said activity tied to proxies continues to escalate.

Kela said that pro-Iranian efforts have been “characterized primarily by disruptive hacktivism and narrative-driven operations rather than confirmed strategic intrusions,” including website defacements, distributed-denial-of-service attacks and low-level intrusion claims.

An umbrella group of pro-Tehran proxies claimed to have penetrated the CCTV cameras “of one of Israel’s largest health insurance companies,” publishing screenshots, Flashpoint said Tuesday. Hackers going by “FAD Team” and identifying as part of “Iraq’s Resistance Hub” conducted SQL injection hacks on an array of targets including a Mexican scientific journal, a virtual U.S. Air Force flight simulator group, an Indian agricultural group and a Pennsylvania municipal government, Flashpoint reported.

Flashpoint said many pro-Iran and pro-Russian efforts launched Monday are being conducted under the banner of “#OpIsrael,” and that the campaign purports to be “focusing on critical infrastructure and data exfiltration.”

Cybersecurity officials in the United States and United Kingdom repeated calls to domestic organizations to review their defensive posture, especially firms with operational technology and industrial control system environments.

“Iranian cyber actors, both state-aligned and hacktivist, have consistently gone after the simplest gaps in the most consequential environments,” said Brett Leatherman, assistant director of the FBI’s Cyber Division, in a Monday post to LinkedIn.