Critical Infrastructure Security
‘Bless Their Heart,’ Says Threat Intel Executive of Pro-Iranian Group
Security experts are dismissing a pro-Iranian hacktivist group’s claim to have breached Indian nuclear secrets in reprisal for the country’s support of Israel.
See Also: Beyond Replication & Versioning: Securing S3 Data in the Face of Advanced Ransomware Attacks
The LulzSec Black group last week claimed to have hacked “the company responsible for Indian nuclear reactors” and to have stolen 80 databases, of which it was now selling 17 databases containing 5.2 gigabytes of data. The group claimed the information detailed the precise location of India’s nuclear reactors, numerous chemical laboratories, employee personally identifiable information, industrial and engineering information, precise details of guard shifts and “other sensitive data related to infrastructure.”
LulzSec Black, named after the notorious hacktivist collective that committed a string of high-profile hits in 2011, claims to be a group of “Palestinian hackers.” Previous attacks tied to the group include disruptions targeting Israel, as well as countries that support Israel, including France and Cyprus.
Threat intelligence firm Resecurity said the group’s nuclear claims vary from being dramatically overstated to outright lies.
“This activity is related to the ‘pseudo-hacktivist’ activities by Iran” designed to provoke fear, uncertainty and doubt, Resecurity told Information Security Media Group. “Many of their statements are overstatements, having no connection to reality. For example, they clearly do not have ’80 databases’ or even 5.2 GB of data.”
LulzSec Black’s claims arrive amidst U.S. government alerts of the “heightened threat environment” facing critical infrastructure networks and operational technology environments, following Israel launching missile strikes against Iran on June 13 (see: Infrastructure Operators Leaving Control Systems Exposed).
While the resulting regional war appears to now be moderated by a fragile ceasefire, many governments are still bracing for reprisals (see: Israel-Iran Ceasefire Holding Despite Fears of Cyberattacks).
What LulzSec Black may actually possess is identity and contact information for nuclear specialists, likely stolen from third-party HR firms and recruitment websites such as the CATS Software applicant tracking system and recruitment software, Resecurity said. This can be seen in the long list of various job titles – “security auditor, heavy water unit,” “nuclear engineer, analysis lab, tritium gas,” and “radiation officer, fuel fabrication, uranium dioxide” – in a sample of dumped data.
In that data, tags such as “Top Secret,” appear, which Resecurity said likely either reflect clearances held by job candidates, or were added by the hackers themselves “so it will look like it is from some nuclear energy facility.”
Hacktivist Groups Make More Noise
10 days of explosive missile swaps between Israel and Iran led a large number of hacktivist groups to take sides. Some claim to focus on disrupting OT environments, including supervisory control and data acquisition, or SCADA, systems, as well as industrial control systems. LulzSec Black is one such group, as are APT Iran and FAD Team, which each claim to have targeted fuel facilities in Israel and the United States. Another group, Z-Alliance, claims to have targeted SCADA systems in Europe, and which appears to focus on Italy and NATO in particular.
“Both hacktivists and government-affiliated actors routinely target vulnerable U.S. networks and internet-connected devices for disruptive cyberattacks,” the U.S. Cybersecurity and Infrastructure Security Agency said in a Friday alert. “Activities like website defacements, leakage of sensitive information and distributed denial-of-service (DDoS) campaigns against U.S. websites have been common attack methods in the past.”
Most “hacktivist” groups are “stupid script kiddies who just like to make noise,” said Gary Warner, director of threat intelligence at cybersecurity firm DarkTower. Warner said DarkTower tracks 122 pro-Iranian hacking groups.
Most of self-proclaimed hacktivists resort to DDoS attacks, with the majority of Arabic- and Indonesian-speaking groups simply targeting websites with the Israeli country code top-level domain .il, he said.
For DDoS attackers, even a momentary disruption to a website is enough to declare success – so long as they capture a screenshot from a site such as check-host.net, showing that the target site was unreachable from multiple locations around the world.
One such group is Team BD Cyber Ninja, which normally looks for Indian targets but recently claimed to also be hunting “Jewish American” websites. At least some of its targets are in fact based in the United Kingdom or Canada. An attack against a U.K.-based certification firm left the company’s site unreachable, with the group demanding a ransom, payable in cryptocurrency, to unlock it. In that case, the ninjas “forgot to put their crypto address in the place where their script said ‘bc1qexamplebtcaddress,'” Warner said.
One Team BD Cyber Ninja victim was a Chinese takeout restaurant in Ontario. “As we say in Alabama, ‘bless their heart,'” Warner said.