Homeland Justice and Karma: Iranian Cyber Attacks Revealed

 Source: Iranian MOIS-Linked Hackers Behind Destructive Attacks on Albania and Israel (thehackernews.com)

Recent revelations have uncovered a worrying trend surrounding Iranian hackers linked to their Ministry of Intelligence and Security (MOIS), namely that they've been the main suspects behind destructive cyberattacks targeting Albania and Israel. These threat actors, also known as 'Void Manticore,' have been utilizing a wiper malware to target critical systems in both countries whilst self-identifying themselves as 'Homeland Justice' and 'Karma.' The threat actors' patterns also display a striking correlation with geopolitical events involving Israel, Albania, and Iran, as attacks targeting the latter victim country had been ongoing since July 2022, while attacks against the former had only begun in earnest following the Israel-Palestine war in October 2023. 

Void Manticore's attacks have caused significant disruption, as they've been characterized by a dual approach that fuses the impacts of data destruction with psychological warfare. This also indicates that their attacks seem more focused on disrupting potential adversaries of Iran and causing mayhem rather than stealing any specific or sensitive information for the time being. Some of their tactics include deploying wiper malware like CI Wiper and No-Justice to delete data while magnifying the impact and the media buzz surrounding the attacks by selectively leaking data to the public. The attacks don't stand out regarding method sophistication, as publicly available tools and known vulnerabilities seem to be their methods of choice when targeting vulnerable systems tied to either victim country. Subsequently, once access is secured, the attackers tend to lean on ubiquitous protocols such as Remote Desktop Protocol (RDP), Server Message Block (SMB), and File Transfer Protocol (FTP) for lateral movement amongst systems, all while searching for the optimal location to drop their payloads in. 

One of the intriguing features surrounding this attack and its threat group is the apparent overlap between Void Manticore and another threat group known as Scarred Manticore. This indicates some level of collaboration between the two groups throughout the attack process, culminating in the systematic handoff of targets before exploitation. Possessing this degree of coordination between two distinct threat groups once again underlines the sensitivity and sophisticated nature of these attacks conducted by the Iranian government. Furthermore, this fits in with the previously established modus operandi of the Iranian MOIS, as it has had a proven track record of coordinating attacks between various threat actors operating under its purview.

Ultimately, these attacks once again highlight the ever-growing need to raise awareness surrounding the institutionalized nature of cyber threats. With our world gradually becoming ever more unstable and cyber threats becoming ever more ubiquitous, thinking of cyber as solely a domain in which companies protect themselves against black hat hackers and organized criminals is an outdated notion, as nation-states across the world are increasingly using cyber-attacks as a means to achieve their geopolitical objectives. 

For a more detailed analysis surrounding the attacks, feel free to visit The Hacker News.