An Iran-based hacking group often called Pioneer Kitten is breaching protection, schooling, finance, and healthcare organizations throughout the USA and dealing with associates of a number of ransomware operations to extort the victims.
The risk group (additionally tracked as Fox Kitten, UNC757, and Parisite) has been energetic since not less than 2017 and is believed to have a suspected nexus to the Iranian authorities.
As CISA, the FBI, and the Protection Division’s Cyber Crime Heart warned right this moment in a joint advisory, the attackers are monetizing their entry to compromised organizations’ networks by promoting area admin credentials and full area management privileges on cyber marketplaces whereas utilizing the ‘Br0k3r’ and, extra not too long ago, ‘xplfinder’ handles.
“More recently, the FBI identified these actors collaborating directly with ransomware affiliates to enable encryption operations in exchange for a percentage of the ransom payments. These actors have collaborated with the ransomware affiliates NoEscape, Ransomhouse, and ALPHV (aka BlackCat),” the federal companies mentioned.
“The Iranian cyber actors’ involvement in these ransomware attacks goes beyond providing access; they work closely with ransomware affiliates to lock victim networks and strategize on approaches to extort victims.”
Whereas working carefully with ransomware operators in these assaults, Pioneer Kitten retains its “partners” at nighttime because the risk actors do not disclose their nationality and origin to the ransomware operators they work with.
As of July 2024, Pioneer Kitten risk actors have been scanning for Verify Level Safety Gateways doubtlessly susceptible to CVE-2024-24919.
Additionally, since April 2024, they’ve additionally carried out mass scans for Palo Alto Networks PAN-OS and GlobalProtect VPN gadgets, seemingly as a part of probing for gadgets susceptible to a most severity command injection vulnerability (CVE-2024-3400).
Traditionally, the risk group has been recognized for focusing on organizations by leveraging Citrix Netscaler CVE-2019-19781 and CVE-2023-3519 exploits, and CVE-2022-1388 exploits in opposition to BIG-IP F5 gadgets.
Pioneer Kitten was additionally seen making an attempt to promote entry to compromised networks on underground boards in July 2020, pointing to an try and diversify the hacking group’s income stream.
In one other joint advisory issued in September 2020, CISA and the FBI warned that the Pioneer Kitten risk group “has the capability, and likely the intent, to deploy ransomware on victim networks” and that they have been noticed “selling access to compromised network infrastructure in an online hacker forum.”
Based on FBI’sanalysis, the Iran-based hackers are related to the Authorities of Iran (GOI) and use the ‘Danesh Novin Sahand’ Iranian firm title as a canopy. They’ve additionally been linked to knowledge theft assaults focusing on organizations in Israel and Azerbaijan in assist of the GOI’s pursuits.
