Iran to cyber-attack the US?

Most all organizations knee-jerk responses to the sanctions as an immediate for Iranian cyber attacks against the US. This is not unusual for such organizations as it helps sell product and is solely based on a limited understanding of the area and a focus on so-called ‘threat intelligence.” A much larger geopolitical view is required. This is a standard response and not one based on evidence or fact but emotional responses to a US-initiated action. Iran has been targeting the United States since approximately 2002 with the formalization of certain digital security and hacking groups in Iran. Any Iranian attacks against the US would lead to exponentially more lethal attacks against Iranian targets by the US. Iran will most likely focus its efforts on suppressing any internal dissent, squashing any visible means of internal turmoil while censoring the ability of Iranian citizens to openly express their contrary viewpoints via the Internet. Treadstone 71 does not believe any attacks on US soil i.e., against critical infrastructures in the US would be productive for Iran at this time. We may see continued probes, scans, and methods of enumeration against these sites but direct attacks are not likely unless it is retaliatory (based upon other than sanction actions by the US). We may see increased cyber actions against US military capabilities in the Persian Gulf as methods of testing relative to war games in and around the Straits of Hormuz. With economic unrest and visibly upset people in Iran, Iran has more internal troubles and will likely focus their efforts there. We do not believe we will see any immediate, state-sponsored attacks against the US from Iran as a result of the sanctions at this time. This could shift and increased vigilance is still warranted.

Our Previous statement from May still holds

With more control over Iranian hackers now as opposed to the past, Rouhani may exhibit restraint thereby not playing into US hawk ‘I told you so’ pundits. Any hacks of substance coming from Iran at this time would be directed by the government but it is unlikely we will see an immediate uptick in activity based upon the already expected response from the current US Administration. Rouhani still has the ability to work China, Russia, and the EU over the existing agreement. If anything, this places the US further on the outside of global activities creating another vacuum where we once stood. Any Iranian overt and targeted hacking at this time against the US would be counterproductive to their aims.

Further to, it is possible that Rouhani detractors inside Iran could execute targeted attacks against the US as a method to discredit his administration while supporting the view from US hawks. Hardliners in Iran are not satisfied with the agreement and may do more beyond hacking to discredit Rouhani with remaining agreement members.

Additionally, adversaries of Iran could execute cyber false flag operations to make attacks look as if they originated from Iran in order to discredit the Iranian leadership as a pretext for increased sanctions and cyber actions.

Regardless, we should expect increases in reconnaissance, phishing, and social engineering actions in preparation for much larger actions. Monitoring of this activity, the locations from which they occur as well as any changes in adversary and payload speed, targeting, and maliciousness, should be increased in standard surveillance and warning actions. An increase in the ‘cyber defcon’ at least for vigilance is warranted.

Confuser and Oilrig – Iranian Hacks

This is a bit disjointed at this time and is raw data. This is not intelligence, has not been analyzed but does tie directly to Oilrig.

A powerful program to pack your apps. With this program, you can pack programs in C # and VB.Net

Confuser – Confuser program zipped. For download and analysis

a1ir3z4-HK Frequently found on anonysec.org, c-cracking.org, formerly of the Kalli Hack Team (kallihack), http://haraji.8tag.ir

Others in the mix: XVII_Hacker, #XVII_Roman & #BlackErroR1 & #sorblack

BTC BRUTER v.3.0 By UNKNOWN-KILLER

Bitcoin Cracker Performance Test via Telegram: @ a1ir3z4HK @ a1ir3z4_HK_bot
Using temp emails here: http://www.emeil.ir/
Sprinkle the effort with a bit of Russian for flavoring

Cʏʙᴇʀ Cʀᴀᴄᴋɪɴɢ | سایبر کرکینگ

61.155.153.21:3389@SZCN2003X-5984\administrator;1qaz@WSX3edc
123.206.72.128:3389@10_221_112_104\administrator;1qaz@WSX3edc
123.207.139.51:3389@10_10_123_100\administrator;1qaz@WSX3edc
113.108.144.211:3389@ZK\administrator;1qaz@WSX
218.13.56.118:3389@HEGII\administrator;1qaz@WSX
218.17.182.99:3389@DTC-S01\administrator;1qaz@WSX
58.213.155.42:3389@SQL\administrator;1qaz@WSX
218.90.154.154:3389@DHT1FDC2\administrator;1qaz@WSX
218.94.38.222:3389@WIN-3EGCECLJQ5J\administrator;1qaz@WSX
180.107.198.6:3389@HAMBER\administrator;1qaz@WSX
117.89.141.232:3389@DELL-R710\administrator;1qaz@WSX
58.221.10.142:3389@WIN-QUO7ORFGR99\administrator;123qwe!@#
180.112.122.235:3389@HP-SERVER\administrator;123qwe!@#
219.136.229.194:3389@BMYWEB\administrator;1234qwer!@#$
121.9.14.146:3389@WIN-90NIL448CQ4\administrator;1qaz!QAZ
119.145.72.210:3389@WINDOWS-M89UCHU\administrator;1qaz!QAZ
218.93.123.171:3389@USER-A4G6BL8T0O\administrator;1qaz!QAZ
61.160.112.76:3389@NWERPDB\administrator;1qazXSW@
117.80.229.78:3389@KSBOMAN\administrator;1qazXSW@
119.29.157.222:3389@10_135_48_44\administrator;1qazXSW@
61.145.180.174:3389@TEDU-LH\administrator;!QAZ2wsx
113.108.146.83:3389@WIN-QIO2J4TRCMJ\administrator;!QAZ2wsxЧитать полностью…

61.155.153.21:3389@SZCN2003X-5984\administrator;1qaz@WSX3edc
123.206.72.128:3389@10_221_112_104\administrator;1qaz@WSX3edc
123.207.139.51:3389@10_10_123_100\administrator;1qaz@WSX3edc
113.108.144.211:3389@ZK\administrator;1qaz@WSX
218.13.56.118:3389@HEGII\administrator;1qaz@WSX
218.17.182.99:3389@DTC-S01\administrator;1qaz@WSX
58.213.155.42:3389@SQL\administrator;1qaz@WSX
218.90.154.154:3389@DHT1FDC2\administrator;1qaz@WSX
218.94.38.222:3389@WIN-3EGCECLJQ5J\administrator;1qaz@WSX
180.107.198.6:3389@HAMBER\administrator;1qaz@WSX
117.89.141.232:3389@DELL-R710\administrator;1qaz@WSX
58.221.10.142:3389@WIN-QUO7ORFGR99\administrator;123qwe!@#
180.112.122.235:3389@HP-SERVER\administrator;123qwe!@#
219.136.229.194:3389@BMYWEB\administrator;1234qwer!@#$
121.9.14.146:3389@WIN-90NIL448CQ4\administrator;1qaz!QAZ
119.145.72.210:3389@WINDOWS-M89UCHU\administrator;1qaz!QAZ
218.93.123.171:3389@USER-A4G6BL8T0O\administrator;1qaz!QAZ
61.160.112.76:3389@NWERPDB\administrator;1qazXSW@
117.80.229.78:3389@KSBOMAN\administrator;1qazXSW@
119.29.157.222:3389@10_135_48_44\administrator;1qazXSW@
61.145.180.174:3389@TEDU-LH\administrator;!QAZ2wsx
113.108.146.83:3389@WIN-QIO2J4TRCMJ\administrator;!QAZ2wsxЧитать полностью…

182.71.201.2:3389@TECHNOPAK\administrator;p@ssw0rd
150.242.254.98:3389@WINWORLD\administrator;Pass@word1
115.112.155.95:3389@APOLLOHOSPITALS\administrator;P@ssw0rd
221.135.143.132:3389@DMSSERVER\administrator;P@ssw0rd
220.225.210.91:3389@CTL\administrator;P@ssw0rd
45.64.195.147:3389@UNISRV\administrator;P@ssw0rd
125.22.73.198:3389@NAVGGL\administrator;P@ssw0rd
125.22.73.196:3389@NAVGGL\administrator;P@ssw0rd
59.144.162.8:3389@DELLSERVER\administrator;Admin@123
27.54.170.204:3389@DCPLHO\administrator;Admin@123
180.151.71.42:3389@FOURDTECH\administrator;Admin@123
202.47.116.201:3389@JAYAIR\administrator;Admin@123
118.185.53.18:3389@JBBROTHERS\administrator;Admin@123
27.251.117.6:3389@WIN-6T4QFMCPVE8\administrator;Admin123
103.230.152.172:3389@WIN-PMCSC1KVLPH\administrator;admin@123
219.65.58.58:3389@BIOTECH\administrator;admin@123
124.123.99.31:3389@WIN-RJTS2DUSFC1\administrator;admin@123
122.15.47.237:3389@ADMINISTRATOR\administrator;admin@123
125.63.94.107:3389@LAT039010002\administrator;admin@123
103.50.152.53:3389@BIOTECH\administrator;admin@123
117.252.2.69:3389@ADMINISTRATOR\administrator;admin@123
119.226.187.124:3389@WINDOWS-LJLRPML\administrator;admin@123
125.21.48.42:3389@WINDOWS-LJLRPML\administrator;admin@123
223.30.104.27:3389@WIN-ANRHQC2VF3Q\administrator;admin@123
125.20.83.199:3389@DSKE-1\administrator;admin@123
223.30.126.218:3389@CKHO\administrator;admin@123
59.90.244.200:3389@TEEPARAM-SERVER\administrator;Passw0rd1
14.102.15.38:3389@LAB01\administrator;password@123
124.124.70.194:3389@BRIGADEGROUP\administrator;password@123
220.227.9.77:3389@SCINDIASCHOOL\administrator;password@123
122.200.19.58:3389@ASHTE-RFID\administrator;P@ssw0rd@123
61.12.1.3:3389@WINDOWS-CYMSTZH\administrator;password@1234
182.74.185.140:3389@BIBAAPPARELS\administrator;abc@123
180.211.99.2:3389@GCPL\administrator;
112.196.8.202:3389@LIBRARYSERVER\administrator;
118.185.4.242:3389@SRI01\administrator;
Capture
Beast Trojan Builder – (change to .rar to unzip) Use at own risk.
57c4d9a0-63da-46d3-9e16-b720d27b0f6a

Blog at WordPress.com.

Up ↑

%d bloggers like this: