Iranian APT34 Targets Iraqi Government with New Veaty and Spearal Malware Campaign

Introduction

On September 12, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released a comprehensive set of 25 advisories targeting vulnerabilities in industrial control systems (ICS). These advisories highlight current security issues, potential exploits, and mitigations for ICS components, which are critical to the operation of energy grids, manufacturing, and other industrial sectors.

Report Overview

Industrial control systems (ICS) have increasingly become a focal point for cyber threats due to their critical role in infrastructure. The recent advisories were issued after security researchers identified various vulnerabilities across a range of industrial products from major vendors like Siemens, Rockwell Automation, and AutomationDirect. CISA’s timely release of these advisories serves to inform administrators and users about the risks and available mitigations, reinforcing the importance of proactive cyber defense measures in industrial environments.

The vulnerabilities span across several high-profile industrial systems:

• Siemens SINEMA Remote Connect Server (ICSA-24-256-01): This vulnerability involves improper authentication handling that could allow attackers to bypass security controls.
• Siemens SINUMERIK Systems (ICSA-24-256-04): An issue with code execution within SINUMERIK systems could lead to unauthorized remote control of critical machinery.
• Rockwell Automation ControlLogix and GuardLogix 5580 (ICSA-24-256-18): This vulnerability exposes key systems to potential remote code execution, making it one of the more severe advisories in this set.
• Siemens SIMATIC SCADA and PCS 7 Systems (ICSA-24-256-14): These critical systems, responsible for monitoring and control, are susceptible to privilege escalation, enabling attackers to take full control of ICS components.

CISA’s advisories include detailed technical information for each vulnerability, including CVE numbers, attack vectors, and the complexity of exploitation. Several of these advisories point to remote code execution, privilege escalation, and denial of service, all of which could have significant operational impacts.

The vulnerabilities affect several major industries, including manufacturing, energy, and telecommunications. If exploited, attackers could disrupt essential services, cause operational failures, or even physically damage equipment. This could result in significant financial losses, operational downtime, and risks to human safety, especially in sectors where ICS components are used to manage critical infrastructure.

Among the most significant vulnerabilities is the Siemens SINUMERIK Systems (ICSA-24-256-04) advisory, which could allow remote attackers to control industrial machines. Given the global reliance on Siemens systems, this flaw poses a major threat to industrial security.

Insights and Analysis

CISA has emphasized the importance of addressing these vulnerabilities promptly. As noted in the advisory, "Administrators and users must assess the risks and deploy necessary mitigations to protect against potential exploitation." The agency advises system administrators to update affected components, apply patches where available, and implement network segmentation to reduce the risk of lateral movement in case of an initial breach.

To mitigate these risks, CISA recommends several steps for users and administrators:

• Patch management: Apply the latest security updates provided by vendors such as Siemens and Rockwell Automation.
• Network segmentation: Isolate ICS networks from corporate networks and the internet to minimize exposure.
• Monitoring and logging: Regularly monitor systems for unusual activity and maintain logs to detect potential breaches.

In light of the increasing threats to critical infrastructure, timely action is essential. The release of these 25 advisories underscores the importance of safeguarding industrial control systems, and the need for organizations to remain vigilant in their cybersecurity efforts.

For further details, users are encouraged to review the individual ICS advisories released by CISA.

References

Targeted Iranian Attacks Against Iraqi Government Infrastructure - Check Point Research

Veaty and Spearal, a new set of malware connected to Iranian sources, were found attacking Iraqi governmental infrastructures

Check Point Researchstcpresearch