A sophisticated cyber intrusion targeting critical national infrastructure in the Middle East has been uncovered, with evidence pointing to an Iranian state-sponsored threat group. The adversaries employed a chain of open-source proxying tools-including plink, Ngrok, glider proxy, and ReverseSocks5-to traverse security boundaries and penetrate deeper into restricted network segments, including those potentially connected to operational technology (OT) environments. These tools demonstrate the evolving capability set of Iranian cyber operators and highlight the continued threat to critical infrastructure globally. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Fortinet researchers identified particularly concerning efforts by the attackers to bypass network segmentation, a security measure specifically designed to prevent such lateral movement. From these initial access points, the attackers methodically expanded their presence, installing sophisticated backdoors including Havoc, HanifNet, HXLibrary, and NeoExpressRAT. These tools enabled comprehensive command execution, file operations, and critical system discovery capabilities across the compromised infrastructure. The attackers also employed HXLibrary, a malicious IIS module providing deep system control, and NeoExpressRAT, a Golang-based backdoor with hardcoded C2 communication capabilities. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. The HanifNet backdoor represents a sophisticated .NET-based tool designed for maintaining persistent access to compromised systems. Initial investigation reveals signs of compromise dating back as early as May 2021, indicating a long-term strategic operation designed for intelligence gathering and potential prepositioning for future attacks. The threat actors initially gained access through compromised VPN credentials, subsequently deploying multiple web shells on public-facing servers to establish footholds within the victim’s environment. Its communication with command and control infrastructure was carefully obfuscated to evade traditional security monitoring.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 05 May 2025 13:00:04 +0000