IRGC-affiliated actors exploit exchange, VMware, Fortinet for ransom
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Iranian Revolutionary Guard Corps-affiliated APT exploits known vulnerabilities in Exchange, Fortinet, and VMware systems for disk encryption and data extortion ransom operations.
U.S. and allied cybersecurity authorities assess that Iranian Islamic Revolutionary Guard Corps (IRGC)-affiliated cyber actors are actively exploiting known vulnerabilities to gain initial access to networks across multiple critical infrastructure sectors in the United States, Australia, Canada, and the United Kingdom. The actors exploit CVE-2021-34473 and related ProxyShell vulnerabilities in Microsoft Exchange servers, CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591 in Fortinet FortiOS, and CVE-2021-44228, CVE-2021-45046, and CVE-2021-45105 (Log4Shell) in VMware Horizon. After gaining initial access, the actors establish persistence through new user accounts, move laterally across networks, and then deploy BitLocker encryption for ransom operations, often combined with data exfiltration for double-extortion attacks. The actors operate under cover of Iran-based companies Najee Technology Hooshmand Fater LLC and Afkar System Yazd Company. Documented incidents include attacks on a U.S. police department, regional transportation company causing extended operational disruption, a municipal government with crypto-mining follow-on activity, and a U.S. aerospace company. Defenders should prioritize patching the identified vulnerabilities, enforce MFA, maintain offline backups, and implement network segmentation to limit lateral movement.
Mentioned in this report
Detection guidance
Local or Domain User Account Created via Net Command
net.exe/net1.exe used to add a user account (local, or domain with /domain), matching the persistence-through-new-accounts behaviour in the IRGC intrusions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Local or Domain User Account Created via Net Command
description: Detects net.exe or net1.exe adding a user account with 'user ... /add'.
The IRGC-affiliated actors created new local and domain accounts for persistence
after exploiting public-facing applications. Presence of /domain indicates a domain
account. Review the creating parent process and account name.
tags:
- attack.persistence
- attack.t1136.001
- attack.t1136.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \net.exe
- \net1.exe
CommandLine|contains|all:
- ' user '
- ' /add'
condition: selection
falsepositives:
- Helpdesk or onboarding scripts that create local or domain accounts with net user
- Software installers creating dedicated service accounts
level: medium
id: 4a336b58-3b2c-5bf9-83a8-35ace8e5e8da
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-257a
BitLocker Encryption Enabled via Command Line or PowerShell
manage-bde or Enable-BitLocker used to turn on drive encryption, as abused by IRGC-affiliated actors for ransom. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: BitLocker Encryption Enabled via Command Line or PowerShell
description: Detects manage-bde.exe turning on BitLocker protection or PowerShell
Enable-BitLocker being invoked. The actors deployed BitLocker to encrypt victim
systems for ransom. Most relevant on servers or on hosts not managed by an enterprise
BitLocker rollout.
tags:
- attack.impact
- attack.t1486
logsource:
category: process_creation
product: windows
detection:
selection_bde:
Image|endswith: \manage-bde.exe
CommandLine|contains:
- ' -on'
- ' /on'
selection_ps:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains: Enable-BitLocker
condition: 1 of selection_*
falsepositives:
- Legitimate IT provisioning of disk encryption on new endpoints
- MDM or imaging task sequences that enable BitLocker
level: medium
id: 5fb640e7-17f2-5705-b831-af1403ba0e15
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-257a
VMware Horizon Tomcat Service Spawning Command Shell
The VMware Horizon Tomcat service launching a shell or script interpreter, indicating Log4Shell exploitation of Horizon. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: VMware Horizon Tomcat Service Spawning Command Shell
description: Detects the VMware Horizon Tomcat service process spawning cmd, PowerShell,
or script hosts. This is consistent with post-exploitation after Log4Shell (CVE-2021-44228
and related) in VMware Horizon, which the IRGC-affiliated actors used for initial
access.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \ws_TomcatService.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
condition: selection
falsepositives:
- Rare administrative scripts launched by the Horizon Connection Server during maintenance
level: high
id: 584ba47b-26e6-5e52-b3eb-6f16f3575a6e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-257a
3 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-257a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs