# IRGC-affiliated actors exploit exchange, VMware, Fortinet for ransom

Published: 2026-03-10 · Severity: high · Sectors: government-national, defense, transportation, energy, healthcare, infrastructure, financial-services, manufacturing
Canonical: https://vorant.io/reports/34bfb477-eeb7-5dfb-85ea-2f26f3710f56/irgc-affiliated-actors-exploit-exchange-vmware-fortinet-for-ransom

> Iranian Revolutionary Guard Corps-affiliated APT exploits known vulnerabilities in Exchange, Fortinet, and VMware systems for disk encryption and data extortion ransom operations.

U.S. and allied cybersecurity authorities assess that Iranian Islamic Revolutionary Guard Corps (IRGC)-affiliated cyber actors are actively exploiting known vulnerabilities to gain initial access to networks across multiple critical infrastructure sectors in the United States, Australia, Canada, and the United Kingdom. The actors exploit CVE-2021-34473 and related ProxyShell vulnerabilities in Microsoft Exchange servers, CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591 in Fortinet FortiOS, and CVE-2021-44228, CVE-2021-45046, and CVE-2021-45105 (Log4Shell) in VMware Horizon. After gaining initial access, the actors establish persistence through new user accounts, move laterally across networks, and then deploy BitLocker encryption for ransom operations, often combined with data exfiltration for double-extortion attacks. The actors operate under cover of Iran-based companies Najee Technology Hooshmand Fater LLC and Afkar System Yazd Company. Documented incidents include attacks on a U.S. police department, regional transportation company causing extended operational disruption, a municipal government with crypto-mining follow-on activity, and a U.S. aerospace company. Defenders should prioritize patching the identified vulnerabilities, enforce MFA, maintain offline backups, and implement network segmentation to limit lateral movement.

## Mentioned in this report

- Vulnerabilities: CVE-2018-13379 (KEV), CVE-2019-5591 (KEV), CVE-2020-12812 (KEV), CVE-2021-31196 (KEV), CVE-2021-31206, CVE-2021-31207 (KEV), CVE-2021-33766 (KEV), CVE-2021-33768, CVE-2021-34470, CVE-2021-34473 (KEV), CVE-2021-34523 (KEV), CVE-2021-44228 (KEV), CVE-2021-45046 (KEV), CVE-2021-45105
- Threat actors: IRGC-affiliated APT

## Detection guidance (public sample)

### Local or Domain User Account Created via Net Command

ATT&CK: T1136.001

net.exe/net1.exe used to add a user account (local, or domain with /domain), matching the persistence-through-new-accounts behaviour in the IRGC intrusions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Local or Domain User Account Created via Net Command
description: Detects net.exe or net1.exe adding a user account with 'user ... /add'.
  The IRGC-affiliated actors created new local and domain accounts for persistence
  after exploiting public-facing applications. Presence of /domain indicates a domain
  account. Review the creating parent process and account name.
tags:
- attack.persistence
- attack.t1136.001
- attack.t1136.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \net.exe
    - \net1.exe
    CommandLine|contains|all:
    - ' user '
    - ' /add'
  condition: selection
falsepositives:
- Helpdesk or onboarding scripts that create local or domain accounts with net user
- Software installers creating dedicated service accounts
level: medium
id: 4a336b58-3b2c-5bf9-83a8-35ace8e5e8da
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-257a
```

### BitLocker Encryption Enabled via Command Line or PowerShell

ATT&CK: T1486

manage-bde or Enable-BitLocker used to turn on drive encryption, as abused by IRGC-affiliated actors for ransom. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: BitLocker Encryption Enabled via Command Line or PowerShell
description: Detects manage-bde.exe turning on BitLocker protection or PowerShell
  Enable-BitLocker being invoked. The actors deployed BitLocker to encrypt victim
  systems for ransom. Most relevant on servers or on hosts not managed by an enterprise
  BitLocker rollout.
tags:
- attack.impact
- attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_bde:
    Image|endswith: \manage-bde.exe
    CommandLine|contains:
    - ' -on'
    - ' /on'
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains: Enable-BitLocker
  condition: 1 of selection_*
falsepositives:
- Legitimate IT provisioning of disk encryption on new endpoints
- MDM or imaging task sequences that enable BitLocker
level: medium
id: 5fb640e7-17f2-5705-b831-af1403ba0e15
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-257a
```

### VMware Horizon Tomcat Service Spawning Command Shell

ATT&CK: T1190

The VMware Horizon Tomcat service launching a shell or script interpreter, indicating Log4Shell exploitation of Horizon. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: VMware Horizon Tomcat Service Spawning Command Shell
description: Detects the VMware Horizon Tomcat service process spawning cmd, PowerShell,
  or script hosts. This is consistent with post-exploitation after Log4Shell (CVE-2021-44228
  and related) in VMware Horizon, which the IRGC-affiliated actors used for initial
  access.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \ws_TomcatService.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
  condition: selection
falsepositives:
- Rare administrative scripts launched by the Horizon Connection Server during maintenance
level: high
id: 584ba47b-26e6-5e52-b3eb-6f16f3575a6e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-257a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-257a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/34bfb477-eeb7-5dfb-85ea-2f26f3710f56/irgc-affiliated-actors-exploit-exchange-vmware-fortinet-for-ransom.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup