Iran-based actor exploits VPN flaws for U.S. targeting
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Iran-based threat actor exploits Pulse Secure, Citrix, and F5 VPN vulnerabilities to target U.S. federal agencies and private networks for persistent access and data theft.
CISA and FBI report a sustained campaign by an Iran-based malicious cyber actor targeting U.S. federal agencies and private networks across information technology, government, healthcare, financial, insurance, and media sectors. The threat actor, correlated with Pioneer Kitten and UNC757, conducts mass-scanning using tools like Nmap to identify open ports, then exploits publicly known VPN vulnerabilities to gain initial access. Primary CVEs exploited include CVE-2019-11510 and CVE-2019-11539 (Pulse Secure), CVE-2019-19781 (Citrix NetScaler), and CVE-2020-5902 (F5 BIG-IP). Once inside, the actor obtains administrator-level credentials, installs web shells (ChunkyTuna, Tiny, China Chopper), and maintains persistence for months using reverse proxies (ngrok, FRP) and legitimate tools (TightVNC, Plink). The actor has been observed selling access to compromised infrastructure and has ransomware deployment capability. While data exfiltration has not been directly observed, the use of 7-Zip and sensitive document access suggests intent to steal data.
Mentioned in this report
Detection guidance
TightVNC Service Named Pipe Created
Detects creation of named pipes associated with TightVNC server, which the actor used as a legitimate remote-access tool for persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: TightVNC Service Named Pipe Created
description: Detects creation of named pipes used by the TightVNC server service.
The report describes the actor using TightVNC for months-long persistence on compromised
hosts. Unexpected TightVNC on servers or VPN-adjacent systems warrants review.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
category: pipe_created
product: windows
detection:
selection:
PipeName:
- \TVN_log_pipe_public_name
- \TightVNC_Service_Control
- \mlnhcpkomdeavomsjalt
condition: selection
falsepositives:
- Administrator-sanctioned TightVNC deployments for remote support
level: medium
id: 3b278b8a-129d-5e4d-89d4-b2f48cbadf55
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
Plink Remote Port Forwarding Tunnel
Detects plink.exe launched with a remote forward (-R) option, used to build reverse SSH tunnels out of a compromised network. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Plink Remote Port Forwarding Tunnel
description: Detects plink.exe executed with the -R remote port forward option, creating
a reverse SSH tunnel to an external host. The report names Plink among the legitimate
tools used by the actor to maintain access. Matches the technique pattern, not any
specific host or port.
tags:
- attack.lateral-movement
- attack.t1021.004
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \plink.exe
- OriginalFileName: Plink
selection_cli:
CommandLine|contains: ' -R '
condition: selection_img and selection_cli
falsepositives:
- Administrators using Plink for sanctioned SSH port forwarding to internal jump hosts
level: high
id: a6671730-df8a-5784-aaca-7cbbc0906dca
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
Reverse Proxy Tool ngrok or FRP Client Execution
Detects execution of ngrok or FRP client with tunnelling arguments, used to keep persistent external access into a compromised network. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reverse Proxy Tool ngrok or FRP Client Execution
description: Detects ngrok or FRP client (frpc) execution with tunnel or config arguments.
The report describes the actor maintaining persistence via reverse proxies such
as ngrok and FRP after exploiting VPN appliances.
tags:
- attack.persistence
- attack.t1133
logsource:
category: process_creation
product: windows
detection:
selection_ngrok:
Image|endswith: \ngrok.exe
CommandLine|contains:
- ' tcp '
- ' http '
- ' authtoken'
- ' start '
selection_frp:
Image|endswith: \frpc.exe
CommandLine|contains:
- ' -c '
- .ini
- .toml
condition: 1 of selection_*
falsepositives:
- Developers using ngrok to expose local test services
- Sanctioned FRP usage by IT for remote access
level: high
id: 1f74e068-5688-5a4a-a513-b5ae05aca807
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs