# Iran-based actor exploits VPN flaws for U.S. targeting

Published: 2026-03-10 · Severity: high · Sectors: government-national, defense, healthcare, financial-services, technology, media
Canonical: https://vorant.io/reports/e1c69b89-389c-579a-acc8-f5d7e8c874f7/iran-based-actor-exploits-vpn-flaws-for-u-s-targeting

> Iran-based threat actor exploits Pulse Secure, Citrix, and F5 VPN vulnerabilities to target U.S. federal agencies and private networks for persistent access and data theft.

CISA and FBI report a sustained campaign by an Iran-based malicious cyber actor targeting U.S. federal agencies and private networks across information technology, government, healthcare, financial, insurance, and media sectors. The threat actor, correlated with Pioneer Kitten and UNC757, conducts mass-scanning using tools like Nmap to identify open ports, then exploits publicly known VPN vulnerabilities to gain initial access. Primary CVEs exploited include CVE-2019-11510 and CVE-2019-11539 (Pulse Secure), CVE-2019-19781 (Citrix NetScaler), and CVE-2020-5902 (F5 BIG-IP). Once inside, the actor obtains administrator-level credentials, installs web shells (ChunkyTuna, Tiny, China Chopper), and maintains persistence for months using reverse proxies (ngrok, FRP) and legitimate tools (TightVNC, Plink). The actor has been observed selling access to compromised infrastructure and has ransomware deployment capability. While data exfiltration has not been directly observed, the use of 7-Zip and sensitive document access suggests intent to steal data.

## Mentioned in this report

- Vulnerabilities: CVE-2019-11510 (KEV), CVE-2019-11539 (KEV), CVE-2019-19781 (KEV), CVE-2020-5902 (KEV)
- Threat actors: Fox Kitten
- Malware: China Chopper, Chisel, ChunkyTuna, Tiny

## Detection guidance (public sample)

### TightVNC Service Named Pipe Created

ATT&CK: T1021.005

Detects creation of named pipes associated with TightVNC server, which the actor used as a legitimate remote-access tool for persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: TightVNC Service Named Pipe Created
description: Detects creation of named pipes used by the TightVNC server service.
  The report describes the actor using TightVNC for months-long persistence on compromised
  hosts. Unexpected TightVNC on servers or VPN-adjacent systems warrants review.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName:
    - \TVN_log_pipe_public_name
    - \TightVNC_Service_Control
    - \mlnhcpkomdeavomsjalt
  condition: selection
falsepositives:
- Administrator-sanctioned TightVNC deployments for remote support
level: medium
id: 3b278b8a-129d-5e4d-89d4-b2f48cbadf55
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
```

### Plink Remote Port Forwarding Tunnel

ATT&CK: T1021.004

Detects plink.exe launched with a remote forward (-R) option, used to build reverse SSH tunnels out of a compromised network. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Plink Remote Port Forwarding Tunnel
description: Detects plink.exe executed with the -R remote port forward option, creating
  a reverse SSH tunnel to an external host. The report names Plink among the legitimate
  tools used by the actor to maintain access. Matches the technique pattern, not any
  specific host or port.
tags:
- attack.lateral-movement
- attack.t1021.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith: \plink.exe
  - OriginalFileName: Plink
  selection_cli:
    CommandLine|contains: ' -R '
  condition: selection_img and selection_cli
falsepositives:
- Administrators using Plink for sanctioned SSH port forwarding to internal jump hosts
level: high
id: a6671730-df8a-5784-aaca-7cbbc0906dca
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
```

### Reverse Proxy Tool ngrok or FRP Client Execution

ATT&CK: T1133

Detects execution of ngrok or FRP client with tunnelling arguments, used to keep persistent external access into a compromised network. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Reverse Proxy Tool ngrok or FRP Client Execution
description: Detects ngrok or FRP client (frpc) execution with tunnel or config arguments.
  The report describes the actor maintaining persistence via reverse proxies such
  as ngrok and FRP after exploiting VPN appliances.
tags:
- attack.persistence
- attack.t1133
logsource:
  category: process_creation
  product: windows
detection:
  selection_ngrok:
    Image|endswith: \ngrok.exe
    CommandLine|contains:
    - ' tcp '
    - ' http '
    - ' authtoken'
    - ' start '
  selection_frp:
    Image|endswith: \frpc.exe
    CommandLine|contains:
    - ' -c '
    - .ini
    - .toml
  condition: 1 of selection_*
falsepositives:
- Developers using ngrok to expose local test services
- Sanctioned FRP usage by IT for remote access
level: high
id: 1f74e068-5688-5a4a-a513-b5ae05aca807
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e1c69b89-389c-579a-acc8-f5d7e8c874f7/iran-based-actor-exploits-vpn-flaws-for-u-s-targeting.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup