Iranian hackers breach VPN servers to plant backdoors in corporate networks worldwide
Researchers at cyber security firm ClearSky claim to have uncovered an Iranian hacking campaign intended to gain a persistent foothold on the networks of major companies worldwide.
The campaign, dubbed Fox Kitten, was first noticed in the fourth quarter of 2019, although it represents the continuation of attacks that have been running for the past three years, targeting dozens of companies in Israel and around the world.
Iranian state-sponsored threat groups, part of the Fox Kitten campaign, are specifically focusing on VPN security vulnerabilities and exploiting them as soon as they are disclosed to the public. The aim is to plant backdoors in the networks of foreign firms, specifically in IT, telecoms, aviation, oil and gas, security and government sectors. The ClearSky report warns that Iranian APT groups are in no way less capable than Chinese, Russian and North Korean hackers, and have developed good technical capabilities to exploit security bugs in short periods of time. In some cases, the researchers observed hackers exploiting VPN bugs within hours after they were disclosed.
