Lebanese APT Group Compromises 250 Servers Worldwide

Summary

According to Israeli cybersecurity firm ClearSky, an advanced persistent threat (APT) group compromised approximately 250 servers, many from telecommunications and IT companies across the world, including in the United States. The threat actor used vulnerable public-facing web servers as the initial attack vector and then used several tools to conduct reconnaissance, gain persistence, and evade detection. The APT is tracked as “Lebanese Cedar” and is believed to be connected to the Hezbollah Cyber Unit.

Recommendations

The NJCCIC recommends organizations review the ClearSky report and search networks using the indicators of compromise provided. Additionally, keep servers up to date and placed behind a firewall.