Cyber Threats in a Time of Heightened Middle East Tensions: What UK CISOs Can Expect

As worst-case scenarios go, they don’t get much worse than a company-wide wipe of all connected devices. Yet that’s the reality that US medtech firm Stryker is facing up to after being hit by pro-Iranian hackers on March 11. The Handala group claimed to have wiped 200,000 endpoints and stolen 50TB of data. Time will tell whether this is accurate or not, but at the time of writing, Stryker admitted that the attack “resulted in a global disruption to the company’s Microsoft environment”.

The question is to what extent UK organisations will be exposed as the cyber war escalates. If the current regime hunkers down for the long game and starts lashing out online, it could portend the start of a dangerous new period.

Is It Time to Worry?

The National Cyber Security Centre (NCSC) issued guidance on March 2, soon after US and Israeli bombs started falling on Iran. It doesn’t believe there has been a “significant change in the direct cyber threat from Iran”. Although the Stryker attack appears not to have changed this calculus, this assessment could change in the future. Drones have already been fired at an RAF airbase in Cyprus. So, it’s not beyond the realms of possibility that cyber-attacks could also be launched at UK firms, especially those with Israeli links (like Stryker has).

Organisations that do need to be more concerned are those with a presence (i.e. branch offices) or supply chains in the Middle East. The risk could stem from physical or digital attacks. Three AWS  datacentres in the UAE and Bahrain have already been struck by drones leading to outages, for example. Meanwhile, cyber-attacks on branch offices or regional supply chains could theoretically allow intruders to gain a foothold into systems with a view to moving into connected networks elsewhere.

Adding to the concern, the Islamic Revolutionary Guard Corps (IRGC) has now named several US tech firms as targets due to Israeli ties or cloud services, according to Flashpoint. These are AWS, Google, Microsoft, Oracle and IBM, as well as Nvidia and Palantir. Regional banking centres linked to the US and Israel have also been singled out by the regime.

What to Expect

If UK firms and/or their partners are singled out by Iranian hackers, what can they expect? According to analysis by Halcyon, the threat comes potentially from state-backed hackers and linked hacktivist groups:

“We anticipate that Iran may use attempted obfuscation, proxies, and destructive tools against US networks in the coming weeks:

• Using Distributed Denial of Service (DDoS) against hosting providers.

• Deploying ransomware before wiping an organisation’s data and/or using destructionware, or destructive malware, that render system recovery impossible

• Leveraging long-term access for espionage and data exfiltration for destructive attacks and/or to locate dissidents for further targeting.”

It should be of some concern that Iranian threat actors may already be pre-positioned inside some corporate networks, as per this report. Think tank the Center for Strategic and International Studies (CSIS) says: “financial services, water utilities, and transportation infrastructure, many of which rely on outdated control systems, remain attractive targets for Iranian actors as kinetic conflict intensifies.”

SonicWall SVP of managed services, Michael Crean, tells IO (formerly ISMS.online) that threat actors are moving away from “large-scale scanning and DDoS activity” towards vulnerability exploitation.

“Attackers are increasingly targeting web applications, databases and servers using techniques such as SQL injection, path traversal and remote code execution. These types of attacks are often designed to gain initial access to systems before moving deeper into a network,” he continues.

“If tensions continue, we could see disruptive activity such as website defacements, data theft and leaks, or DDoS attacks against public-facing services. Destructive malware such as wipers is possible during escalation, although the current data mainly indicates probing and exploitation rather than widespread destructive attacks.”

Time to Build Resilience

Destruction was the name of the game with Stryker, and according to reports it didn’t even require the delivery of malware – simply the compromise of an Intune admin account. That shows why holistic resilience efforts must be a priority.

The NCSC urges UK CISOs to consult previously issued advisories on DDoS attacks, phishing activity and targeting of industrial control systems (ICS). For those with supply chains or offices in the region, it recommends its guide to resilience at times of heightened threats. Critical infrastructure (CNI) providers are urged to prepare now. 

SonicWall’s Crean says CISOs should focus on visibility, patching and preparation.

“Businesses should also review their supply chain exposure and assess the cybersecurity posture of key vendors and partners. Enhanced monitoring for unusual authentication activity, web application anomalies and lateral movement can help detect early signs of compromise,” he adds.

“Finally, incident response plans should be tested and ready so organisations can respond quickly if cyber activity linked to geopolitical tensions begins to spread.”

James Shank, director of threat operations at Expel, urges security leaders to keep a cool head and focus on the “fundamentals” to improve security posture.

“Stress the importance of being suspicious of communications and apply this to your service desk too. Consider adding additional checks for things like password resets or MFA changes,” he tells IO. “Tighten authentication by increasing challenge frequency, reducing session timeouts, and enforcing stricter controls on access policies. Enforce least privilege and lock down access management.”

CISOs should also audit log activity for suspicious logins, lateral movement and privilege escalation, considering the possibility of pre-positioned access. OT observability is important too, so OT/ICS should be included in these audits.

“Finally, increase communication across your teams,” Shank advises. “Context sharing between security, IT, OT and the business slows attackers down more than people expect.”

Discipline Amid Chaos

Standards like ISO 27001 can play an important role at times like this in enforcing discipline, Shank continues. “Crisis moments can result in chaos, over-pivoting, and a lack of clarity on priorities,” he says. “Frameworks provide guidance to maintain clear and consistent accountability, which means chaos gets managed, and diligence prevails.”

SonicWall’s Crean agrees, arguing that best practice frameworks provide much-needed structure to cyber-risk management.

“ISO 27001 is a global framework for building an information security management system that helps organisations identify critical assets, assess risks and implement appropriate controls. It covers areas such as access management, incident response, supplier security and business continuity,” he concludes.

“While standards cannot prevent cyber-attacks on their own, they help ensure organisations have the governance, processes and resilience needed to respond effectively when threats increase during periods of geopolitical tension.”