DEV-0270

Last Updated

Also known as: DEV-0270, DireFate, Lord Nemesis, Nemesis Kitten, Storm-0270, Yellow Dev 23, Yellow Dev 24

Microsoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS. Microsoft assesses with moderate confidence that DEV-0270 conducts malicious network operations, including widespread vulnerability scanning, on behalf of the government of Iran.

🌍 Country Iran
📝 Last Updated

Associated Operations

2023-11 Lord Nemesis Strikes: Supply Chain Attack on the Israeli Academic Sector https://op-c.net/blog/lord-nemesis-strikes-supply-chain-attack-on-the-israeli-academic-sector/

Introduction

Microsoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS. Microsoft assesses with moderate confidence that DEV-0270 conducts malicious network operations, including widespread vulnerability scanning, on behalf of the government of Iran.

Activities and Tactics

Country of Origin: 🇮🇷 Iran

Notable Campaigns

  • 2023-11
  • Lord Nemesis Strikes: Supply Chain Attack on the Israeli Academic Sector
  • https://op-c.net/blog/lord-nemesis-strikes-supply-chain-attack-on-the-israeli-academic-sector/

Tactics, Techniques, and Procedures (TTPs)

Ransomware Vulnerability Matrix observations

Category Vendor Product CVEs
Network Edge Fortinet FortiOS CVE-2019-5591

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Impacket:
  • Living off the Land:
  • WmiExec:

Attribution and Evidence

Country of Origin: Iran Additional attribution information pending cataloguing.

References

References pending cataloguing.