Iran Cyber Attacks on Saudi Arabia

After a four-year hiatus, Iran recently resumed destructive cyber-attacks against Saudi Arabia in what US officials say is part of a long-term strategy by Tehran to take over the oil-rich kingdom and regional US ally.

Late January 2017, the Saudi government warned, in a notice to telecommunications companies, that an Iranian-origin malicious software called Shamoon had resurfaced in cyber-attacks against some 15 Saudi organisations, including government networks.

The Shamoon malware was last detected in the 2012 cyber-attack against the major Saudi state oil producer Aramco. That cyber-attack damaged or destroyed some 30,000 computers and was considered one of the more destructive state-linked cyber-attacks to date.

A State Department security report issued Feb. 10 stated that the 2012 attack destroyed over three-fourths of Aramco's computers, and that the damage took five months to mitigate at "an extreme cost."

Shamoon also was used in Iranian cyber-attacks against RasGas, a liquified natural gas company located in neighboring Qatar.

A new version of the malware, Shamoon 2, was linked to the recent cyber-attack, which took place in November 2016. Security officials linked that attack to a Middle East hacker group known as Greenbug that used fraudulent emails in phishing scams to acquire login credentials for Saudi networks.

A cyber security expert familiar with details of the latest Saudi cyber-attack who spoke on condition of anonymity said the November incident was “Iranian-directed” and linked to two hacker groups in Iran known as "Cadelle and Chafer” in cyber-security circles.

The new Shamoon 2 "is meant to do damage," the expert said, noting that the recent cyber-attack was not as effective as the earlier one in 2012.

Once inside compromised computer networks, the Iranian hackers were able to steal large amounts of data. They then destroyed the computers using a digital wiping tool that removes all data from the system. The hacked computers were left with a screen image.

In the 2012 Saudi Aramco attack, the Iranians left an image of a burning American flag image. After the November cyber-attack, the hackers left a screen image of a dead Syrian refugee boy.

The Saudis received US government cyber-security and technology training after the 2012 attack. No Shamoon malware was detected until the new variant, Shamoon 2, appeared in November. The US government believes the same Iranian hackers carried out both attacks.

A National Security Agency document from 2013 warned that Iranian government cyber-attacks are part of an expansion of Iranian influence in the Middle East. "NSA has seen Iran further extending its influence across the Middle East over the last year," states the top secret memo, which was disclosed by renegade contractor Edward Snowden.

NSA believed Iran's 2012 cyber-attack was carried out in retaliation for the earlier US cyber-attacks against Iranian nuclear facilities. Those attacks caused nuclear centrifuges to self-destruct using an industrial control software known as Stuxnet.

"NSA expects Iran will continue this series of attacks, which it views as successful, while striving for increased effectiveness by adapting its tactics and techniques to circumvent victim [computer network] mitigation attempts," the NSA said.

The Iranian cyber-attacks are one element of a larger Iranian strategy to subvert and ultimately take over Saudi Arabia, the location of Islam's holy sites, according to US officials.

Predominantly Shiite Iran and predominantly Sunni Saudi Arabia are bitter rivals that vie for influence over the world's Muslims.

The State Department report, "Devastating Cyber Attack Program Returns to Saudi Arabia," warned that US companies operating in the kingdom could be the next targets of Iranian cyber-attacks.

"The increased tensions and unpredictable future between Iran, Saudi Arabia, and the US raises the potential for US organisations in the region to be future targets for a cyber-attack, either with Shamoon or similar malware tuned for destruction rather than corporate espionage or theft," the report said.

In addition to cyber-attacks, Iran seeks to subvert Saudi Arabia through a proxy war in Yemen.

Tehran is backing Houthi rebels against the pro-Saudi government of Yemen. The Houthis took over the capital of Sanaa in 2014. One year later, a Saudi-led coalition of nine regional states intervened in the conflict.

Concerned by large numbers of civilian casualties in the conflict, the Obama administration last year delayed delivery to Saudi Arabia of an arms sale package for large numbers of precision-guided bomb kits. The kits turn gravity bombs into precision-guided weapons that can be directed to targets.

US officials say the Trump administration is ready to lift the ban on the bomb kits to the regional ally because it is no longer concerned by the Obama administration's goal of warmer relations with Tehran.

Under Obama, then-Secretary of State John Kerry tried to negotiate a settlement of the Yemen conflict in a deal with the Houthis. Critics said the deal would have been advantageous to Iran and harmful to the Saudis.

Iran has dispatched a large number of Islamic Revolutionary Guards Corps fighters to Yemen, along with pro-Iranian militia members from Iraq, in a bid to help the Houthis.

Additionally, US officials say Iran is helping the Houthis plant sea mines off the coast of Yemen near the strategic Red Sea choke point known as the Bab-el-Mandeb, a strategic shipping lane between the Indian Ocean, Red Sea, and Suez Canal.

Controlling the Bab-el-Mandeb is said to be a key element of the Iranian strategy of targeting Saudi Arabia. Once in control of the Bab-el-Mandeb, the Iranians could use their control of the region's other strategic chokepoint, the Strait of Hormuz, to exert political leverage throughout the region.

A commercial maritime security notice was sent recently to shipping companies warning that vessels transiting the region should check with the US Navy about the threat of sea mines.

A Saudi warship was recently attacked in waters near Yemen by what is now believed to have been a small, remotely piloted boat loaded with explosives.

The guided missile destroyer USS Cole was recently dispatched to the area following the rebel attack on the Saudi ship.

FreeBeacon:

 

« Google To Break Pirates Over Music Searches
Self-driving Ubers are now in Arizona »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

E-Tech Computing

E-Tech Computing

E-Tech has been providing system support and information technology consulting services including Internet and Network Security assessments.

CEPS

CEPS

CEPS is a leading think tank and forum for debate on EU affairs, ranking among the top think tanks in Europe. Topic areas include Innovation, Digital economy and Cyber-security.

Research Institute in Science of Cyber Security (RISCS)

Research Institute in Science of Cyber Security (RISCS)

RISCS is focused on giving organisations more evidence, to allow them to make better decisions, aiding to the development of cybersecurity as a science.

Ground Labs

Ground Labs

Ground Labs is a security software company dedicated to making sensitive data discovery products that help organisations prevent sensitive data loss.

Fujitsu

Fujitsu

Fujitsu is the leading Japanese global information and communication technology company, offering a full range of products, solutions and services including Managed IT Services and Cyber Security.

Seconize

Seconize

Seconize empowers enterprises to proactively manage their cyber risks, prioritize remediations, optimize security spending and ensure compliance.

Emirates International Accreditation Center (EIAC)

Emirates International Accreditation Center (EIAC)

EIACI is the national accreditation body for the United Arab Emirates. The directory of members provides details of organisations offering certification services for ISO 27001.

FutureCon Events

FutureCon Events

FutureCon produces cutting edge events aimed for Senior Level Professionals working in the security community, bringing together the best minds in the industry for a unique cybersecurity event.

Base Cyber Security

Base Cyber Security

Base Cyber Security is an information and cyber security talent service provider and career specialist.

Hub One

Hub One

Hub one is a leading player in digital transformation with expertise in broadband connectivity, business solutions for traceability and mobility, IOT in industrial environments and cybersecurity.

Inceptus

Inceptus

Inceptus is a next generation Managed Security Service Provider (MSSP). We are dedicated to keeping our customers safe, secure and protected while doing business on the Internet.

Onclave Networks

Onclave Networks

Onclave Networks is a global cybersecurity leader, transforming the future of securing all IT/OT devices and systems.

Noblis

Noblis

Noblis is a dynamic science, technology, and strategy organization dedicated to creating forward-thinking technical and advisory solutions in the public interest.

Otorio

Otorio

OTORIO delivers industrial cybersecurity and digital risk-management solutions and services. We help our customers to keep their revenue-generating operations resilient, efficient, and safe.

Cyberwatch Finland

Cyberwatch Finland

Cyberwatch Finland's services improve decision-makers’ strategic situational picture and enable successful holistic cyber risk management.

Northdoor

Northdoor

Northdoor provides a comprehensive set of services around information security and works with leading global technology vendors to deploy and manage cyber security solutions.