Iran Cyber Attacks on Saudi Arabia

After a four-year hiatus, Iran recently resumed destructive cyber-attacks against Saudi Arabia in what US officials say is part of a long-term strategy by Tehran to take over the oil-rich kingdom and regional US ally.

Late January 2017, the Saudi government warned, in a notice to telecommunications companies, that an Iranian-origin malicious software called Shamoon had resurfaced in cyber-attacks against some 15 Saudi organisations, including government networks.

The Shamoon malware was last detected in the 2012 cyber-attack against the major Saudi state oil producer Aramco. That cyber-attack damaged or destroyed some 30,000 computers and was considered one of the more destructive state-linked cyber-attacks to date.

A State Department security report issued Feb. 10 stated that the 2012 attack destroyed over three-fourths of Aramco's computers, and that the damage took five months to mitigate at "an extreme cost."

Shamoon also was used in Iranian cyber-attacks against RasGas, a liquified natural gas company located in neighboring Qatar.

A new version of the malware, Shamoon 2, was linked to the recent cyber-attack, which took place in November 2016. Security officials linked that attack to a Middle East hacker group known as Greenbug that used fraudulent emails in phishing scams to acquire login credentials for Saudi networks.

A cyber security expert familiar with details of the latest Saudi cyber-attack who spoke on condition of anonymity said the November incident was “Iranian-directed” and linked to two hacker groups in Iran known as "Cadelle and Chafer” in cyber-security circles.

The new Shamoon 2 "is meant to do damage," the expert said, noting that the recent cyber-attack was not as effective as the earlier one in 2012.

Once inside compromised computer networks, the Iranian hackers were able to steal large amounts of data. They then destroyed the computers using a digital wiping tool that removes all data from the system. The hacked computers were left with a screen image.

In the 2012 Saudi Aramco attack, the Iranians left an image of a burning American flag image. After the November cyber-attack, the hackers left a screen image of a dead Syrian refugee boy.

The Saudis received US government cyber-security and technology training after the 2012 attack. No Shamoon malware was detected until the new variant, Shamoon 2, appeared in November. The US government believes the same Iranian hackers carried out both attacks.

A National Security Agency document from 2013 warned that Iranian government cyber-attacks are part of an expansion of Iranian influence in the Middle East. "NSA has seen Iran further extending its influence across the Middle East over the last year," states the top secret memo, which was disclosed by renegade contractor Edward Snowden.

NSA believed Iran's 2012 cyber-attack was carried out in retaliation for the earlier US cyber-attacks against Iranian nuclear facilities. Those attacks caused nuclear centrifuges to self-destruct using an industrial control software known as Stuxnet.

"NSA expects Iran will continue this series of attacks, which it views as successful, while striving for increased effectiveness by adapting its tactics and techniques to circumvent victim [computer network] mitigation attempts," the NSA said.

The Iranian cyber-attacks are one element of a larger Iranian strategy to subvert and ultimately take over Saudi Arabia, the location of Islam's holy sites, according to US officials.

Predominantly Shiite Iran and predominantly Sunni Saudi Arabia are bitter rivals that vie for influence over the world's Muslims.

The State Department report, "Devastating Cyber Attack Program Returns to Saudi Arabia," warned that US companies operating in the kingdom could be the next targets of Iranian cyber-attacks.

"The increased tensions and unpredictable future between Iran, Saudi Arabia, and the US raises the potential for US organisations in the region to be future targets for a cyber-attack, either with Shamoon or similar malware tuned for destruction rather than corporate espionage or theft," the report said.

In addition to cyber-attacks, Iran seeks to subvert Saudi Arabia through a proxy war in Yemen.

Tehran is backing Houthi rebels against the pro-Saudi government of Yemen. The Houthis took over the capital of Sanaa in 2014. One year later, a Saudi-led coalition of nine regional states intervened in the conflict.

Concerned by large numbers of civilian casualties in the conflict, the Obama administration last year delayed delivery to Saudi Arabia of an arms sale package for large numbers of precision-guided bomb kits. The kits turn gravity bombs into precision-guided weapons that can be directed to targets.

US officials say the Trump administration is ready to lift the ban on the bomb kits to the regional ally because it is no longer concerned by the Obama administration's goal of warmer relations with Tehran.

Under Obama, then-Secretary of State John Kerry tried to negotiate a settlement of the Yemen conflict in a deal with the Houthis. Critics said the deal would have been advantageous to Iran and harmful to the Saudis.

Iran has dispatched a large number of Islamic Revolutionary Guards Corps fighters to Yemen, along with pro-Iranian militia members from Iraq, in a bid to help the Houthis.

Additionally, US officials say Iran is helping the Houthis plant sea mines off the coast of Yemen near the strategic Red Sea choke point known as the Bab-el-Mandeb, a strategic shipping lane between the Indian Ocean, Red Sea, and Suez Canal.

Controlling the Bab-el-Mandeb is said to be a key element of the Iranian strategy of targeting Saudi Arabia. Once in control of the Bab-el-Mandeb, the Iranians could use their control of the region's other strategic chokepoint, the Strait of Hormuz, to exert political leverage throughout the region.

A commercial maritime security notice was sent recently to shipping companies warning that vessels transiting the region should check with the US Navy about the threat of sea mines.

A Saudi warship was recently attacked in waters near Yemen by what is now believed to have been a small, remotely piloted boat loaded with explosives.

The guided missile destroyer USS Cole was recently dispatched to the area following the rebel attack on the Saudi ship.

FreeBeacon:

 

« Google To Break Pirates Over Music Searches
Self-driving Ubers are now in Arizona »

Quartz Conference
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Acumin

Acumin

Acumin is an internationally established Cyber Security recruitment specialist.

Cambray Solutions

Cambray Solutions

Cambray Solutions LLC., is a leading technology consulting and software solutions company.

Computer Weekly

Computer Weekly

ComputerWeekly provides the latest news and analysis through its website and weekly digital magazine, as well as award-winning, exclusive premium content.

Huntsman Security

Huntsman Security

Huntsman Security provides technology to enable real-time security monitoring and immediate visibility of advanced threats and compliance issues.

Government Communications Security Bureau (GCSB)

Government Communications Security Bureau (GCSB)

GCSB contributes to New Zealand’s national security by providing information assurance and cyber security to the New Zealand Government and critical infrastructure organisations.

Jumio

Jumio

Jumio’s end-to-end identity verification and authentication solutions fight fraud, maintain compliance and onboard good customers faster.

4Stop

4Stop

4Stop is a global KYC, compliance and anti-fraud risk management company.

AEWIN Technologies

AEWIN Technologies

AEWIN is professional in the fields of Network Appliance, Cyber Security, Server, Edge Computing and an ODM/OEM expert.

Antares NetlogiX

Antares NetlogiX

Antares Netlogix are a leading Austrian service provider for IT security, critical infrastructures and managed security services.

Gray Analytics

Gray Analytics

Gray Analytics is a Cybersecurity Risk Management company providing best-practice services across a broad spectrum of cyber scenarios for both government and commercial customers.

HORNE Cyber

HORNE Cyber

HORNE Cyber's offense-oriented approach to cybersecurity uncovers hidden cyber risk and significantly reduces exposure to security threats.

Anonomatic

Anonomatic

Anonomatic’s mission is to make data privacy secure, simple and cost effective. We are Data and Privacy Experts who are passionate about helping organizations solve PII compliance.

Dawgen Global

Dawgen Global

Dawgen Global is an integrated multidisciplinary professional service firm in the Caribbean Region providing a range of services including Risk Management and Information Systems Assurance.

Prelude

Prelude

Prelude offer the first autonomous platform built to attack, defend and train critical assets through continuous red-teaming.

CornerStone

CornerStone

CornerStone is an award winning, independent risk, cyber and security consulting firm providing a range of Risk Management, Security Design and Implementation Management Services.

Immunefi

Immunefi

Immunefi provides bug bounty hosting, consultation, and program management services to blockchain and smart contract projects.