Iran Cyber Attacks on Saudi Arabia

After a four-year hiatus, Iran recently resumed destructive cyber-attacks against Saudi Arabia in what US officials say is part of a long-term strategy by Tehran to take over the oil-rich kingdom and regional US ally.

Late January 2017, the Saudi government warned, in a notice to telecommunications companies, that an Iranian-origin malicious software called Shamoon had resurfaced in cyber-attacks against some 15 Saudi organisations, including government networks.

The Shamoon malware was last detected in the 2012 cyber-attack against the major Saudi state oil producer Aramco. That cyber-attack damaged or destroyed some 30,000 computers and was considered one of the more destructive state-linked cyber-attacks to date.

A State Department security report issued Feb. 10 stated that the 2012 attack destroyed over three-fourths of Aramco's computers, and that the damage took five months to mitigate at "an extreme cost."

Shamoon also was used in Iranian cyber-attacks against RasGas, a liquified natural gas company located in neighboring Qatar.

A new version of the malware, Shamoon 2, was linked to the recent cyber-attack, which took place in November 2016. Security officials linked that attack to a Middle East hacker group known as Greenbug that used fraudulent emails in phishing scams to acquire login credentials for Saudi networks.

A cyber security expert familiar with details of the latest Saudi cyber-attack who spoke on condition of anonymity said the November incident was “Iranian-directed” and linked to two hacker groups in Iran known as "Cadelle and Chafer” in cyber-security circles.

The new Shamoon 2 "is meant to do damage," the expert said, noting that the recent cyber-attack was not as effective as the earlier one in 2012.

Once inside compromised computer networks, the Iranian hackers were able to steal large amounts of data. They then destroyed the computers using a digital wiping tool that removes all data from the system. The hacked computers were left with a screen image.

In the 2012 Saudi Aramco attack, the Iranians left an image of a burning American flag image. After the November cyber-attack, the hackers left a screen image of a dead Syrian refugee boy.

The Saudis received US government cyber-security and technology training after the 2012 attack. No Shamoon malware was detected until the new variant, Shamoon 2, appeared in November. The US government believes the same Iranian hackers carried out both attacks.

A National Security Agency document from 2013 warned that Iranian government cyber-attacks are part of an expansion of Iranian influence in the Middle East. "NSA has seen Iran further extending its influence across the Middle East over the last year," states the top secret memo, which was disclosed by renegade contractor Edward Snowden.

NSA believed Iran's 2012 cyber-attack was carried out in retaliation for the earlier US cyber-attacks against Iranian nuclear facilities. Those attacks caused nuclear centrifuges to self-destruct using an industrial control software known as Stuxnet.

"NSA expects Iran will continue this series of attacks, which it views as successful, while striving for increased effectiveness by adapting its tactics and techniques to circumvent victim [computer network] mitigation attempts," the NSA said.

The Iranian cyber-attacks are one element of a larger Iranian strategy to subvert and ultimately take over Saudi Arabia, the location of Islam's holy sites, according to US officials.

Predominantly Shiite Iran and predominantly Sunni Saudi Arabia are bitter rivals that vie for influence over the world's Muslims.

The State Department report, "Devastating Cyber Attack Program Returns to Saudi Arabia," warned that US companies operating in the kingdom could be the next targets of Iranian cyber-attacks.

"The increased tensions and unpredictable future between Iran, Saudi Arabia, and the US raises the potential for US organisations in the region to be future targets for a cyber-attack, either with Shamoon or similar malware tuned for destruction rather than corporate espionage or theft," the report said.

In addition to cyber-attacks, Iran seeks to subvert Saudi Arabia through a proxy war in Yemen.

Tehran is backing Houthi rebels against the pro-Saudi government of Yemen. The Houthis took over the capital of Sanaa in 2014. One year later, a Saudi-led coalition of nine regional states intervened in the conflict.

Concerned by large numbers of civilian casualties in the conflict, the Obama administration last year delayed delivery to Saudi Arabia of an arms sale package for large numbers of precision-guided bomb kits. The kits turn gravity bombs into precision-guided weapons that can be directed to targets.

US officials say the Trump administration is ready to lift the ban on the bomb kits to the regional ally because it is no longer concerned by the Obama administration's goal of warmer relations with Tehran.

Under Obama, then-Secretary of State John Kerry tried to negotiate a settlement of the Yemen conflict in a deal with the Houthis. Critics said the deal would have been advantageous to Iran and harmful to the Saudis.

Iran has dispatched a large number of Islamic Revolutionary Guards Corps fighters to Yemen, along with pro-Iranian militia members from Iraq, in a bid to help the Houthis.

Additionally, US officials say Iran is helping the Houthis plant sea mines off the coast of Yemen near the strategic Red Sea choke point known as the Bab-el-Mandeb, a strategic shipping lane between the Indian Ocean, Red Sea, and Suez Canal.

Controlling the Bab-el-Mandeb is said to be a key element of the Iranian strategy of targeting Saudi Arabia. Once in control of the Bab-el-Mandeb, the Iranians could use their control of the region's other strategic chokepoint, the Strait of Hormuz, to exert political leverage throughout the region.

A commercial maritime security notice was sent recently to shipping companies warning that vessels transiting the region should check with the US Navy about the threat of sea mines.

A Saudi warship was recently attacked in waters near Yemen by what is now believed to have been a small, remotely piloted boat loaded with explosives.

The guided missile destroyer USS Cole was recently dispatched to the area following the rebel attack on the Saudi ship.

FreeBeacon:

 

« Google To Break Pirates Over Music Searches
Self-driving Ubers are now in Arizona »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Haltdos

Haltdos

Haltdos is an AI driven website protection service that secures websites against today's cyber threats.

SentryBay

SentryBay

SentryBay is a real-time data security company developing technology for PC, mobile, the cloud and IoT.

Cyber London (CyLon)

Cyber London (CyLon)

CyLon is a leading cyber security accelerator and seed investment programme. We help entrepreneurs from across the globe to build cyber security businesses, raise investment, and develop partnerships.

J2 Software

J2 Software

J2 Software is a leading African Information Security and ICT business providing information security, governance, risk and compliance solutions.

CyberArrow

CyberArrow

CyberArrow (formerly EBDAA) is a consultancy company providing high quality consultancy services in Risk & Compliance and Awareness & Education.

Segusoft

Segusoft

With its encryption platform SEGULINK, Segusoft provides standard software for companies to securely transfer files and messages.

Irdeto

Irdeto

Irdeto is the world leader in digital platform security, protecting platforms and applications for media & entertainment, gaming, connected transport and IoT connected industries.

TechCERT

TechCERT

TechCERT is Sri Lanka’s first and largest Computer Emergency Readiness Team (CERT).

Gradiant

Gradiant

Gradiant’s mission is to contribute to the growth and competitive improvement of Galician businesses through technology development and innovation using ICT.

CloudOak

CloudOak

CloudOak is a cloud channel provider for hybrid cloud Backup as a Service (BaaS), Disaster Recovery as a Service (DRaaS) and Archiving to Small to Medium Business (SMB).

HUB Security

HUB Security

Hub Security provide Ultra Secure, Military Grade HSM (Hardware Security Module) Solutions for Blockchain and Digital Assets.

Smart Hive

Smart Hive

Smart Hive has created a platform that will allow organizations to share real-time, relevant and actionable threat intelligence among each other while maintaining confidentiality.

Cutting Edge Technologies (CE Tech)

Cutting Edge Technologies (CE Tech)

CE Tech is a Next Generation Technology Partner providing advanced technology infrastructure solutions through partnerships with leading technology providers.

usecure

usecure

usecure is a global provider of computer-based cyber security awareness training, offering the market’s most time-efficient, cost-effective and admin-lite solution for reducing insider threats.

Fluid Attacks

Fluid Attacks

Fluid Attacks specialize in red team operations as well as technology development that continuously enhance our security testing services.

CertiProf

CertiProf

CertiProf has been enhancing professional lives since 2015, offering a wide range of IT certifications and agile framework training.