Iran Likely To Retaliate With Cyberattacks

 

 

A former insider with knowledge of Iran's hacking operations said the attacks are likely to be launched by contractors and thus pose a greater risk of spinning out of control.

 

Recently, President Donald Trump announced the US would withdraw from the Iran nuclear deal, a pact of Western nations that pledged to lift economic sanctions against Iran in exchange for limiting its nuclear program. The UN's nuclear verification agency said Iran had complied with the agreement. Although there has been no evidence or intelligence to suggest a cyber-attack is in the works, researchers say they predict, based on Iran's past cyber activities, that retaliatory cyber-attacks are likely.

 

"We assess that within months, if not sooner, American companies in the financial, critical infrastructure, oil, and energy sectors will likely face aggressive and destructive cyber-attacks by Iranian state-sponsored actors," said Priscilla Moriuchi, a former NSA analyst, now at Recorded Future.

 

 

Countries allied with the US and Europe, like Saudi Arabia and Israel, are also at risk, the report said. Levi Gundert, who co-authored the research, told ZDNet the attacks will likely aim for "maximum impact," such as a malware attack rather than a denial-of-service attack. Much of the research is centered on Iran's long-known history of targeting Western businesses and governments with cyber-attacksin response to sanctions, largely because of how quickly the hackers could turn around an attack.

 

Tehran began strengthening its cyber capabilities following the Green Revolution, a period of intense protests in Iran against the incumbent government during the Arab Spring in 2009.  The government responded with a heavy crackdown, with an increased focus on cyber operations.

 

But some of the best hackers available were primarily young and financially driven, said the report. This led to mistrust and fears that the hackers could be bought by foreign intelligence agencies. According to the former insider, that led to a tiered trust system that centered Tehran's hacking efforts around a central team of trusted and ideologically aligned middle management that dishes out assignments to contractors, often pitting teams against each other, who get paid only when the work is completed. 

 

The government also uses compartmentalisation, giving one team an infiltration mission and using another to launch a remote code execution attack.

 

 

One such institution, Imam Hossein University, was sanctioned by the US Treasury for its connections to the Islamic Revolutionary Guard Corps (IRGC), Iran's military intelligence unit. But because some of Iran's best operators "are not always the most devout or loyal to the regime," the researchers warn they "could be more difficult to control." That may lead to the IRGC choosing a less ideologically driven contractor, capable of delivering a destructive attack in a short period of time, instead of a trusted and less politically driven contractor.

 

 

 

"These efforts did not entirely disappear with the agreement, but they did refocus on Iran's neighbors in the Middle East," said John Hultquist, FireEye's director of intelligence analysis, in an email to ZDNet.

 

"With the dissolution of the agreement, we anticipate that Iranian cyberattacks will once again threaten Western critical infrastructure," he said.

 

ZDNet: 

 

 

Iran’s Cyber Capabilities:

 

The Resurgent Cyber Threat From Iran: