The Iran-Russia Cyber Agreement & US Strategy In The Middle East

The new cooperation agreement between Russia and Iran on cybersecurity and information technology is likely to create new hurdles for the United States and its allies in the Middle East. This January, Russian Foreign Minister Sergey Lavrov and his Iranian counterpart Javad Zarif signed a cooperation agreement on cybersecurity and information and communications technology (ICT).

The agreement includes cybersecurity cooperation, technology transfer, combined training, and coordination at multilateral forums, like the United Nations.  

Iran / Russia Cybersecurity Alliance

Although the cooperation with Moscow outlined in the agreement could upgrade Tehran’s offensive cyber capabilities, the agreement is largely defensive, motivated by the countries’ shared animus toward the United States and U.S. influence in the Middle East as well as a desire to reduce dependence on Western technology.

There are limits, however, to how closely the two sides can be expected to work together.

The relationship between Russia and Iran has long suffered from mutual suspicion, ideological differences, and competition. Moreover, in the past, Russian and Iranian operators have operated at cross purposes. For example, in October 2019, British and U.S. officials revealed that the Russian threat actor Turla had hijacked Iranian hacking infrastructure as part of a false-flag operation.

Due to suspicion and conflicting objectives, cyber cooperation between Moscow and Tehran is likely to be focused on intelligence sharing and improving cyber defenses, rather than sharing offensive capabilities. Nonetheless, the agreement could pose four challenges to U.S. cyber operations. 

  • First, Russia could help Iran obtain stronger cyber defense systems. Harvard’s Belfer Center’s National Cyber Power Index 2020 lists Iran as the lowest-scoring nation for cyber defense capabilities, with Russia ranked in the middle of the countries surveyed. If Tehran addresses these defensive deficiencies with the help of Russian technology and training, it could make U.S. initiatives like 'Defend Forward' more challenging and costly.
  • Second, Iran-Russia cyber cooperation could entail Russian cyber teams deploying to Iran to monitor Iranian networks in order to collect insights and identify U.S. malware, similar to U.S. Cyber Command’s “Hunt Forward” operations. Acquiring and analyzing Cyber Command or National Security Agency hacking tools and techniques could help improve Russian and Iranian defenses, thwart future U.S. cyber operations, and force U.S. hackers to develop new exploits sooner than they hoped.
  • Third, if able to access Iranian defense systems, Russian hackers could acquire and reverse engineer U.S. or Israeli malware that has been used against Iran. This occurred with the Stuxnet worm, which targeted Iran’s nuclear facilities in 2010 and was attributed to the United States and Israel. Since then, numerous cyber actors have developed over 22 million pieces of malware that used Stuxnet’s blueprint to target organizations around the world. Stuxnet eventually infected thousands of networks globally, so hackers had access to lots of samples, but an attack that did not become as widely known could still be repurposed if Russia is able to access Iranian networks.
  • Fourth, technologies and techniques that Iran acquires from Russia could be provided to Iran’s proxies around the Middle East, including Hezbollah and militias in Iraq and Yemen. Some of these groups have already shown considerable hacking capabilities. In January, security firm ClearSky revealed that a Hezbollah-affiliated hacking group named Lebanese Cedar was involved in an extensive campaign that targeted telecoms and internet service providers in the United States, Europe, and Middle East. Equipping Iranian proxies with advanced Russian cyber capabilities could allow them to threaten government agencies, businesses, and U.S. operations in the Middle East. It could also hamper investigations into cyber operations conducted by Iranian proxies and lead to misattributing them to Russia, possibly causing unintended escalation.

US Reaction & Strategy

Although the agreement between Moscow and Tehran could pose challenges for U.S. cyber strategy, some of its disruptive implications can be mitigated. To minimize the risk of their hacking tools being repurposed for use against them, the United States and its allies should establish a unified vulnerability disclosure mechanism to share vulnerabilities, including those that have already been exploited, with each other and vendors. 

While the United States already has a vulnerability equities process, other allies seem to have only varying degrees of similar processes, if at all. Because victims are likely to patch vulnerabilities once they’ve been targeted, the attacking country can disclose the vulnerabilities it used after they’ve been exploited without weakening its offensive capabilities. Furthermore, the United States could promote the responsible development of offensive capabilities by adding self-destruct code modules to prevent them from being analyzed by adversaries. These modules have been deployed as part of highly sophisticated malware campaigns in the past and are designed to overwrite their own file data in order to prevent forensic analysis.

Establishing a standardized vulnerabilities disclosure mechanism could take place as part of a broader effort to strengthen intelligence sharing and security ties between the United States, Israel, the Gulf States, and possibly other actors in the region. As cyber cooperation between Russia and Iran grows, leaving it unchallenged could pose new threats to U.S. security and strategy in the Middle East.

This article was first publised  by the Council on Foreign Relations (Creative Commons BY-NC-ND 4.0)   

Image: Unsplash

You Might Also Read: 

The Cyber Security Top Ten Power List:

 

« British Companies Compromised By Exchange Email Hacking
2021 Blockchain Trends »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

FREE eBook: Practical Guide To Optimizing Your Cloud Deployments

FREE eBook: Practical Guide To Optimizing Your Cloud Deployments

AWS Marketplace eBook: Optimizing your cloud deployments to accelerate cloud activities, reduce costs, and improve customer experience.

Perimeter 81

Perimeter 81

Perimeter 81 is a Zero Trust Network as a Service designed to simplify secure network, cloud and application access for the modern and distributed workforce.

Cylance Smart Antivirus

Cylance Smart Antivirus

An antivirus that works smarter, not harder, from BlackBerry. Lightweight, non-intrusive protection powered by artificial intelligence. BUY NOW - LIMITED DISCOUNT OFFER.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Security Affairs

Security Affairs

Security Affairs is a blog covering all aspects of cyber security.

Lakeside Software

Lakeside Software

Lakeside Software provides workspace analytics for desktop transformation, asset optimization, security, incident resolution, and continuous assessment.

tunCERT

tunCERT

TunCERT is the National Computer Emergency Response Team of Tunisia.

DataVisor

DataVisor

DataVisor is a big data fraud detection and anti-money laundering solution.

NESEC

NESEC

NESEC is a specialist in information security consulting services and solutions.

GreyCastle Security

GreyCastle Security

GreyCastle Security is a leading cybersecurity services provider dedicated exclusively to cybersecurity and the practical management of cybersecurity risks.

Fyde

Fyde

Fyde helps companies with an increasingly distributed workforce mitigate breach risk by enabling secure access to critical enterprise resources.

DeepCyber

DeepCyber

DeepCyber supports its customers, with an “intelligence-driven” approach, to improve their proactive detection and response "capability" of cyber threats.

Zero Networks

Zero Networks

With Zero Network, you can achieve affordable, airtight network access security at scale.

Cyemptive Technologies

Cyemptive Technologies

Cyemptive's CyberSlice technology preempts and remove threats before they take hold, in seconds, compared to other’s hours, days, weeks and even months.

Nihon Cyber Defense

Nihon Cyber Defense

Nihon Cyber Defence’s mission is to provide robust solutions, services and support to governments, corporates and organisations in order to protect them from all forms of cyber warfare.