The Resurgent Cyber Threat From Iran

Experts are sounding the alarm about new cyber activity from Iran, as hackers become more emboldened and skilled at carrying out surveillance operations and other attacks outside the country’s borders.

In recent years, Iran-linked hacker groups have showed signs of growing sophistication, expanding their cyber tool kits and stepping up operations against new international targets, including in the Middle East and the United States. 

Iran’s growing ambitions, coupled with the geopolitical climate, have given some warning of the future threat. “They’re good enough that they’re able to break into a lot of organizations,” said Charles Carmakal, vice president at Mandiant, a FireEye subsidiary that provides cyber incident response to government and private organizations across the globe.

“There’s definitely a lot of fear by the intelligence agencies and lots of security companies about what Iran is going to do." 

Cybersecurity professionals have detected Iranian hackers breaking into networks of defense contractors, aviation firms, oil and gas companies, technology companies and telecommunications providers.

In February, cybersecurity firm Symantec revealed that the Iran-based hacking group dubbed “Chafer” had expanded spy operations to new targets across numerous sectors in Israel, Jordan, the United Arab Emirates, Saudi Arabia and Turkey, and successfully compromised a major telecommunications provider in the Middle East.

The group also began using several new hacking tools over the past year, including leveraging the “EternalBlue” exploit reportedly stolen from the National Security Agency by another hacker group.

While Symantec has no definitive evidence linking Chafer to the Iranian government, Vikram Thakur, the firm’s security response technical director, said the group’s targets, which include companies in the aviation sector, suggest a government motivation because the information would be more valuable in the public versus private sector.

“What we’ve noticed of the overall picture that the quantity of attacks that are originating from that geography are much, much higher than seven or eight years ago,” Thakur said. “In the coming years, we’d expect Chafer as well as other cyber actors originating from Iran to continue increasing their volumes of attack as well as their list of victims.”

In many cases, Iran-linked cyber activity is limited to intelligence operations. But some groups have also shown signs of destructive capabilities. Last September, FireEye identified a new Iranian hacking group that’s been dubbed “Advanced Persistent Threat 33,” or APT 33, that had been quietly conducting spying operations since at least 2013 against organizations in the US, Saudi Arabia and South Korea. The group has a particular eye toward the military, commercial aviation and energy sectors.

FireEye found evidence that APT 33 is capable of carrying out destructive attacks, linking it to a destructive “wiper” malware that can delete files.

Iran has a long history of malicious activity in cyberspace. US officials suspected Iran in the 2012 cyber assault against Saudi Arabian oil giant Saudi Aramco, in which hackers used destructive malware called “Shamoon” to wipe computer networks of data and replace the files with an image of a burning US flag. 

A new variant of the malware resurfaced in late 2016, infiltrating other Saudi Arabian computer systems. FireEye traced the 2016 activity back to Iran, though did not attribute it to a specific threat group. 

The US Justice Department earlier that year indicted seven Iranians believed to have been working at the behest of Tehran’s government for conducting distributed denial of service attacks on US financial institutions between 2011 and 2013, as tensions ran high over sanctions on Iran’s nuclear program.

Much of the attention in Washington has lately focused on the cyber threat from Russia, following Moscow’s interference in the 2016 presidential election.

Iran is still widely viewed by officials and cybersecurity professionals as inferior to China and Russia in terms of its capabilities. Still, experts say Iran’s hackers have notably grown more professional in a matter of years. Iran-linked hacking groups have increased the scale of their attacks and gotten better at hiding their tracks, in part by using virtual private networks to carry out operations so they cannot be traced back to Iran.

“They got better over the years,” said Carmakal. “When I think about the real impact to our safety and the impact to our business operations, I’m actually more concerned about Iran.” 

FireEye tracks other hacking groups it links to the Iranian government, including APT 34, which the firm says has conducted reconnaissance operations largely targeting critical infrastructure organizations in the Middle East since at least 2014. FireEye has attributed some of Chafer’s activity to APT 34.

The firm has also identified Iranian hacking group APT 35, which Ben Read, senior manager of cyber espionage analysis, described as “one of the most active groups” in 2017 of all nation-state actors tracked by FireEye. 

“They’ve shown a consistent interest in US companies,” said Read.
US officials have warned of mounting threats from Iran and other nation-states in the cyber realm.  

“We will see Chinese, Iranian and North Korean cyber actors continue to build off past successes to improve the scope and scale of their cyber capabilities,” Director of National Intelligence Dan Coats told the US Senate Armed Services Committee.

Lt. Gen. Robert Ashley, director of the Defense Intelligence Agency, also warned lawmakers that Iran and North Korea “can launch disruptive cyber-attacks and use cyberspace as a means to asymmetrically respond to perceived challenges in political, military, or economic domains” despite being less capable than other threat actors. 

Some speculate Iran could increase malign cyber activity against the United States if tensions run high between Washington and Tehran.

A report released by Carnegie Endowment for International Peace in January observed that destructive Iranian cyber operations against the US had decreased since the early negotiations of the Iran nuclear deal. They noted, however, that the US should expect Tehran to target economic, civilian, and government networks in the event of “renewed hostilities.”
President Trump has threatened to withdraw from the Iran nuclear deal, though he declined to topple the 2015 agreement in January by waiving key sanctions on Tehran. 

Meanwhile, the Trump administration imposed new sanctions on Iran related to its ballistic missile activity and crackdown on dissidents, for which Iran promised to retaliate. 

“I think they are a significant threat to organisations in the US, particularly those in the national security area,” Read said.

“What is really going to change how much of a threat they are is the overall geopolitical situation.”

The Hill:

You Might Also Read: 

Iran Adopts Russian Style CyberWar Tactics:

Iran’s Cyberwar Could Infiltrate Your Mailbox:

 


 

 

« Russia Can Disconnect From The Internet
UK Police Helping Business Fight Cyber Attacks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

FireEye

FireEye

FireEye delivers unmatched detection, protection and response technology through an extensible and flexible cloud-based XDR platform.

Hodgson Russ

Hodgson Russ

Hodgson Russ is a US business law firm. Practice areas include Privacy, Data Breach & Cybersecurity.

eco

eco

eco, with more than 950 member organizations, is the largest Internet industry association in Europe.

CERT-UA

CERT-UA

CERT-UA is the national Computer Emergency Response Team for Ukraine.

Wolfpack Information Risk

Wolfpack Information Risk

Wolfpack specialise in information and cyber threat management covering the full spectrum of prevention, detection, incident response and business resilience capabilities.

CyberWarrior

CyberWarrior

CyberWarrior deliver training and consulting for some of the world’s top brands and also partner with national systems integrators to augment their teams with our expertise.

Cog Systems

Cog Systems

Cog Systems offer an embedded solution built on modularity, proactive security, trustworthiness, and adaptability to enable highly secure connected devices.

Vesta

Vesta

Vesta Corporation is a global provider of a scalable suite of fraud and payment solutions for online commerce.

Cybertonica

Cybertonica

Cybertonica is a FinTech company which detects and prevents fraudulent transactions and reduces risk for financial services organisations.

Sky Republic

Sky Republic

Sky Republic offers a Smart Contract Platform to integrate and synchronize business networks beyond EDI and API.

Founder Shield

Founder Shield

Founder Shield is a data driven insurance brokerage focused excusively on rapidly evolving high-growth companies.

Lockheed Martin

Lockheed Martin

Lockheed Martin deliver full-spectrum cyber capabilities and cyber resilient systems to defense, intelligence community and global security customers.

FPG Technologies & Solutions

FPG Technologies & Solutions

FPG Technology is a technology solutions provider and systems integrator, specializing in delivering IT Consulting, IT Security, Cloud, Mobility, Infrastructure solutions and services.

DH2i Company

DH2i Company

DH2i is a leading provider of multi-platform Software Defined Perimeter and Smart Availability software enabling customers to create an entire IT infrastructure that is always-secure and always-on.

Kirk ISS

Kirk ISS

Kirk ISS are the leading provider of IT services in the Cayman Islands. We offer best-in class hardware, software, communications and cloud computing, all backed by professional services support.

OccamSec

OccamSec

OccamSec is a leading provider in the world of cybersecurity. We provide accurate, actionable information to reduce risk and enable better informed decisions.