Iran has been the target of cyberattacks, including theOperation Olympic Games (Stuxnet) attack by the United States and Israel on its nuclear facilities.
According to a 2014 report byInstitute for National Security Studies, Iran is "one of the most active players in the international cyber arena".[4] In 2013, aRevolutionary Guards general stated that Iran has "the 4th biggest cyber power among the world's cyber armies."[5][6] According to a 2021 report by a cyber-security company, "Iran is running two surveillance operations in cyber-space, targeting more than 1,000 dissidents".[7] As of 2024, Iran's cyber activities have advanced, particularly in their precision and intelligence-gathering capabilities, allowing for more accurate and targeted attacks against Israel. Following directives from Iran's supreme leaderAli Khamenei after theOctober 7 attacks, cyber operations expanded, including joint efforts withHezbollah. Despite these advances, Iran's cyber capabilities still fall short of Israel's, with Iranian hackers' skills being likened to those of mid-level organized crime gangs. However, Israeli officials remain concerned that Iran could rapidly enhance its capabilities, particularly through potential cooperation withRussia.[8]
There is significant debate among experts regarding the definition of cyberwarfare, and even if such a thing exists.[10] One view is that the term is a misnomer since no cyber attacks to date could be described as a war.[11] An alternative view is that it is a suitable label for cyber attacks which cause physical damage to people and objects in the real world.[12]
Many countries, including theUnited States,United Kingdom,Russia,China,Israel,Iran, andNorth Korea,[13][14][15][16] have active cyber capabilities for offensive and defensive operations. As states explore the use of cyber operations and combine capabilities, the likelihood of physical confrontation and violence playing out as a result of, or part of, a cyber operation is increased. However, meeting the scale and protracted nature of war is unlikely, thus ambiguity remains.[17]
The first instance ofkinetic military action used in response to a cyber-attack resulting in the loss of human life was observed on 5 May 2019, when theIsrael Defense Forces targeted and destroyed a building associated with an ongoing cyber-attack.[18][19]
Iranian cyber defense system - digital fortress part ofnational information network (national internet) - is developed for thwarting attacks and engaging attackers.[20] In November 2022, the Iranian Majlis Islamic Consultative Assembly recommended a Passive Defence Incorporation.[21]
In June 2010, Iran was the victim of acyber-attack when itsnuclear facility in Natanz was infiltrated by the cyber-worm 'Stuxnet'.[22] A combined effort by the United States and Israel,[23]: 211 Stuxnet destroyed perhaps over 1,000 nuclear centrifuges and, according to aBusiness Insider article, "[set] Tehran's atomic programme back by at least two years."[24] The worm spread beyond the plant to allegedly infect over 60,000 computers, but the government of Iran indicates it caused no significant damage. Iran crowdsourced solutions to the worm and is purportedly now better positioned in terms of cyber warfare technology.[22] No government claimed responsibility for the worm.[24] The cyber-worm was also used againstNorth Korea.[citation needed]
October 2021:An attack paralyzed gas stations across the country, preventing users from purchasing fuel using state-issued cards and digital billboards displaying antigovernment messages
In September, October and November 2022, Iranian state networks and emails came under attack byAnonymous and other hacking groups acting in solidarity withIranian protestors.[28]
In the year 2023 several government ministries were fully hacked by multiple people including Ministry of Science research and technology on September 23.[29][30][31] Veterans affairs[32] Ministry of foreign affairs(50TB)[33] Central Insurance and 19 subsidiary corporations(119 million lines records)[34][35][36] City of Tehran municipality , State news bulletin[37] National Civil Registration vital records organization database(20TB)[38] Atomic Energy Organization[39] Presidency[40] Ridesharing companyTapsi was hacked as well.
December 2023 seventy percent of entire national Iranian fuel pumps taken out, Predators Sparrow took responsibility[41]
January 2024 Snapp was hacked with records of 80 million Iranians along with payment info sold.[42]
In 2024 February
Islamic Consultative Assembly was hacked revealing massive payment to members.[43][44]
US military attacked two Iranian intelligence vessels atRed Sea.[48]
May 2024 Iranian regime was getting hammered with huge scale cyberattacks causing internet issues[49]
June 2024 Islamic culture and guidance's ministry Haj.ir taken out , source code and database hacked by IRleaks team, it included pilgrim and civil travel records since 1980s[50]
TheIranian government has been accused by Western analysts of its own cyber-attacks against theUnited States,Israel andPersian Gulf Arab countries, but denied this, including specific allegations of 2012 involvement in hacking into American banks.[24] The conflict betweenIran and the United States has been called "history's first known cyber-war" by Michael Joseph Gross in mid-2013.[56]
August 2014: AnIDF official told the press that Iran has launched numerous significant attacks against Israel'sInternet infrastructure.[57]
31 March 2015: There wasa massive power outage for 12 hours in 44 of 81 provinces of Turkey, holding 40 million people.Istanbul andAnkara were among the places suffering blackouts. According toObserver.com, Iranian hackers, possibly theIranian Cyber Army, were behind the power outage.[58]
June 2017: TheDaily Telegraph reported that intelligence officials concluded that Iran was responsible for a cyberattack on theBritish Parliament lasting 12 hours that compromised around 90 email accounts ofMPs. The motive for the attack is unknown but experts suggested that the Islamic Revolutionary Guard Corps could be using cyberwarfare to undermine theIran nuclear deal.[59]
March 2022: Large-scale cyberattacks were launched against multiple Israeli government websites, allegedly by Iran as retaliation for failed Mossad operations, though neither the attack attribution nor the purported Mossad operations could be confirmed as of March 2022. The National Cyber Directorate declared a state of emergency as a result of the attacks and unnamed defense sources told media outlets it was possibly the largest-ever cyberattack against Israel.[62][63]
November 2022: Iranian hackers attacked Albanian networks.[64][65]
November: seventeen American networks system were turned into mining crypto because of existing undefended vulnerability.[66]
Moneybird ransomware was used by Agrius against Israeli people.[67] Cyberattack on Israeli university was blamed on Iranian ministry of intelligence.[68] Attacks attributed to Iranians targeted Israeli ports and Haifa harbors.[69]
Disinformation en masse sponsored by state targeted Iranians in 2023.[70]
In August 2023, Germany'sFederal Office for the Protection of the Constitution reported that hackers linked to Iran's Islamic Revolutionary Guard Corps targeted Iranian regime opponents in Germany, using fake identities to conduct cyber espionage.[71]
Sophos and Zimperium report Iranian citizens credentials hacked by Iranian hackers, with Firebase, C2 (C&C) iOS, Android malware apps called Bank Saderat, Central Bank and Bank Mellat.[72]
In November 2023, Ziv Hospital inSafed, Israel, reported a cyber breach of its computer systems. An Iranian-linked hacking group subsequently claimed to have obtained 500 gigabytes of patient information.[8]
In late November 2023, the Municipal Water Authority ofAliquippa, Pennsylvania experienced a cyberattack by pro-Iran hackers who breached its industrial equipment, including a system managing water pressure.[73]
In December 2023, a cyberattack by hackers linked to Iran disrupted the water supply in a rural area ofCounty Mayo,Ireland, leaving about 160 households without water for two days.[74]
December 14, 2023 ESET documented OilRig group which is state sponsored use C&C attacks.[75]
In February 2024,OpenAI announced that it had shut down accounts used by the Crimson Sandstorm hacking group. The group had been using OpenAI services to research evasion techniques, write and refactor code, and create phishing campaign content.[76][77]
April 2024 Israel secrets published by Iranian website,[78]
In June 2024, Iranian-backed hackers, identified asMint Sandstorm (also known as Charming Kitten or APT35), targeted a high-ranking official from a U.S. presidential campaign with a spear-phishing attack. The hackers used a compromised email account to send a malicious link.[79]
July 2024 MuddyWater increased the cyber attacks in the Middle East.[80]
On August 9, 2024,Microsoft reported that Iran has intensified its interference in the US elections by launching fake news sites and conducting hacking attempts. According to aWashington Post report, Iranian-operated news networks, such as Nio Thinker and Savannah Time, aim to polarize American voters by promoting extreme viewpoints. Microsoft also detailed a spear-phishing attack conducted by Iranian hackers targeting a US presidential campaign. This group used a compromised email account to attempt unauthorized access to sensitive information. Another Iranian group also managed to breach an account belonging to a county government employee in a swing state.[81]
In September 2024, U.S. authorities revealed that Iranian hackers had accessed and distributed stolen information from Trump's campaign to individuals linked to Biden's re-election effort, aiming to disrupt the election. Despite Iran's denial of involvement, officials suggested the intent was to erode public confidence in the electoral process.[82]
Also in September 2024, Swedish authorities revealed that a cyber group called Anzu, operating under Iran's Islamic Revolutionary Guard Corps (IRGC), were responsible for hacking into a Swedish text messaging service in July 2023, taking over passwords, usernames and other tools, and sending thousands of messages calling Swedes "demons" and bearing instructions to exact vengeance upon Koran burners. Iran denied the accusation, though the investigation by the Swedish Prosecution Authority managed to identify the individual hackers responsible for the data breach. In a statement by Justice Minister Gunnar Stromme it was said that the goal was to destabilise Sweden or increase polarisation, and the security service warned that Iran is among those seeking to create division and bolster their own regimes.[83][84][85]
On October 30 FBI and Treasury released a cybsecurity threat advisory related in relation to Emennet Passargad.[86][87]
In November 2024 ClearSky revealed an Iranian "dream job malware" APT TA455 doing an op using North Korean shared methods targeting US defence sector.[88]
Iranian state-sponsored hackers, identified as TA455 (also known as APT35 and Charming Kitten), have been conducting a cyber espionage campaign targeting theaerospace industry since September 2023, using tactics similar to those of North Korean threat actors. The campaign involves creating fake recruiter profiles onLinkedIn and using malicious domains to lure victims into downloadingmalware known as SnailResin. Victims are enticed to open ZIP files disguised as job-related documents, which have a lowantivirus detection rate. The malware is deployed through DLL side-loading attacks, closely mirroring techniques used by North Koreanhackers. Researchers suggest that the Iranian hackers may have adopted these methods fromNorth Korea, particularly given the malware's initial association with North Korean groups likeKimsuky and Lazarus. TA455 employsCloudflare to obscure its command-and-control domains and encodes command and control data onGitHub to blend in with legitimate web traffic, making tracking their infrastructure difficult. The primary targets of this campaign are aerospace professionals, with the goal of infiltrating networks within the aerospace, aviation, and defense sectors, particularly in theMiddle East, includingIsrael, theUAE, and potentiallyTurkey,India, andAlbania. The goal appears to be espionage and data exfiltration from these high-value targets in the aerospace sector.[89]
The UK and US have jointly issued a warning about ongoing spear-phishing attacks conducted by cyber actors affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC). These sophisticated attacks target individuals connected to Iranian and Middle Eastern affairs, including government officials, think tank personnel, journalists, activists, and those involved in US political campaigns. The attackers use social engineering techniques to impersonate trusted contacts, aiming to gain access to victims' personal and business accounts. They often use fraudulent login pages to obtain credentials, allowing them to access sensitive information and manipulate email accounts. The National Cyber Security Centre (NCSC) and its US counterparts are urging at-risk individuals to follow mitigation steps and utilize free cyber defence services to protect themselves. Paul Chichester, NCSC Director of Operations, emphasized the persistent nature of this threat and the importance of remaining vigilant, particularly for those in sensitive sectors.[90]
December
FBI's Donald Trump appointment director Kash Patel successfully hacked.[91]
Cotton Sandstorm : Meta reported that they had successfully detected and taken down 48 accounts belonging to IRGC posing as anti west activists part of an influence op[92][93]
LabDookhtegan launched a cyberattack against Iranian oil rigs jamming their comms and electronic guidance systems and crippling and disrupting satellite network connectivity of 116 ships.[94]
Codebreakers hackers released entire database records of bank sepah from upto 1925.[95]
Iranians hacked public announcement speakers from an Israeli kindergarten.[96]In the January 30th Iranians failed to hack Gemini accounts product of Google.[97]
In February Minister of intelligence hacked 2 terabytes of data from Israeli police.[98]
In March a 30000 ddos bot network was discovered originating in Iran.[99]
30 million users of Mobile Communications of Iran hacked .[100]
Unit42 discovered an Iranian APT35 sponsored fake german Mega Model agency fashion Modeling website collecting user data on behalf of fake AI generated identity Shir Benzion.[102]
In May 14 Prana group hack revealed masked identity of Majiz Azami , owner of Sepeher Energy Jahan and its subsidiary Energy Hamta Pars , a front company for Iranian Armed Forces Staff to be using Qatari's help to smuggle 65 million barrels of oil worth $4.2bn. The company was incorporated jn Tehran in November 2022.[103]
In May 30 Meta reported Iranian regime influence operation network taken out.[104]
Iranian man Sina Qolinejas pleaded guilty to helping ransomware attack on City of Baltimore.[105]
On May 5, 2020,Reuters reported, quoting a monthlyFacebook report, that Iranian state-run media had targeted hundreds of fake social media accounts to covertly spread pro-Iranian messaging, online since at least 2011, for secretly broadcasting online promotional messages in favor of Iran in order targeting voters in countries including Britain and the United States.[109] Accounts were suspended forcoordinated inauthentic behavior, which removed eight networks in recent weeks, including one with links to the Islamic Republic of Iran Broadcasting.[109]
^Singer, P. W.; Friedman, Allan (March 2014).Cybersecurity and cyberwar: what everyone needs to know. Oxford University Press.ISBN978-0-19-991809-6.OCLC802324804.
^Smith, Troy E. (2013). "Cyber Warfare: A Misrepresentation of the True Cyber Threat".American Intelligence Journal.31 (1):82–85.ISSN0883-072X.JSTOR26202046.
^Lucas, George (2017).Ethics and Cyber Warfare: The Quest for Responsible Security in the Age of Digital Warfare. Oxford University Press. p. 6.ISBN978-0-19-027652-2.
.jpg)
November 2018:The Iranian telecommunication ministerMohammad-Javad Azari Jahromi accusesIsrael of a failedcyberattack on its telecommunications infrastructure, and vows to respond with legal action.[26][27]
31 March 2015: There wasa massive power outage for 12 hours in 44 of 81 provinces of Turkey, holding 40 million people.Istanbul andAnkara were among the places suffering blackouts. According toObserver.com, Iranian hackers, possibly theIranian Cyber Army, were behind the power outage.[58]
June 2017: TheDaily Telegraph reported that intelligence officials concluded that Iran was responsible for a cyberattack on theBritish Parliament lasting 12 hours that compromised around 90 email accounts ofMPs. The motive for the attack is unknown but experts suggested that the Islamic Revolutionary Guard Corps could be using cyberwarfare to undermine theIran nuclear deal.[59]
November 2022: Iranian hackers attacked Albanian networks.[64][65]
November: seventeen American networks system were turned into mining crypto because of existing undefended vulnerability.[66]
