The Rise Of Iranian Hacker Groups and What It Means For Organizations


Iranian Hacker Groups

While the intensity of the current geopolitical situation seems to have faded from the headlines as news organizations are mesmerized by impeachment proceedings, don’t be fooled into believing that the threat landscape has not dramatically changed. Worsening U.S-Iranian relations coupled with the rise of Iranian cyber attacks, Iranian sponsored cyber attacks, has proved that it’s high time organizations started looking at information security as a business risk and not just a technology risk.  

Escalation of US/Iranian tensions and Iranian cyber capabilities is already forcing the West to think differently about safeguarding their information assets and the critical role of ‘information’ for Iranian hacker groups. Iran is the powerhouse against which all nations of the world have been fighting a constant battle for securing their critical information infrastructure against Iran sponsored cyber attacks. Iranian cyber attacks and threats are at their all time worst levels and now more than ever U.S. businesses need to understand that responsibility for protecting against Iranian hacker groups and all cybersecurity threats should not reside just with the CTO or equivalent.  For security to be effectively enhanced, organizations need to embrace a focus on “People, Process, and Technology”. 

Iran compensates for its lack of military capability against the West by focusing on developing an Iranian cyber army or sponsoring cyber mercenaries. Iranian dominance in cyber attacks  allows them to continuously launch sophisticated cyber attacks against the interests of its enemies….a list that the U.S. has moved to the top of once again.  

What Are some of The Nation State’s Ferocious Cyber Activities? 

Here’s a list of some of significant Iranian cyber attacks that have caused severe damage to many sophisticated information technology players globally. 

  • Shamoon Attack Of 2012 and 2016: These attacks by Iranian hacker groups crippled thousands of workstations in Saudi Aramco, Saudi ministries, and other organizations. 
  • DDoS attacks 2012-13: Iranian hacker groups launched severe DDoS attacks on rival Western nations in 2012 and 2013, substantially impacting their financial institutions.  
  • New York Dam Hack 2013Seven Iranians associated with the Islamic Revolutionary Guards Corps were accused of hacking into the Bowman Avenue Dam systems. 
  • 2019 Attacks On Australian Parliament House: Initially blamed on China, the attacks on Australia’s Parliament House and three major political parties were later concluded to be launched by Iranian sponsored hacker groups. 

Why Be Concerned With Iranian Cyber Attacks? 

Iranian hacker groups generally have free reign to remain persistent in their malware spread malware without any fears of being caught or reprimanded…in fact they are handsomely rewarded and have no fear of reprisal from Iran. Iran’s cyber capability has caused havoc on business systems worldwide and possess the power to turn the world into a cyber battlefield. Here is why you need to take Iranian cyber attacks seriously:   

  • Iran’s Advanced Persistent Threat (APT) GroupsIran’s Advanced Persistent Threat (APT) groups consist of hackers who get unauthorized and unidentified access to computer networks for the Iranian government…they are part of the Iran cyber army. They retain this illegal access to systems for long periods to carry out their malicious intentions of data theft and Iranian sponsored cyber attacks. The renowned APT groups of Iran are APT 33 and APT 34. 
  • TTP Of Iranian Attack Groups: Iranian APT cyber attack groups excel at their infecting global networks due to the TTP (Tactics, Techniques, and Procedures) they use to give shape to Iranian cyber attacks. Some of the known TTPs of Iranian cyber attackers are spear phishing, watering hole attacks, and brute-forcing. 
  • Rapport With Proxy Groups: Iran cyber attacks are multifaceted due to sponsorship of proxy groups. Iran’s chain of loyal proxies religiously fight Iran’s geopolitical rivals with the funds, technologies and arms that Iran provides them with.  
  • Support Of Islamic Revolutionary Guard Corps (IRGC): The Islamic Revolutionary Guard Corps (IRGC) is integrated into the support network for Iranian hacker groups and backs their ideologies. 
  • State Support: The Iranian government offers support and shelter of violent and vicious militant actors as well as cyber attacks. 
  • Dedicated Contractors On Board: Iran has several dedicated threat actors on board who are hired on a contractual basis to launch various Iranian cyber attacks. These contractors are from varied fields such as universities, institutions, criminal gangs, and terrorist organizations. These threat actors not only execute government threat projects but also launch independent campaigns that are reflected from the use of common tools in specific Iranian cyber attacks. 

US-Iran Relations 

Iran has been accused of repeatedly targeting the US government and organizations through its Iranian cyber army.  The brief review of some notable incidents is telling…..  

  • Iranian hackers brought down the systems of American banks such as JPMorgan Chase, Bank of America and Capital One back in 2011. 
  • The city of Atlanta was compelled to function manually because of an Iranian cyber attack using ransomware in 2018. 
  • In 2015, an Iranian cyber attack erased all data stored on the computers of the Sands casino in Las Vegas. 
  • Iran’s cyber capabilities improved following a massive cyberattack experienced in 2010 when the computer worm Stuxnet infected its nuclear facilities commonly believes to have been launched by the US in collaboration with Israel.  

How Can Organizations Protect Themselves from the Iran Cyber Army and other state-sponsored cyber attacks? 

Iran cyber capabilities and Iranian cyber attacks are a formidable challenge to U.S. interests. As with all the state-sponsored support and secret actors, Iranian hacker groups are ahead of the security measures that most U.S. businesses may be adopting. Many businesses are leaving it to their IT department to figure out how to protect it from Iranian hacker groups…this is a mistake. If you are concerned about your organization, then the following tips can help you: 

  • Awareness: The first step always remains to be aware of relevant threat intelligence and updating your emergency call trees. 
  • Vigilance: Prevention is better than cure. Make sure to monitor critical internal security controls and try to be quick in identifying and responding to unusual behavior.  
  • Effective Response Plans: Try to develop a response plan and have personnel trained to handle a cyber attack calmly and sensibly. 
  • Disable Ports And Protocols Not IUse: What you often leave unattended can sometimes turn out to be the entry point of malware. Identify and disable unnecessary ports and protocols.  
  • Update Security Patches: Pay attention to security patches and update them as you find them. Patches help substantially in protecting against vulnerabilities
  • Update Backups: Make sure to update your backups offline to limit exposure to ransomware attacks. 

Final Words  

Gone are the days when cyber threats were merely an IT issue. The scale and motives of cyber attacks have undergone major transformations that put organizations all types and sizes at risk without advance warning. There is no denying Iranian cyber capabilities, and both Iran and other state sponsored actors are only going to grow bigger and stronger over time. IT teams cannot stand alone, cybersecurity requires an organization wide commitment. 

Leave a Reply