FRESH AIR

Iranian Cybercrime Remains and Expands

Apr 2, 2019 | Oved Lobel

Iran Cyber 2

Microsoft has become the latest large private company to declare war against Iranian cybercriminals working directly for or on behalf of the Islamic Revolutionary Guard Corps (IRGC) or Ministry of Intelligence. Microsoft said it had been tracking the hacking group – alternatively dubbed Phosphorus, Charming Kitten, or APT35 –  since 2013 and had seized 99 websites being utilised to spy on activists, journalists, defence officials, dissidents, and a range of others throughout the Middle East. The company sued the group in the US District Court in Washington for damages incurred by hacking their clients and computer networks.

Iran has become a steadily more prominent and dangerous actor in cyberspace. While the Australian Signals Directorate (ASD) says the investigation into the sweeping hack of Australian parliamentary systems and political parties is ongoing and won’t make an attribution, the US cybersecurity firm Resecurity claimed Iran was behind the hack, rather than China, and linked it to the Iranian cyberattack against the UK parliament in 2017, in which the email accounts of at least 90 MPs were compromised.

It is also possible that China, Russia, and Iran are all working together to target Five Eyes, the Western intelligence alliance between the US, UK, Canada, Australia and New Zealand. A recent report on the the Iranians hacking the cellphone of leading Israeli political candidate Gen. (res.) Benny Gantz alleged that Russia had given the Iranians the sophisticated technology necessary to conduct the attack. Meanwhile, there are suggestions that China and Iran cooperated to roll up and destroy CIA networks in both countries. In any case, Iran remains a sophisticated and malicious global actor in cyberspace in its own right, and has on several occasions attacked Australia, most recently attempting to steal information from the Australian shipbuilder and defence contractor Austal.

Meanwhile, Facebook announced on March 26 that it had “removed 513 Pages, Groups and accounts for engaging in coordinated inauthentic behavior as part of multiple networks tied to Iran. They operated in Egypt, India, Indonesia, Israel, Italy, Kazakhstan or broadly across the Middle East and North Africa.” These consisted of “158 Pages, 263 Facebook accounts, 35 Groups and 57 Instagram accounts.” According to Facebook, “About 1.4 million accounts followed one or more of these Pages, about 108,000 accounts joined at least one of these Groups and around 38,000 accounts followed one or more of these Instagram accounts.” Between December 2013 and February 2019, about US$15,000 was spent on ads by this Iranian network. Facebook has been one of several companies dismantling this sprawling Iranian propaganda effort since last year.

AIJAC has previously covered this expansive Iranian propaganda network, called “The International Union of Virtual Media.” In September 2018, we wrote:

In late August, Facebook, Twitter and Google announced that they had shut down dozens of accounts and pages on their respective platforms linked to an Iranian operation, which was launched at least as early as Jan. 2017, to influence public opinion in other countries. A Reuters investigation just released, confirmed by cyber-security firms ClearSky and FireEye Inc, which aided in the initial discovery, revealed that the Iranian operation was far larger than initially thought, consisting of dozens of websites, YouTube channels, and hundreds of social media accounts in multiple languages designed to amplify official Iranian and pro-Iranian, pro-Palestinian and pro-Assad regime propaganda. Google released a statement saying that “In addition to the intelligence we received from FireEye, our teams have investigated a broader range of suspicious actors linked to Iran who have engaged in this effort.” Facebook is still investigating and taking down further pages and accounts linked to the operation.’

With each passing month since then, new revelations have demonstrated the staggering reach of Iran’s disinformation campaigns and potent offensive cyber capabilities. It is unlikely the major tech companies are anywhere near uncovering, much less unravelling, the full extent of these operations.

RELATED ARTICLES


Copy Of Copy Of Israel Pfizer Tw

Israel’s vaccination success by the numbers

Feb 18, 2021 | Featured, Fresh AIR
Cyber

Hezbollah cyberattack on Australian company is part of a growing cyber-threat emanating from Iran

Feb 17, 2021 | Featured, Fresh AIR
20161212FreeSpeechInquiry

AIJAC makes parliamentary submission on countering extremist movements and radicalism in Australia

Feb 16, 2021 | Featured, Fresh AIR
Copy Of Copy Of Kosovo FB Insta (1)

When will Europe grow a spine on Iranian terrorism?

Feb 10, 2021 | Featured, Fresh AIR
Israel elections

Parties finalise their lists for next month’s Israeli election

Feb 5, 2021 | Featured, Fresh AIR
International Holocaust Remembrance Day In Poland, January 2020 (49449915157)

The antisemitic commentators of Holocaust Remembrance Day

Feb 3, 2021 | Featured, Fresh AIR

SIGN UP FOR AIJAC EMAILS

RECENT POSTS

(Credit: UN Photo/Rick Bajornas)

ICC recognising Palestine creates setback for Middle East peace hopes

(Credit: Wikimedia Commons)

The Biden Administration needs to build on US Mideast achievements

Copy Of Copy Of Israel Pfizer Tw

Israel’s vaccination success by the numbers

Screen Shot 2021 02 17 At 2.56.47 Pm

Biden, the Middle East & Beyond: Knowns and Unknowns – Danielle Pletka

Cyber

Hezbollah cyberattack on Australian company is part of a growing cyber-threat emanating from Iran

(Credit: UN Photo/Rick Bajornas)

ICC recognising Palestine creates setback for Middle East peace hopes

(Credit: Wikimedia Commons)

The Biden Administration needs to build on US Mideast achievements

Copy Of Copy Of Israel Pfizer Tw

Israel’s vaccination success by the numbers

Screen Shot 2021 02 17 At 2.56.47 Pm

Biden, the Middle East & Beyond: Knowns and Unknowns – Danielle Pletka

Cyber

Hezbollah cyberattack on Australian company is part of a growing cyber-threat emanating from Iran

SORT BY TOPICS