FRESH AIR

Iran’s continuing cyber-mischief during the coronavirus crisis 

May 12, 2020 | Oved Lobel

Istock 803260700

 

Iranian hackers and propaganda networks have been working overtime during the novel coronavirus pandemic. In the first week of May, Israel’s ClearSky cybersecurity reportedly discovered the attempted and possibly successful hack of American biopharmaceutical company Gilead Sciences, the producer of one of the most promising potential COVID-19 treatments, the antiviral drug Remdesivir. According to ClearSky’s Ohad Zaidenberg, “they are acting against the infrastructure of the American research institute Gilead, and we determined that they are trying to hurt other research bodies that are dealing with coronavirus, including in Israel.”  

Iran has vigorously denied its involvement, with UN envoy Alirez Miryousefi declaring, “The Iranian government does not engage in cyber warfare. Cyber activities Iran engages in are purely defensive and to protect against further attacks on Iranian infrastructure.” 

Earlier in May, the UK reported that Iran was among a small group of hostile states, including Russia and potentially China, trying to hack British universities and scientific facilities researching COVID-19. This followed reports in April that Iran-linked hackers had tried to break into the email accounts of World Health Organisation (WHO) staff, which Iran also loudly denied, saying the reports were “sheer lies to put more pressure on Iran.”   

All of these cyber-espionage campaigns are reportedly the work of an Iranian hacking group dubbed “Charming Kitten.” As AIJAC covered in its February overview of Iranian cyber-activity, “Charming Kitten” members posed as journalists and set up non-existent events or bogus interviews for the targets of their activity, who were mostly Iranian expats and Israeli researchers. ClearSky and two other firms, Certfa and SecureWorks, linked several incidents to the group “which has masqueraded as well-known Wall Street JournalCNNIran International and Deutsche Welle journalists as well as inventing some of its own.” 

Perhaps even more serious than the espionage are the cyberattacks. Fox News first reported that Iran was behind an attempted cyberattack on Israel’s Water Authority in late April. The Washington Post, citing two foreign government officials, reported that “The hackers sought to cripple computers that control water flow and wastewater treatment for a pair of rural districts in Israel,” and that they’d routed the attacks through both the US and Europe. Sources did not describe the attack as sophisticated, and it was quickly detected and thwarted. Although the US Director of National Intelligence assessed Iran to have the same capabilities as Russia, China and North Korea when it comes to intruding into industrial control systems, it has yet to demonstrate the capability.  

While Israel has not officially confirmed Iran’s involvement, Israel’s Channel 13 reported that a high-level security cabinet meeting discussed the hack, with an unnamed official quoted as saying, “This is an attack that goes against all the codes of war. Even from the Iranians we didn’t expect something like this.” True to form, Iran’s UN envoy denied Iranian culpability, once again implausibly claiming that “The Iranian government does not engage in cyberwarfare.” 

On the propaganda front, Iran’s International Union of Virtual Media (IUVM), a global multilingual network of social media accounts and ostensibly local news websites first uncovered in 2018, has reportedly been very active in pushing coronavirus-related disinformation. True to its mission of “confronting…western governments and Zionism front activities,” the IUVM’s focus has been on blaming the US for the virus, mocking the US response and defending both Iran’s as well as China’s handling of the pandemic, according to an in-depth report by network analysis company Graphika A US State Department report in April warned of the convergence of  the coronavirus-related disinformation campaigns from Iran, Russia and China.  

Interestingly, much of the IUVM’s new accounts, websites, and pages seem to be focused on Africa, including “Ethiopianow,” “Durban Daily,” “@AfricaTruth1,” “AFtruth.com” and the likely related French-language page “Realite Afrique.” 

Facebook, meanwhile, took down a part of the Iranian social media propaganda network in May, as it does every few months, saying some of the accounts were linked to the Islamic Republic of Iran Broadcasting Corporation (IRIB). IRIB and IUVM run essentially like an echo chamber, with IRIB reports and cartoons rebroadcast under IUVM accounts and vice versa. According to Graphika’s chief innovation officer Camille Francois, “We do see these successive waves of takedowns across platforms being effective: While this operator continues to use social media for its campaigns, the scale is smaller every time we see them come back, and takedowns happen increasingly rapidly. That’s likely why we see this Iranian operator make heavier use of websites, and having a harder time promoting their campaigns on social media accounts.”  

The latest IUVM cluster taken down by Facebook had only about 5000 followers across all platforms. As the Graphika report noted, “The IUVM operation is significant and manned by a well-resourced and persistent actor, but its effectiveness should not be overstated.” 

RELATED ARTICLES

Fighters and military vehicles belonging to Syrian government forces intervene in the city of Sweida to enforce a ceasefire between Druze factions and Bedouin tribes. Syria, July 20, 2025 (Image: Shutterstock)

Druze crisis tested Israel’s Syria strategy

Jul 31, 2025 | Featured, Fresh AIR
Image: Shutterstock

Media Matters: Smoke and Ire over IHRA

Jul 30, 2025 | Featured, Fresh AIR
President Bill Clinton walks Prime Minister Ehud Barak of Israel and Yasser Arafat of the Palestinian Authority at Camp David, Maryland, July 2000 (Image: Wikipedia)

The silver anniversary of the silver bullet

Jul 29, 2025 | Featured, Fresh AIR
A protest in response to the death in detention of Mahsa Amini by Iran's morality police in Tehran (Image: Tolga Ildun/ Shutterstock)

Diaspora Iranians hope for more attention to the plight of the Iranian people

Jul 24, 2025 | Featured, Fresh AIR
Image: Shutterstock

An AIJAC letter the Sydney Morning Herald refused to publish

Jul 14, 2025 | Featured, Fresh AIR
Screenshot from a video showing radical Israeli rioters torching Palestinian homes in the West Bank town of Huwara in 2023

Myths and Facts about Settler violence

Jul 10, 2025 | Featured, Fresh AIR
D11a774c 2a47 C987 F4ce 2d642e6d9c8d

Bibi in DC, the Houthi threat and the politicised ICJ opinion

Jul 26, 2024 | Update
Image: Shutterstock

Nine months after Oct. 7: Where Israel stands now

Jul 10, 2024 | Update
Palestinian Red Crescent workers from Al-Najjar Hospital in the city of Rafah, south of the Gaza Strip (Image: Shutterstock)

Hamas’ impossible casualty figures

Mar 28, 2024 | Update
455daec3 C2a8 8752 C215 B7bd062c6bbc

After the Israel-Hamas ceasefire for hostages deal

Nov 29, 2023 | Update
Screenshot of Hamas bodycam footage as terrorists approach an Israeli vehicle during the terror organisation's October 7, 2023 attack in southern Israel, released by the IDF and GPO (Screenshot)

Horror on Video / International Law and the Hamas War

Oct 31, 2023 | Update
Sderot, Israel. 7th Oct, 2023. Bodies of dead Israelis lie on the ground following the attacks of Hamas (Image: Ilia Yefimovich/dpa/Alamy Live News)

Israel’s Sept. 11, only worse

Oct 11, 2023 | Update
Screenshot 2025 08 08 At 2.05.36 pm

Israel’s latest Gaza plan: Colin Rubenstein on Sky News

Aug 8, 2025 | Video
Screenshot

‘We cannot deny Hamas’ role in this’: Joel Burnie on Sky News

Jul 25, 2025 | Featured, Video
Screenshot 2025 07 11 At 12.30.23 pm

‘Time’s up for talk’: Joel Burnie discusses Antisemitism Envoy’s report on Sky News

Jul 11, 2025 | Video
Screenshot

‘Optimism’ for Hamas to ‘exile’ their power and create a permanent ceasefire with Israel: Joel Burnie on Sky News

Jun 30, 2025 | Featured, Video
Screenshot

Australian government’s response to Iran-Israel conflict ‘disappointing’: Paul Rubenstein on Sky News

Jun 17, 2025 | Video
Screenshot

UNRWA feeds the ‘Palestinian delusion’ of no Jewish state: Dr Einat Wilf on Sky News

Jun 12, 2025 | Featured, Video

RECENT POSTS

Screenshot

AIJAC deeply disappointed at misguided Palestinian statehood decision

Prime Minister Anthony Albanese (Image: Chad J. McNeeley/ Wikimedia Commons)

Don’t reward Hamas: Why it would be wrong to recognise Palestine now

The Hamas military wing released another video of Israeli hostage Evyatar David (Source: Reddit)

Appeasement has a price – and the hostages are paying it

Screenshot 2025 08 08 At 2.05.36 pm

Israel’s latest Gaza plan: Colin Rubenstein on Sky News

UK Prime Minister Keir Starmer with Canadian Prime Minister Mark Carney (Image: No 10 Downing Street/ Flickr)

Gullible West’s Palestinian statehood threats are peak idiocy

SORT BY TOPICS