Cyberwarfare is a part of the Iranian government's "soft war" military strategy. Being both a victim and wager of cyberwarfare,[1] Iran is considered an emerging military power in the field.[2] Since November 2010, an organization called "The Cyber Defense Command" (Persian: قرارگاه دفاع سایبری; Gharargah-e Defa-e Saiberi) has been operating in Iran under the supervision of the country's "Passive Civil Defense Organization" (Persian: سازمان پدافند غیرعامل; Sazeman-e Padafand-e Gheyr-e Amel) which is itself a subdivision of the Joint Staff of Iranian Armed Forces.[3]
Iran has been the target of cyberattacks, including the Operation Olympic Games (Stuxnet) attack by the United States and Israel on its nuclear facilities.
According to a 2014 report by Institute for National Security Studies, Iran is "one of the most active players in the international cyber arena".[4] In 2013, a Revolutionary Guards general stated that Iran has "the 4th biggest cyber power among the world's cyber armies."[5][6] According to a 2021 report by a cyber-security company, "Iran is running two surveillance operations in cyber-space, targeting more than 1,000 dissidents".[7] As of 2024, Iran's cyber activities have advanced, particularly in their precision and intelligence-gathering capabilities, allowing for more accurate and targeted attacks against Israel. Following directives from Iran's supreme leader Ali Khamenei after the October 7 attacks, cyber operations expanded, including joint efforts with Hezbollah. Despite these advances, Iran's cyber capabilities still fall short of Israel's, with Iranian hackers' skills being likened to those of mid-level organized crime gangs. However, Israeli officials remain concerned that Iran could rapidly enhance its capabilities, particularly through potential cooperation with Russia.[8]
Cyberwarfare is the use of cyber attacks against an enemy state, causing comparable harm to actual warfare and/or disrupting vital computer systems.[9] Some intended outcomes could be espionage, sabotage, propaganda, manipulation or economic warfare.
There is significant debate among experts regarding the definition of cyberwarfare, and even if such a thing exists.[10] One view is that the term is a misnomer since no cyber attacks to date could be described as a war.[11] An alternative view is that it is a suitable label for cyber attacks which cause physical damage to people and objects in the real world.[12]
Many countries, including the United States, United Kingdom, Russia, China, Israel, Iran, and North Korea,[13][14][15][16] have active cyber capabilities for offensive and defensive operations. As states explore the use of cyber operations and combine capabilities, the likelihood of physical confrontation and violence playing out as a result of, or part of, a cyber operation is increased. However, meeting the scale and protracted nature of war is unlikely, thus ambiguity remains.[17]
Iranian cyber defense system - digital fortress part of national information network (national internet) - is developed for thwarting attacks and engaging attackers.[20] In November 2022, the Iranian Majlis Islamic Consultative Assembly recommended a Passive Defence Incorporation.[21]
In June 2010, Iran was the victim of a cyber-attack when its nuclear facility in Natanz was infiltrated by the cyber-worm 'Stuxnet'.[22] A combined effort by the United States and Israel,[23]: 211 Stuxnet destroyed perhaps over 1,000 nuclear centrifuges and, according to a Business Insider article, "[set] Tehran's atomic programme back by at least two years."[24] The worm spread beyond the plant to allegedly infect over 60,000 computers, but the government of Iran indicates it caused no significant damage. Iran crowdsourced solutions to the worm and is purportedly now better positioned in terms of cyber warfare technology.[22] No government claimed responsibility for the worm.[24] The cyber-worm was also used against North Korea.[citation needed]
The Iranian government has been accused by Western analysts of its own cyber-attacks against the United States, Israel and Persian Gulf Arab countries, but denied this, including specific allegations of 2012 involvement in hacking into American banks.[24] The conflict between Iran and the United States has been called "history's first known cyber-war" by Michael Joseph Gross in mid-2013.[56]
On October 30th FBI and Treasury released a cybsecurity threat advisory related in relation to Emennet Passargad.[86][87]
In November 2024 ClearSky revealed an Iranian "dream job malware" APT TA455 doing an op using North Korean shared methods targeting US defence sector.[88]
Iranian state-sponsored hackers, identified as TA455 (also known as APT35 and Charming Kitten), have been conducting a cyber espionage campaign targeting the aerospace industry since September 2023, using tactics similar to those of North Korean threat actors. The campaign involves creating fake recruiter profiles on LinkedIn and using malicious domains to lure victims into downloading malware known as SnailResin. Victims are enticed to open ZIP files disguised as job-related documents, which have a low antivirus detection rate. The malware is deployed through DLL side-loading attacks, closely mirroring techniques used by North Korean hackers. Researchers suggest that the Iranian hackers may have adopted these methods from North Korea, particularly given the malware's initial association with North Korean groups like Kimsuky and Lazarus. TA455 employs Cloudflare to obscure its command-and-control domains and encodes command and control data on GitHub to blend in with legitimate web traffic, making tracking their infrastructure difficult. The primary targets of this campaign are aerospace professionals, with the goal of infiltrating networks within the aerospace, aviation, and defense sectors, particularly in the Middle East, including Israel, the UAE, and potentially Turkey, India, and Albania. The goal appears to be espionage and data exfiltration from these high-value targets in the aerospace sector.[89]
The UK and US have jointly issued a warning about ongoing spear-phishing attacks conducted by cyber actors affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC). These sophisticated attacks target individuals connected to Iranian and Middle Eastern affairs, including government officials, think tank personnel, journalists, activists, and those involved in US political campaigns. The attackers use social engineering techniques to impersonate trusted contacts, aiming to gain access to victims' personal and business accounts. They often use fraudulent login pages to obtain credentials, allowing them to access sensitive information and manipulate email accounts. The National Cyber Security Centre (NCSC) and its US counterparts are urging at-risk individuals to follow mitigation steps and utilize free cyber defence services to protect themselves. Paul Chichester, NCSC Director of Operations, emphasized the persistent nature of this threat and the importance of remaining vigilant, particularly for those in sensitive sectors.[90]
December
LabDookhtegan launched a cyberattack against Iranian oil rigs jamming their comms and electronic guidance systems and crippling and disrupting satellite network connectivity of 116 ships.[94]
Codebreakers hackers released entire database records of bank sepah from upto 1925.[95]
Iranians hacked public announcement speakers from an Israeli kindergarten.[96] In the January 30th Iranians failed to hack Gemini accounts product of Google.[97]
In February Minister of intelligence hacked 2 terabytes of data from Israeli police.[98]
In March a 30000 ddos bot network was discovered originating in Iran.[99]
In April Iranian regime reported a cyber attack on regime infrastructure. [101]
Unit42 discovered an Iranian APT35 sponsored fake german Mega Model agency fashion Modeling website collecting user data on behalf of fake AI generated identity Shir Benzion.[102]
In May 14th Prana group hack revealed masked identity of Majiz Azami , owner of Sepeher Energy Jahan and its subsidiary Energy Hamta Pars , a front company for Iranian Armed Forces Staff to be using Qatari's help to smuggle 65 million barrels of oil worth $4.2bn. The company was incorporated jn Tehran in November 2022. [103]
Iranian armed forces install malware apps for espionage on Android phones.[104] They could steal victims identity according to Microsoft.[105]
On May 5, 2020, Reuters reported, quoting a monthly Facebook report, that Iranian state-run media had targeted hundreds of fake social media accounts to covertly spread pro-Iranian messaging, online since at least 2011, for secretly broadcasting online promotional messages in favor of Iran in order targeting voters in countries including Britain and the United States.[106] Accounts were suspended for coordinated inauthentic behavior, which removed eight networks in recent weeks, including one with links to the Islamic Republic of Iran Broadcasting.[106]