Security News
Iran's Atomic Energy Organization has laughed off claims that the email systems of a subsidiary were compromised, revealing important operational data about a nuclear power plant. An activist group that calls itself Black Reward and claims to be from Iran took to Telegram last Friday with claims it had accessed an email server run by a company related to Iran's Atomic Energy Organization and exfiltrated 324 inboxes comprising over 100,000 messages and totalling over 50G of files.
Signal is urging its global community to help people in Iran stay connected with each other and the rest of the world by volunteering proxies to bypass the aggressive restrictions imposed by the Iranian regime. On Monday, the Iranian regime severely restricted internet connectivity in the country, imposing broad blocks on all ISPs, sometimes leaving internet users entirely offline for several hours.
Iran is experiencing a near-total internet service disruption in the west and intermittent interruptions nationwide, with access to Instagram, Whatsapp and some mobile networks being blocked, says Netblocks. While Twitter and Facebook were banned in Iran years ago, Instagram and WhatsApp remained as one of the few accessible social media platforms in the country.
The criminal charges come as Iran has apparently stepped up its malicious activity against America and its allies - exploiting well-known software vulnerabilities to conduct espionage, deploy ransomware, steal money, data and credentials and good old-fashioned election misinformation and meddling, according to the government and private security firms. The trio are accused of conducting a hacking campaign to break into computer systems of "Hundreds of victims" in the US, UK, Israel, Iran and other countries, according to court documents [PDF].
The US Treasury Department has issued sactions against Iran's intelligence agency in response to that country's cyberattack against Albania and other "Cyber-enabled activities against the United States and its allies." Earlier this week, NATO ally Albania cut its diplomatic relations with Iran after blaming a July cyberattack that hit its government infrastructure on Iranian state-sponsored attackers.
The U.S. Treasury Department on Friday announced sanctions against Iran's Ministry of Intelligence and Security and its Minister of Intelligence, Esmaeil Khatib, for engaging in cyber-enabled activities against the nation and its allies. The development comes months nearly nine months after the U.S. Cyber Command characterized the advanced persistent threat known as MuddyWater as a subordinate element within MOIS. It also comes almost two years following the Treasury's sanctions against another Iranian APT group dubbed APT39.
The U.S. Treasury Department announced sanctions today against Iran's Ministry of Intelligence and Security and its Minister of Intelligence for their role in the July cyberattack against the government of Albania, a U.S. ally and a NATO member state. MOIS is the Iranian government's leading intelligence agency, tasked with coordinating intelligence and counterintelligence efforts, as well as covert actions supporting the Islamic regime's goals beyond the country's borders.
This decision comes after severing diplomatic relations with Iran following the attribution of a July cyberattack that targeted Albanian government infrastructure to Iranian threat actors. "The in-depth investigation provided us with indisputable evidence that the cyberattack against our country was orchestrated and sponsored by the Islamic Republic of Iran through the engagement of four groups that enacted the aggression," Rama said.
Iran's Communications Ministry joined in a pledge with Russian state-owned defence and technology conglomerate Rostec to explore future collaboration in e-government, information security, and other areas. News of the collaboration came in a statement published on Friday by Iran's Information Technology Organization - a government agency charged with developing policy related to data networks and digital services.
Malware used in a crippling cyberattacks against an Iranian steel plants last week is connected to an attack that shut down the country's rail system last year. The overlaps in the code, combined with contextual clues and even recycled jokes, indicate that the same threat actor, dubbed Indra, is behind the attacks impacting Iran's infrastructure.