American Institute: Recent Cyber Attack on Australian Parliament Linked to Iranian Government-Associated Hackers

A few days after Australian officials reported a foreign cyber attack on the country's main parties and parliament, an American research company announced that the perpetrators were hackers based in Iran. Charles Yu, head of the cybersecurity firm 'Riskurity', told the Wall Street Journal that the recent cyber attack on the Australian parliament aligns with the activities of 'Mabna Institute' in Iran, which reportedly has ties to the Islamic Revolutionary Guard Corps (IRGC). Established in 2013, Mabna Institute has been under U.S. Treasury sanctions since April of this year. According to the Wall Street Journal, the recent attack on the Australian parliament is part of Mabna Institute's espionage efforts, likely in response to the U.S. withdrawal from the JCPOA, targeting the five countries known as 'Five Eyes' since May. The 'Five Eyes' is an alliance of intelligence agencies from the U.S., Australia, the UK, Canada, and New Zealand that engage in digital surveillance. The cyber attacks against the Australian parliament and parties occurred about two weeks ago, and Australian Prime Minister Scott Morrison announced in parliament on Monday that the source of these attacks was 'a foreign government entity'. In recent days, some Australian media and figures have referred to previous cyber attacks attributed to the Chinese government, suggesting Chinese state hackers as potential culprits for the new attacks. However, Charles Yu stated that attributing the attacks to China was a mistake. 'We have been monitoring the activities of the Mabna group for years and are familiar with their patterns.' In April, when the Mabna Institute and eight of its members were added to the U.S. Treasury sanctions list, the Treasury and the FBI released details about the institute. According to the details released at that time, the Mabna Institute was initially established to provide services to universities and research centers in Iran but gradually became a contractor for the IRGC and some government entities to conduct cyber attacks or other malicious activities. The FBI reported that by that time, the Mabna Institute had conducted cyber attacks against at least 144 universities in the U.S. and 76 universities in 21 other countries, including Israel, Canada, China, Denmark, Japan, Malaysia, Norway, Turkey, the UK, and South Korea. In addition to the legal entity of the Mabna Institute, the U.S. Treasury also sanctioned eight members of the institute, including Gholamreza Rafatnejad, Ehsan Mohammadi, Seyed Ali Mirkarimi, Mostafa Sadeghi, Sajjad Tahmasbi, Abdollah Karima, Abouzar Goharimoghadam, Roozbeh Sabahi, and Mohammadreza Sabahi, as well as another Iranian citizen named Behzad Masri. According to a statement from the FBI, members of this institute, after hacking individuals' and universities' accounts, provided the stolen information to the IRGC or sold it to other entities. Iranian officials denied allegations of Iran's involvement in cyber attacks against U.S. universities last April, but they have not yet responded to the new report regarding their role in the attack on the Australian parliament. Charles Yu stated that Iranian hackers in the recent attack on the Australian parliament and parties stole information related to a database containing details of over seven thousand individuals, including parliament representatives. Yu's statements come just days after the New York Times reported, citing U.S. intelligence officials, that Iranian and Chinese cyber attacks against U.S. individuals and entities have significantly increased.