An American Security Company: Hackers Likely Linked to Iran Involved in Attacks on Foreign Companies

A security company in the United States reported on Wednesday, September 20, that it had identified a group of hackers 'likely linked' to the Islamic Republic's government who were involved in cyberattacks on foreign companies. According to Reuters, citing managers at the cybersecurity firm FireEye, the connection of these hackers to cyberattacks on Saudi Arabian companies and several Western aviation and oil companies 'indicates an increase in capabilities for internet espionage' in Iran. FireEye's report on a group of hackers named 'APT 33' also contains evidence of this group's activities since 2013. 'APT' stands for 'Advanced Persistent Threat.' As Reuters reports based on this cybersecurity report, among the evidence is the use of Persian language in malware code and the hackers' downtime on Thursdays, the end of the workweek in Iran. FireEye, which has been hired by Western companies and governments to investigate this matter, currently ranks Iran in the realm of cyberattacks and internet hacks alongside China and Russia. FireEye identifies this group of hackers as the first from Iran to be added to its list of state-sponsored hackers alongside those from China, Russia, and North Korea. This is not the first time a cybersecurity company has warned about the increasing capabilities of the Islamic Republic on the internet. Previously, in 2014, the American cybersecurity company Mandiant had reported that the recent cyberattacks by Iranian hackers on the energy sector and government organizations in the United States indicated an increased threat to America. Following that, FireEye identified the group 'APT 33,' which was tasked with investigating cyberattacks by an American aviation company, a Saudi trading company, and a South Korean group with investments in the oil and petrochemical sectors. According to FireEye's report, the attacks by this group of hackers against the Saudis and Koreans occurred in May of this year, less than four months ago. Reuters linked FireEye's information and its publication at this time to the latest U.S. sanctions against several individuals and entities in Iran. Last week, the U.S. Treasury Department sanctioned 11 entities and individuals to counter the IRGC's missile program, the Quds Force's activities outside Iran, and cyberattacks against the United States. On September 14, the department named the Marsad company and associated individuals, as well as the 'IT Security Group,' accusing them of playing a role in cyberattacks on U.S. economic institutions. According to the CEO of FireEye, the Islamic Republic of Iran increased its cyber capabilities after the United States and Israel 'targeted Iran's nuclear centrifuges in a cyberattack in 2010.' This cyber operation is known by its virus name, 'Stuxnet.' The American newspaper 'The New York Times' reported in June 2012, citing former and current officials in the U.S., Europe, and Israel, that the plan for a cyberattack on Iran began in 2006 under George Bush and intensified under Barack Obama.