Iranian Hackers Attempt to Breach Accounts of Political and Civil Activists, Including Dual Nationals

The Human Rights Campaign in Iran reported that several Iranian figures active in charity and educational fields abroad, including dual nationals, as well as dozens of civil and political activists inside the country, have been targeted by hackers from Iran. On Saturday, April 27, it was announced that in the past two weeks, Iranian hackers have attempted to take control of the email and social media accounts of a group of well-known Iranian and dual nationality figures, as well as individuals active in charity and educational affairs. The report did not mention the names of these individuals, only stating that the range of these attacks extends from California and Washington D.C. in the U.S. to Tehran. According to this campaign, some of the individuals targeted by the hackers have had connections with those arrested in Iran or have been involved in activities related to them. The report noted that some of the individuals targeted in these attacks have been mentioned multiple times in media affiliated with the Islamic Revolutionary Guard Corps (IRGC) with 'baseless accusations.' Abbas Adalat, a professor at Imperial College and an activist against sanctions and war against Iran, is the latest dual national to have been arrested on April 15. Meanwhile, the arrest of environmental activists last February ultimately led to the departure of Kaveh Madani, the deputy head of Iran's Environmental Protection Organization, from the country. In his resignation letter, he stated that upon entering Iran, without a judicial order, 'all of his personal hardware and social media accounts' were 'raided' by 'concerned' elements of the Islamic Republic. The Human Rights Campaign in Iran also pointed to the hacking of various accounts of members of the Imam Ali Charity, stating that dozens of civil and political activists inside the country have also been targeted by hackers. The Imam Ali Charity, which works to support women and children, tweeted to the Minister of Communications of Hassan Rouhani's government that on April 25, the emails, Telegram, Facebook, and LinkedIn accounts of its members were 'extensively' attacked in a cyber assault. In this attack, Gmail and phones of some members of this charity were hacked. Following this report, Mohammad Javad Azari Jahromi, the Minister of Communications and Information Technology, tweeted that he had ordered the formation of a committee led by the ministry's security department to investigate this issue and publish the findings. No further details about this action by the Ministry of Communications have been released. The Imam Ali Charity reported that 'one of the SIM cards that was hacked was on a turned-off phone, so the only way to intercept messages was in transit.' According to this charity, 'in one case, a SIM card that belonged to members but was in the possession of a relative was hacked. Therefore, these individuals had access to the system that informs mobile phone numbers through national ID codes.' In this regard, the Human Rights Campaign in its report noted that given the nature of the hacking of the Imam Ali Charity's accounts, 'there is no doubt that the hackers had access to the country's communication infrastructures.' Amin Sabati, an internet and digital security expert, also told the Human Rights Campaign in Iran that hackers close to the IRGC have begun attacks against Iranian and non-Iranian individuals worldwide, and the method used is similar to that employed since April 2017. Previously, the Carnegie Endowment in the U.S. reported that security agencies in Iran have increasingly become skilled in cyber espionage and destructive attacks, with their actions extending from opponents of the Iranian government inside and outside the country, and civil institutions in Iran, to governmental, defense, commercial, and diplomatic organizations in the U.S., Israel, Germany, and Saudi Arabia. This report focused on the Iranian government's destructive actions in cyberspace, noting that such offensive operations are pursued under the guise of misleading public accounts, allowing the Iranian government to showcase its capabilities in this area while shirking responsibility for such actions. Iran has been known since 2012 for its involvement in the hacking of several American banks, hacking a small dam near New York, and attempts to attack the accounts of officials in Barack Obama's administration. In April of this year, 10 Iranian individuals and entities were sanctioned by the United States for hacking hundreds of American and international universities. Iran was also accused last October of being involved in cyberattacks on the accounts of some British parliament members.