Iran’s intelligence and military services [1] [3], including the Islamic Revolutionary Guard Corps (IRGC) [1] [2] [3], are actively engaged in cyber activities targeting Western countries [1] [2] [3]. These activities involve espionage [2], ransomware attacks [2], and efforts to destabilize target countries through information operations [2].
Description
The IRGC’s cyber program operates through a network of contracting companies, with four intelligence and military organizations linked to the IRGC collaborating with these contractors. Leaks have exposed a longstanding relationship between these agencies and Iran-based cyber contractors [3], who have been involved in offensive cyber activities such as targeting major US financial institutions [3], industrial control systems [1] [3], and healthcare providers [1] [3]. They also combine information operations with cyber intrusions to disrupt target countries [1] [3]. Notably, some contractors were even implicated in targeting the 2020 US presidential election [3]. The leaks also reveal that these contractors export their technologies abroad for surveillance and offensive purposes [1] [3]. The effectiveness of US government sanctions in detecting and disrupting these cyber companies has been demonstrated. Additionally, there are indications of financial activities outside of Iran [2], suggesting lucrative arrangements with the IRGC Quds Force (QF) in countries like Iraq [2], Syria [2], and Lebanon [2]. Major ransomware-style attacks have been attributed to pro-Iranian government fronts such as Moses Staff [2], N3tW0rm [2], and Agrius [2]. The interconnected network associated with the IRGC’s cyber program has been exposed through leaks and efforts by anti-government hacktivists and dissident networks [2]. It is worth noting that there are overlaps between sanctioned individuals and specific contracting parties involved in these cyber activities.
Conclusion
The cyber activities conducted by Iran’s intelligence and military services, particularly the IRGC, pose significant threats to Western countries. These activities not only involve espionage and ransomware attacks but also aim to destabilize target countries through information operations [2]. The leaks and evidence of the IRGC’s collaboration with Iran-based cyber contractors highlight the extent of their offensive cyber capabilities and their willingness to export these technologies for surveillance and offensive purposes. The effectiveness of US government sanctions in detecting and disrupting these cyber companies is a positive development, but there are indications of financial activities outside of Iran [2], suggesting lucrative arrangements with the IRGC Quds Force in neighboring countries [2]. The attribution of major ransomware-style attacks to pro-Iranian government fronts further underscores the need for increased vigilance and cybersecurity measures. It is crucial for Western countries to remain proactive in countering these cyber threats and to continue monitoring and disrupting the interconnected network associated with the IRGC’s cyber program.
References
[1] https://flyytech.com/2024/01/27/new-leaks-expose-web-of-iranian-intelligence-and-cyber-companies/
[2] https://www.recordedfuture.com/leaks-and-revelations-irgc-networks-cyber-companies
[3] https://www.infosecurity-magazine.com/news/leaks-iran-intelligence-cyber/
