New evidence shows that Iran's intelligence and military services are associated with cyber activities targeting Western countries through their network of contracting companies.
A string of multi-year leaks and doxxing efforts led by anti-Iranian government hacktivists and dissident networks has uncovered an intricate web of entities associated with the Islamic Revolutionary Guard Corps involved in cyber-attacks and information manipulation campaigns.
Cyber threat intelligence provider Recorded Future discussed some of the findings in a new report, published on January 25, 2024.
It has been found that at least four intelligence and military organizations linked to the IRGC engage with the bulk of cyber contracting parties.
The leaks analyzed by Recorded Future show that these agencies maintain a long-standing relationship with Iran-based cyber contractors.
Researchers have noticed constant movement within the web of Iran-based cyber contractors, with companies frequently disbanding and rebranding in an attempt to obfuscate their activities.
Through their links with these cyber contractors, the abovementioned Iranian government agencies are associated with, if not directly complicit in, the targeting of major US financial institutions, industrial control systems in the US and around the world, and ransomware attacks against various industries, including healthcare providers like children's hospitals.
They also combine information operations with cyber intrusions to foment instability in target countries.
Some of these contractors were involved in targeting the 2020 US presidential election.
Finally, it has been shown that some of these contractors export their technologies abroad, both for surveillance and offensive purposes.
The leaks show that IRGC-related cyber offensive infrastructure has been used to deploy financially motivated attacks, for example.
Finally, based on those leaks, Recorded Future researchers concluded that US government sanctions are likely proving to be an effective legal and diplomatic tool, making it harder for cyber companies under the IRGC umbrella to evade detection.
This Cyber News was published on www.infosecurity-magazine.com. Publication date: Fri, 26 Jan 2024 13:30:29 +0000