Iranian-Linked Hackers Attack 34 Companies Worldwide
Cybersecurity experts have revealed that hackers affiliated with Iran launched a series of cyberattacks, compromising a total of 34 entities across three countries.
Cybersecurity experts have revealed that hackers affiliated with Iran launched a series of cyberattacks, compromising a total of 34 entities across three countries.
The attacks, between March 2021 and June 2022, were carried out by the state-sponsored hacking group known as Charming Kitten, primarily focused on Israel but also affected Brazilian and Emirati organizations.
According to a report released by cybersecurity firm ESET, the cyber operations were executed using a specific backdoor malware called Sponsor. The hacking group exploited a software vulnerability in Microsoft Exchange servers to gain access to their targets, delivering the malware to the victim's technical infrastructure.
The malware enables hackers to execute their commands on the compromised servers of the targeted companies and steal sensitive information.
Companies in various sectors, including financial services, engineering, manufacturing, technology, law, telecommunications, and more, were among the victims of the regime-backed hackers. Additionally, a healthcare company in Brazil also fell victim to the attacks.
No specific information has been provided about the Emirati organization targeted.
Researchers from ESET have emphasized that the companies were targeted due to their failure to update their software infrastructure.
The incident followed warnings issued in 2021 by several cybersecurity organizations in the United States, the United Kingdom, and Australia about the potential threat of Iranian regime hackers exploiting vulnerabilities in Microsoft Exchange servers.
Israel’s Alma, an institute focused on threats to Israel, released a report Wednesday elaborating on how Armenia functions as a transit point in the Islamic Republic’s air corridor route to Syria and Lebanon.
The report said Iran exploits Armenia not only to subvert Azerbaijan – an ally of Israel – but also to facilitate the Islamic Republic’s delivery of military equipment to Syria and then to Lebanon, underlining that “the Iranian effort in both arenas works against Israel.”
The Israeli institute pointed out that Iran supports Armenia in the conflict with Azerbaijan over the disputed Nagorno-Karabakh region, and that Revolutionary Guards (IRGC) operate in the area while tensions are high and may flare up again in the near future. “Iran is acting against Azerbaijan on multiple fronts, with the IRGC’s Quds Force conducting operations in asymmetric warfare, information warfare, and transferring weapons and military equipment to Armenia.”
Referring to the late-August Israeli air attack on Aleppo International Airport – the third one this year, Alma said that Aleppo area, home to about 60,000 Armenians, is “a geographical anchor within the Iranian corridor to Syria, and the Aleppo airport serves as one of the entry gates of the aerial route as part of the weapons corridor from Iran to Syria and Lebanon.”
However, the report failed to note that after more than a decade of civil war, most Armenians who are Christians have fled from the city the city.
The report also mentioned Mehdi Sobhani, Iran’s former envoy to Syria who left his position in March to become the regime’s ambassador to Armenia. “The Iranian ambassador to Syria and Lebanon is normally a senior IRGC officer in charge of coordinating Iranian activity with Hezbollah and the regime of Syrian President Bashar Assad, rather than a diplomat appointed by the Iranian Foreign Ministry,” Alma said, claiming that the selection of Sobhani as the Iranian envoy to Yerevan reflects “the Revolutionary Guards’ high regard for Armenia.”
Alma referred to an earlier report released in December 2022 about the role of Iranian airline Mahan Air -- including its passenger aircraft -- in arms transfers from Iran to Syria and Lebanon on behalf of the IRGC’s Quds Force. It explained that after Iranians airlines were exposed as carriers of arms and forces for the IRGC, Armenian airline Flight Travel LLC was created in 2018 “as a front for Mahan Air’s Armenian headquarters.”
The US Treasury Department sanctioned Flight Travel LLC for aiding Mahan Air in transporting Shiite militia operatives from Pakistan and Afghanistan to Syria, the report underlined, claiming that “These aircraft most certainly carried not only militia operatives but also military equipment and weapons.”
“Ma’raj (Meraj), Qeshm Fares, Pouya Air, and Iran Air are all Iranian airlines that operate within the Iranian corridor and are linked to the IRGC’s activities using cargo and passenger planes," the report said, adding that they are all sanctioned by the US.
According to Alma’s investigation, three Armenian airlines and one Iranian are still operating between Iran and Armenia. “The deployment of Armenian planes could thwart intelligence surveillance of Iranian activity by making it more difficult to cover their tracks,” it said. Iran Air Tour – a subsidiary of Iran Air -- and Syrian airline Cham Wings play an important role in supporting the Iranian effort for the transfer of materiel and militias to Syria.
Iran is known to have expanded its program significantly since 2018, when the United States unilaterally withdrew from the Iran nuclear deal –or Joint Comprehensive Plan of Action (JCPOA).
On Wednesday, three signatories of the deal, UK, France, Germany (E3) delivered a joint statement at the IAEA Board of Governors meeting, in which they condemned Iran’s lack of transparency with regards to its nuclear program.
The E3 noted that “Iran has not allowed effective verification and monitoring activities in relation to the production and inventory of centrifuges and key components, heavy water and uranium ore concentrate for more than two and a half years.”
Despite their emphasis on Iran’s non-compliance, the E3, much like the US, fell short of introducing measures that would ensure Tehran’s cooperation with IAEA.
In the State Department’s press briefing Wednesday, Spokesperson Matthew Miller refused to comment on why a resolution condemning Iran’s non-cooperation was not introduced at the IAEA meeting. Pressed by a reporter, Miller said the Biden administration would only work with other members “to clearly express that Iran should cooperate fully with the IAEA.”
This was in line with a joint statement delivered to the IAEA Board of Governors meeting on behalf of the US and 62 other member states, including all EU countries, Turkey, Kuwait and Saudi Arabia.
“Iran must provide technically credible answers to the IAEA,” the statement read, “in order to address the Agency’s legitimate questions on the outstanding locations, and to resolve the nuclear material discrepancy relating to its Uranium Conversion Facility.”
One major outstanding issue goes back to January 2023, when the IAEA inspectors at Fordow detected undeclared centrifuge configuration changes as well as particles of uranium enriched up to 83.7%.
In March 2023, IAEA Director General Rafael Grossi, visited Iran and brought back an agreement that was hailed as a breakthrough by both sides, but deemed insufficient and non-binding by its critics.
The agreement (or the Joint Statement) stood on the premise that Iran had “expressed its readiness” to “provide further information and access” and “allow the IAEA to implement further appropriate verification and monitoring activities” on a “voluntary” basis.
Six months on, the premise seems to have been shaky at best. According to IAEA,
The IAEA and the international community seem to believe that Iran’s nuclear program has reached levels not seen in countries without a nuclear weapons program.
Authorities in Tehran, of course, maintain that their nuclear program is entirely peaceful and a national right, based on international agreements. But many experts believe Iran’s nuclear expansion is hard to justify outside a weapons program.
For years, the IAEA has tried in vain to verify the nature of Iran’s nuclear activities, as the regime obstructs inspections and dodges questions in what many see as a time-buying tactic.
The Biden administration has so far been reluctant to exert more pressure on Iran over its nuclear program and has instead endeavored to buy the regime’s cooperation with a side deal.
Other western powers have tried to revive the JCPOA, only to get a taste of Tehran’s intransigence –as clearly voiced in the latest E3 statement at the IAEA Board of Governors meeting: “We have made significant efforts to negotiate and agree a return to the JCPOA, for which viable deals were tabled in March and in August 2022. In both cases, it is Iran that refused to sign these agreements, making unacceptable demands going beyond the scope of the JCPOA.
The invite has caused anger across US Congress as one of the world’s most ruthless political figures is visits the US and is welcomed to the meeting of the world’s leaders.
Rep. Claudia Tenney (R.-NY) and Sen. Ted Cruz (R.-Texas) introduced legislation on Tuesday that will make it illegal for Raisi and his delegation to attend UNGA, according to Washington-based Free Beacon.
Just last year, Raisi delivered a speech that berated the United States for withdrawing from the 2015 nuclear accord and claimed Iran is a beacon of justice, as the country was falling into the worst uprising in its modern history.
Raisi is also alleged to have been invited to a meeting with the Council on Foreign Relations (CFR). Although no announcement could be found on CFR’s website, a member of the Council, the well known Iranian Jewish writer, Roya Hakakian, wrote a post on X sharing information that she was invited to the meeting but turned down the invitation due to his attending.
Hakakian shared her declining the invitation saying, “Thank you for this invitation, which, I'm afraid, I must decline. While I am an absolutist when it comes to the value of dialogue, I see the presence of Ebrahim Raisi at the Council on Foreign Relations as a political baptism for a man who has been implicated in countless crimes.”
Iran International wrote to the Council on Foreign Relations asking for clarification but has not received a response at the time of this publication. The date of the meeting is not clear, but Raisi will attend the United Nations annual General Assembly taking place in New York City from September 18-26, in spite of an ongoing UN investigation into the regime’s human rights abuses.
Republicans including Tenney and Cruz maintain that Raisi has no right to be hosted in New York City as the regime fosters terrorism across the globe and launches attacks against US forces and allies in the Middle East. Iran is now under heavy sanctions not only for its ongoing nuclear program, but its dire human rights abuses in Iran and its support of Russia's war on Ukraine.
It is unlikely the legislation will pass before Raisi’s arrival but the campaign has garnered support across the board. The legislation, dubbed the SEVER Act, will "show the international community that terrorists are not welcome in the US," Tenney told the Free Beacon.
She added: ”It is imperative we stop Raisi and his associates from setting foot on American soil. Raisi, whose nickname is ‘the Butcher of Tehran,’ has a record of grave human rights abuses and orchestrating terrorist activities worldwide."
Raisi gained his notoriety from events including the mass murder of around 5,000 dissidents in the 1980s and more recently, has defended the brutal suppression of protesters who took to the streets in the wake of the death of Mahsa Amini in police custody.
It is hoped the bill could set a precedent for future Republican administrations to ban controversial figures and dictators, and is based on sanctions issued by former president Donald Trump. However, the first was first introduced by Tenney and Cruz last year, but it did not pass.
The visit by Raisi comes hot on the heels of a hostage deal with the Biden administration that freed up $6 billion in frozen revenue held in South Korea in exchange for five US-Iranian citizens held in Iran. Iran has also negotiated for a prisoner swap, coming out strongly from the deal which has also led to allegations of breach of Congressional laws laid at the Biden administration’s door.