Iran's Proxies In Iraq Target Israel’s Eilat, Jordan Intercepts

Posing as fake real estate brokers, drone marketers, and individuals seeking services, the operatives operated on platforms such as X, Telegram, WhatsApp, Facebook, and Instagram.

Tasks assigned to Israelis included photographing locations and verifying addresses, all in exchange for financial incentives. Trained to spot such cat-fishing during army service, several of the Israelis alerted the authorities.

The Shin Bet said it was familiar tactics of the Iranian security agencies, primarily focusing on intelligence gathering rather than explicit security matters, Iranian digital activities escalating since the outbreak of the Gaza war on October 7.

“Its purpose is to assist Hamas in its war and to damage Israel’s national resilience and war effort, sowing demoralization and deepening social divisions,” the agency said in a statement.

Shin Bet also uncovered social media pages impersonating Israelis, “making cynical and manipulative use of the issue of the hostages, and even trying to act against families of hostages and bereaved families.”

Screenshots released by Shin Bet show an Iranian operative allegedly soliciting an Israeli for a murder plot, negotiating a payment of 70,000 euros. An audio recording features an Iranian operative speaking in Hebrew, offering $100 to an Israeli for an unspecified task.

Parviz Mohammadnezhad Ghazimahalleh said on Thursday that the the attack which cut off 70% of the country's petrol stations was a “physical” one. “They entered the system via a USB or a program from inside,” he added without specifying the identities of the people involved.

On Monday, the cyberattack which crippled gas stations across Iran was claimed by the hacking group "Gonjeshk-e-Darande" or Predatory Sparrow which announced the attack on X, claiming that they took out “a majority of the gas pumps throughout Iran.”

Iran accuses “Gonjeshk-e-Darande” of having links to Israel. The group rose to prominence as a hacktivist two years ago for a similar cyberattack on fuel distribution centers across Iran on the eve of the second anniversary of the bloody suppression of the November 2019 protests. In a separate incident, they claimed responsibility for hacking the state railway company.

It is the second time such an attack has taken place, Ghazimahalleh said, accusing the responsible officials of “negligence” and “carelessness.”

The remarks came a day after Hadi Beigi-Nezhad, another member of the Energy Commission of Iran’s parliament, said a cyber virus had infected the fuel system, attributing it to an individual and a network that had infiltrated the country.

Last year, “Gonjeshk-e-Darande” garnered attention for successfully penetrating the computer systems of major steel companies in Iran. 

Tejarat News, an economic news website, announced on Thursday that the majority of gas stations in Tehran province have been reconnected to the online distribution system.

Out of a total of 330 gas stations in the province, 239 are now connected to the national fuel system, Tejarat News quoted a local official as saying.

Also on Thursday, Morteza Mahmoudvand, another Iranian lawmaker, blamed “Zionists” and Israel’s intelligence agency Mossad for the fuel system attack and urged “an equilibrium of fear” in order to fight what he called the country’s enemies.

Equilibrium of fear means doing to them what they do to us, added Mahmoudvand, who is a member of the National Security and Foreign Policy Commission of the Iranian parliament.

He claimed that Israel’s cyber operations against Iranian targets will go on even after the Gaza conflict. We need to prepare ourselves in digital, technological and virtual domains not to be vulnerable to future attacks, he went on to say.

This is while the Islamic Republic has already been involved in several cyber operations against Israeli targets.

Earlier in the month, Iran-linked hackers targeted a water facility in the rural area of County Mayo in Ireland, leaving the residents without water for two days.

The attack was carried out by pro-Iran Cyber Av3ngers group which wrote a message on the infected computer system and claimed that the facility was targeted because it used Unitronics Vision Series programmable logic controllers (PLCs), an Israeli-made piece of equipment.

In November, Microsoft’s Threat Analysis Center reported that the Islamic Republic has intensified its cyberattacks and influence operations since 2020, targeting the likes of Israel and Bahrain, one of the Persian Gulf states to make peace with Israel under the 2020 Abraham Accords, brokered by the US.

Hossein Salami stated Thursday that "according to divine promise, the enemies will soon be defeated", referring to Israel. Claiming the spiritual underpinning of the IRGC, he added, "The IRGC embodies many divine symbols, and its essence and nature are based on piety."

Since the terror attack of October 7, in which Hamas unleashed thousands of its militia to invade the Jewish state, Israel has responded with its most brutal force since the proscribed terror group took control of Gaza in 2007. Around 20,000 Gazans have been killed in the offensive which came after 1,200 mostly civilians in Israel were murdered and 240 more taken hostage to Gaza.

The IRGC, classified as a foreign terrorist organization by the United States, is directing Iran's proxies in countries including Lebanon, Iraq, Syria and Yemen in the wake of the Gaza war. Over 100 attacks have been carried out against US facilities in the region and attacks on Israel from north to south.

As a potent faction in Iran, the IRGC not only oversees a substantial business empire but also commands elite armed and intelligence forces. Washington asserts that these forces are actively involved in a global terrorist campaign.

Iran’s Foreign Ministry Spokesman Nasser Kanaani said on Thursday that Tehran will not show “the slightest hesitation in maintaining its territorial integrity.”

He called the three islands “an inseparable part” of Iran, adding that the Islamic Republic considers as “non-negotiable” its territorial integrity and sovereignty over these islands.

The remarks came a day after the sixth Russian-Arab Cooperation Forum in Morocco concluded with a statement reiterating the UAE’s claim over the islands. The Russian delegation to the forum was led by Foreign Minister Sergei Lavrov.

“The statement supported peaceful solutions and initiatives aiming to resolve the conflict through bilateral negotiations or the International Court of Justice, according to international law and the UN Charter,” the UAE’s Ministry of Foreign Affairs announced.

Moscow had previously voiced its support for UAE’s claim back in July during a joint summit between the Persian Gulf Cooperation Council (GCC) and the Russian Federation.

The three Persian Gulf islands have historically been part of Iran, proof of which can be corroborated by historical and geographical documents. However, the United Arab Emirates has repeatedly laid claim to the islands, describing the situation as “the continued occupation by the Islamic Republic of Iran.”

The three islands fell under British control in 1921 but on November 30, 1971, a day after British forces left the region and just two days before the UAE was to become an official federation, Mohammad Reza Shah sent the Iranian navy to secure all three. Iranian forces remain on the islands, with only Abu Musa having a civilian population which is less than two thousand.

As revealed by cybersecurity researchers, including Marc Elias from Symantec, this marks a departure from MuddyWater's previous emphasis on entities in the Middle East, marking their first known operation against African organizations.

The cyber-attacks, conducted in November against unspecified telecom companies, have not shown evidence of successful information theft. However, analysts suggest that the primary objective of the campaign is likely espionage, based on MuddyWater's historical patterns. There is also speculation about the potential for disruption attacks, drawing on the tactics of Iranian hacking groups in the past.

The hackers' activities in Africa may be influenced by the ongoing Israel-Hamas conflict, with Egypt a prime target due to its proximity to Gaza and Israel.

MuddyWater's recent campaign, analyzed by Symantec, stands out for its use of a PowerShell launcher from a newly identified toolset called MuddyC2Go. Discovered in November, the toolset may have been operational since 2020, granting threat actors remote access to victim systems.

In addition to the PowerShell launcher, MuddyWater deployed other tools, including the legitimate remote device control and management software SimpleHelp. The software, once installed, operates as a system service, providing attackers continuous access and the ability to execute commands with administrator privileges.

Active since at least 2017, MuddyWater has consistently demonstrated an interest in targeting telecom organizations, aligning with broader trends observed among cyber-espionage groups.