US launched retaliatory strike against Iranian military computers, as cyber war escalates

Washington: US Cyber Command on Thursday conducted online attacks against an Iranian intelligence group that US officials believe helped plan the attacks against oil tankers in recent weeks, according to people briefed on the operation.

In recent weeks, hackers believed to be working for the Iranian government have also targeted US government agencies, as well as sectors of the economy, including finance, oil and gas, sending waves of spear-phishing emails. This new campaign, claimed by representatives of cybersecurity companies CrowdStrike and FireEye claim, appears to have started shortly after the Trump administration imposed sanctions on the Iranian petrochemical sector this month.

The sophisticated cyber attacks between the US and Iran have escalated.Credit: The Age

Tensions have run high between the two countries since the US withdrew from the 2015 nuclear deal with Iran last year and began a policy of "maximum pressure." Iran has since been hit by multiple rounds of sanctions. Then Iran shot down an unmanned US drone this week.

The US attacks on Iran occurred the same day President Donald Trump called off a strike on Iranian targets such as radar and missile batteries. But the online operation was allowed to go forward because it was intended to be below the threshold of armed conflict — using the same shadow tactics that Iran has deployed.

The intrusion, which had been planned for several weeks, were ultimately meant to be a direct response to both the tanker attacks this month and the downing of a US drone this week, according to the people briefed on the operations.

Multiple computer systems were targeted, according to people briefed on the operations, including those believed to have been used by an Iranian intelligence group that helped plan the tanker attacks.

An additional breach, according to one person briefed on the operations, targeted other computer systems that control Iranian missile launches.

Determining the effectiveness of a cyberattack on the missile launch system is particularly difficult. Its effectiveness could be judged only if Iran tried to fire a missile and the launch failed.

US officials have said the cyberattack was launched after the US President backed away from plans for a more conventional military strike in response to Iran's downing of a US surveillance drone.

The cyberattacks - a contingency plan developed over weeks amid escalating tensions - disabled Iranian computer systems that controlled its rocket and missile launchers, the officials said. Two of the officials said the attacks, which specifically targeted Iran's Islamic Revolutionary Guard Corps computer system, were provided as options after Iranian forces blew up two oil tankers earlier this month.

The IRGC, which was designated a foreign terrorist group by the Trump administration earlier this year, is a branch of the Iranian military.

Iran has increased its cyberattacks on US infrastructure, including the oil and gas sectors, as tensions have grown between the two nations.Credit: AP

The action by US Cyber Command was a demonstration of the US's increasingly mature cyber military capabilities and its more aggressive cyber strategy under the Trump administration. Over the past year US officials have focused on persistently engaging with adversaries in cyberspace and undertaking more offensive operations.

"Both sides are desperate to know what the other side is thinking," said John Hultquist, director of intelligence analysis at FireEye. "You can absolutely expect the regime to be leveraging every tool they have available to reduce the uncertainty about what's going to happen next, about what the US's next move will be."

CrowdStrike shared images of the spear-phishing emails with the AP.

One such email that was confirmed by FireEye appeared to come from the Executive Office of the President and seemed to be trying to recruit people for an economic adviser position. Another email was more generic and appeared to include details on updating Microsoft Outlook's global address book.

The Iranian actor involved in the cyberattack, dubbed "Refined Kitten" by CrowdStrike, has for years targeted the US energy and defense sectors, as well as allies such as Saudi Arabia and the United Arab Emirates, said Adam Meyers, vice-president of intelligence at CrowdStrike.

Beyond the online operation, US military and intelligence officials also are trying to devise other operations that would not escalate tensions with Iran but would try to deter further aggressions and prod Tehran to stop, or dial back, its shadow war, according to current and former officials.

The Department of Homeland Security said in a statement released Saturday that its agency tasked with infrastructure security has been aware of a recent rise in malicious cyber activities directed at US government agencies by Iranian regime actors and proxies.

Cybersecurity and Infrastructure Security Agency Director Christopher Krebs said the agency has been working with the intelligence community and cybersecurity partners to monitor Iranian cyber activity and ensure the US and its allies are safe.

"What might start as an account compromise, where you think you might just lose data, can quickly become a situation where you've lost your whole network," Krebs said.

Such intrusions by Iran do more than just steal data and money — they also seek to delete data or take down entire networks. "What might start as an account compromise, where you think you might just lose data, can quickly become a situation where you've lost your whole network," Krebs warned.

The National Security Agency would not discuss Iranian cyber actions specifically, but said in a statement to the AP on Friday that "there have been serious issues with malicious Iranian cyber actions in the past".

"In these times of heightened tensions, it is appropriate for everyone to be alert to signs of Iranian aggression in cyberspace and ensure appropriate defences are in place," the NSA said.

Iran has long targeted the US oil and gas sectors and other critical infrastructure, but those efforts dropped significantly after the nuclear agreement was signed. After Trump withdrew the US from the deal in May 2018, cyber experts said they have seen an increase in Iranian hacking efforts.

"This is not a remote war [anymore]," said Sergio Caltagirone, vice-president of threat intelligence at Dragos Inc. "This is one where Iranians could quote unquote bring the war home to the United States."

Caltagirone said as nations increase their abilities to engage offensively in cyberspace, the ability of the United States to pick a fight internationally and have that fight stay out of the United States physically is increasingly reduced.

The US has had a contentious cyber history with Iran.

In 2010, the so-called Stuxnet virus disrupted the operation of thousands of centrifuges at a uranium enrichment facility in Iran. Iran accused the U.S. and Israel of trying to undermine its nuclear program through covert operations.

Iran has also shown a willingness to conduct destructive campaigns. Iranian hackers in 2012 launched an attack against state-owned oil company Saudi Aramco, releasing a virus that erased data on 30,000 computers and left an image of a burning American flag on screens.

In 2016, the US indicted Iranian hackers for a series of punishing cyberattacks on US banks and a small dam outside of New York City.

The Defence Department refused to comment on the latest Iranian activity. "As a matter of policy and for operational security, we do not discuss cyberspace operations, intelligence or planning," Pentagon spokeswoman Heather Babb said in a statement. The White House did not respond to a request for comment.

Despite the apparent cyber campaign, experts say the Iranians would not necessarily immediately exploit any access they gain into computer systems and may seek to maintain future capabilities should their relationship with the US further deteriorate.

"It's important to remember that cyber is not some magic offensive nuke you can fly over and drop one day," said Oren Falkowitz, a former National Security Agency analyst. It takes years of planning, he said, but as tensions increase, "cyber impact is going to be one of the tools they use and one of the hardest things to defend against."

AP, The New York Times