U.S. Government Hit by Major Iranian Cyber Operation

The Department of Homeland Security (DHS) issued an emergency directive on Tuesday to all federal agencies to take immediate steps to combat a campaign to redirect internet traffic to websites controlled by malicious actors. Although DHS did not link this series of malicious operations to Iran, private cyber threat researchers at FireEye concluded that the evidence points to Iranian sponsorship. This operation follows a trend of global Iranian cyber campaigns, as identified in a November FDD report.

According to FireEye and Cisco, the “sophisticated” and “innovative” campaign used at least three different methods to manipulate “Domain Name System” (DNS) records, which translate URLs into numerical IP addresses so that internet users’ requests reach the intended websites. “DNS hijacking” enables hackers to decrypt the redirected internet traffic, read emails, and steal credentials.

This is the latest in a series of exceptional operations for Iranian hackers. The Department of Justice issued an indictment in November against two Iranian hackers responsible for $30 million in losses as a result of ransomware attacks. Assistant Attorney General Brian Benczkowski called the indictment “the first of its kind.” In August, Facebook, Google, and Twitter dismantled hundreds of accounts in what was the first reported case of Iranian influence operations exploiting U.S. social media. In March, the Justice Department charged nine Iranians in “one of the largest state-sponsored hacking campaigns ever prosecuted.” The past two years have also witnessed the resurgence of the Shamoon virus, the original variation of which destroyed a then-unprecedented 35,000 computers at Saudi Aramco.

DHS warned that the interception of web and email traffic affected “multiple executive branch agency domains” and posed “significant and imminent risks to agency information and information systems.” Given the scale and persistence of the threat, DHS is right to require that agencies change DNS account passwords and implement multi-factor authentication. Yet good defenses are insufficient to combat Iranian cyber operations. Indictments and sanctions help to hold attackers accountable, but have a limited deterrent effect. Until the Islamic Republic recognizes that Washington is prepared to disable the networks responsible for such attacks, the leadership in Tehran will continue to commission them.

Annie Fixler is the deputy director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies and contributes to FDD’s Center on Economic and Financial Power. Follow her on Twitter @afixler.

Follow FDD on Twitter @FDD. FDD is a Washington-based, nonpartisan research institute focusing on national security and foreign policy.

This article appeared originally at Foundation for Defense of Democracies (FDD).