Iranian Cyber Operations

Americans have long found comfort in the two oceans that separate us from Middle East wars, but the vulnerabilities Iranian cyber operations pose bring these conflicts much closer to home. Through cyber intrusion, Iran has already disrupted our water supply and healthcare sector while continuing to threaten our energy and telecommunications infrastructure. If we fail to force an end to Iran’s cyber warfare, collaborate with our partners to alert the public on Iranian threats, and help communities address key cybersecurity concerns, the Iranian state and cybercriminals may cause irreversible damage to American infrastructure. 

Attempting to disrupt U.S. military operations and  the American government, cybercriminals within the Islamic Revolutionary Guard Corps’ (IRGC) Cyber Economic Command and Iran’s Ministry of Intelligence (MOIS), such as Handala Hack Team, launched direct cyberattacks targeting American troops and officials.  These attacks not only demonstrated Iran’s intent to harm the American warfighter, but also compromise our defense apparatus. Handala claimed responsibility for seizing the personal information of U.S. servicemembers stationed in the Middle East, including details on the F-35 fighter jet, as well as hacking the U.S. Federal Bureau of Investigations Director’s email.

While the Trump administration has recently expanded the U.S. government’s jurisdiction to combat foreign cybercriminals, Iranian cybergroups’ recent threats to our water, energy, and telecommunications sectors suggest they feel empowered to continue launching attacks.

As U.S. forces in the Middle East combat Iranian missiles and drone attacks on our troops and allies, the United States must counter the full range of Iranian aggression, including the regime’s use of cyberwarfare. Until we do that, Iran will continue to have a means of pressuring the United States and targeting Americans. Therefore, U.S. officials should publicly signal a firm position that Washington will only agree to end the war and will hinge any future deal with Iran if the regime halts cyberattacks on U.S. and partner infrastructure.

But linking a deal may not entirely stop Iran from finding loopholes to resume its malign operations. Therefore, the intelligence community and U.S. foreign partners should exchange common tactics, techniques, and procedures of Iranian cybercriminals and inform the public on these identifying features. By exposing Iran’s common hacking signatures, government’s can prepare their people to recognize and thwart Iran’s operations. 

Meanwhile, the U.S. Cybersecurity and Critical Infrastructure Security Agency (CISA) should lead a nationwide hands-on cybersecurity educational initiative with state, local, and tribal governments, as well as major infrastructure stakeholders, such as telecommunications, water, and energy companies aimed at identifying zero-day vulnerabilities and providing them with the necessary tools and resources to fix them. Within this initiative, any organization CISA assesses to have a direct role in operating our critical infrastructure must meet a series of cybersecurity conditions CISA sets, and must undergo annual reviews ensuring full compliance with CISA safeguards.

Iran’s kinetic attacks and assault on the Strait of Hormuz aren’t the only actions causing international chaos. Iran’s cyber warfare has infiltrated the daily lives of American citizens and disrupted military operations overseas. It is essential that Washington treat any cyberattack targeting our military assets, civilians, and international partners like any other kinetic strike. Therefore, we must hold Iran accountable for its cyberattacks while actively collaborating with our foreign partners and rigorously bolstering our cyber defenses nationwide.

LtGen Mike Groen (U.S. Marine Corps, ret.) was Director of the Joint Artificial Intelligence Center (JAIC) and was a participant in the Jewish Institute for National Security of America (JINSA) 2023 Generals and Admirals Program.

Sarah Havdala is a policy analyst at JINSA.