Iranian Hackers Have Infiltrated US Infrastructure

A new research published by the security firm FireEye says  Iran's hacking activity show no signs of slowing down. FireEye calls them Advanced Persistent Threat 34, and has spent the last few years burrowing deep into critical infrastructure companies.

Given how aggressively Iran has pursued infrastructure hacking, previously targeting the financial sector and even a dam in upstate New York, the new findings serve as a warning, and highlight the evolving nature of the threat.
FireEye researchers tracked 34 of the group's attacks on institutions in seven Middle Eastern countries between 2015 and mid-2017, but says APT 34 has been operational since at least 2014. 

The group appears to target financial, energy, telecommunications, and chemical companies, and FireEye says it has moderate confidence that its hackers are Iranians. 

They log into VPNs from Iranian IP addresses, adhere to normal Iranian business hours, their work has occasionally leaked Iranian addresses and phone numbers, and their efforts align with Iranian interests. Namely, targeting the country's adversaries.

New APT in Town
There isn't definitive evidence of a direct link between APT 34 and APT 33, an Iranian hacking group and malware distributor FireEye published findings on in September. But researchers have seen APT 34 operating concurrently inside many of the same target networks as other Iranian hackers.

"We have seen, and this is with a lot of the Iranian actors, a very disconcerting or aggressive posture towards critical infrastructure organizations," says John Hultquist, director of intelligence analysis at FireEye. 

"APT 33 has targeted a lot of organisations in critical infrastructure in the Middle East and so has APT 34. They obviously represent opportunities for intelligence collection. But we always have to think about the alternative use of those intrusions or accesses as possible means for disruption and destruction, especially given the destructive incidents we’ve already seen with other Iranian actors."

To establish what Hultquist describes as beachheads, APT 34 uses involved operations to move deeper and deeper into a network, or exploit a toehold within one organisation to pivot into another. FireEye has observed the group compromising someone's email account at a target company, rifling through their archive, and restarting threads as old as a year, to trick the recipient into clicking a malicious attachment. The hackers also use compromised email accounts to spearphishing other companies, and leapfrog into their systems as well.

News Outlet
Another hacker group “Charming Kitten” used false identities to ferret out information, says Israel-based cybersecurity firm ClearSky. The espionage group known as Charming Kitten is believed to be behind a campaign targeting academic researchers, human rights activists, media outlets and political advisors focusing on Iran, according to a report published recently by Israel-based threat intelligence company ClearSky Cyber Security

The group has also set up a news outlet called The British News Agency to lure targets in. Most of the group's targets are in Iran, the US, Israel and the UK, the report said, but some come from countries including France, Germany, Switzerland, Denmark, India, Turkey and the United Arab Emirates.

The report detailed the various methods used to gain access to computers and private social accounts. Those include false identities, the impersonation of real companies, the insertion of malicious code into a breached website, also known as "watering hole attacks," and spear phishing, the process of pretending to be service providers like Gmail or Facebook to trick people into giving out personal information. 

Much effort went into creating a seemingly legitimate website for The British News Agency, including details about the agency and a contact list of the management team. The purpose of the site was to attract the targets and infect them with malware. 
The scope and systemic character of the attack reveal that it's not a private venture, said Head of Threat Intelligence at ClearSky Eyal Sela in an interview with Calcalist, and the threat intelligence community is quite sure Charming Kitten is only one of several such groups that are linked to the Iranian regime. 

The attack was not made for financial gain, said Mr. Sela: "not one person hacked suffered financial damage. The identity of the attacked, human rights activists and people with political ties, does not support the thesis that the campaign is connected to criminal groups." 

The real purpose of the attack is to ferret out information about Iranian dissenters, said ClearSky CEO Boaz Dolev in an interview with Calcalist. "They want to know who the researchers are talking to," he said, adding that the targets' contact lists serve as a list of traitors. "They want to know who in Iran is in contact with such people out of the country." 
According to the report, multiple Israeli researchers of Iran and the Middle East were sent emails and Twitter direct messages from accounts registered with seemingly Jewish Israeli names. Messages coming from one such account were presented as if coming from a journalist and political researcher at KNBC News. 

Other messages were presented as if coming from an Israeli political researcher raised in California who needed help with an article and also wanted to apply for a position at an Israeli university. Another message was described as coming from a Jewish girl living in Iran. These messages often linked to phishing pages. ClearSky cannot estimate how many accounts were successfully infiltrated, but the success rate for such attacks is usually around 10%, said Mr. Dolev. 

ClearSky reports also point out a connection between Charming Kitten and Behzad Mesri, also known as "Skote Vahshat," the Egyptian citizen indicted by the FBI for hacking into HBO and leaking episodes of several series, including Game of Thrones. According to the FBI, Mesri has been a member of an Iran-based hacking group called the Turk Black Hat security team at certain times.

According to ClearSky, Mr. Mesri follows entities connected to Charming Kitten on Twitter, and was in the Turk Black Hat group at the same time as a hacker called ArYaIeIrA, who now also appears in multiple domains owned by Charming Kitten. The report's authors estimate "with medium certainty" the Mr. Mesri is directly connected to Charming Kitten, and potentially is part of Charming Kitten. D.C.-based Security researcher Collin Anderson previously hypothesized. 

The Iranian attackers are active hackers recruited by the Iranian authorities, and not officially people recruited at a young age and then trained for the job said, Mr. Sela.

That's why they leave a public residue, like signatures in the websites they hack. Many of the group's members are Facebook friends with Mr. Mesri, said Mr. Sela: "these are not people that approve every friend request. They have maybe 200 friends. They only confirm people they know."

Calcalistech:       Wired

You Might Also Read:

Iran Responsible  For Cyber Attack On British Parliament:

The Growing Cyber Threat From Iran:

Tackling Cybercrime: Time For The Regional Gulf Cooperation Council To Join Global Efforts:


 

« Popular Streaming Sites Secretly Mine Cryptocurrency
Intelligent & Autonomous Security Robots »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Chatham House

Chatham House

Chatham House is an independent policy institute based in London. Topics cover foreign affairs and defence including cyber security.

IGEL Technology

IGEL Technology

IGEL Technology is one of the world's leading thin client vendors. Thin clients increase data security and compliance.

Vera Security

Vera Security

Vera is a data security platform that provides 360-degree visibility and control over critical business data, anywhere it's shared or stored.

Sogeti

Sogeti

Sogeti deliver solutions that enable digital transformation and offer cutting-edge expertise in Cloud, Cybersecurity, Digital Manufacturing, Quality Assurance, Testing, and emerging technologies.

Norwegian Information Security laboratory (NISlab)

Norwegian Information Security laboratory (NISlab)

NISlab conducts international competitive research in information and cyber security and operates study programs in this area.

ElcomSoft

ElcomSoft

ElcomSoft is a global leader in computer and mobile forensics, IT security and forensic data recovery.

Sphonic

Sphonic

Sphonic provides regulated institutions of any size a powerful compliance & risk platform to quickly and securely onboard new customers and manage ongoing AML and Fraud & Risk trends.

Jenson Knight

Jenson Knight

Jenson Knight is a global cyber security, cloud and IT infrastructure staffing specialist.

BotRx

BotRx

BotRx is the only AI-enabled, automated fraud protection technology that allows fast & easy deployment - continually keeping invisible bad bots and agents at bay, so you can rest easy.

InfoSystems Inc

InfoSystems Inc

InfoSystems provides reliable IT solutions to build and maintain strong and secure systems for both SMB and enterprise organizations.

Trusted Security Solutions (TSS)

Trusted Security Solutions (TSS)

TSS are specialist in IT Security and providing Cybersecurity Solutions & Services combined with storage and backup.

Celebrus

Celebrus

Celebrus Fraud Data Platform, by D4t4 Solutions, works with existing fraud structures to augment functionality and turn fraud management into true fraud prevention.

Phronesis Security

Phronesis Security

Phronesis Security is committed to delivering world-class cyber security consulting with a tangible social and environmental impact.

Beyon Cyber

Beyon Cyber

Beyon Cyber offer a complete portfolio of advanced solutions & services for cyber security in Bahrain.

Saffron Networks

Saffron Networks

Saffron Networks is an ISO-certified company. We assure our clients of reliable solutions, specifically with the Security landscape and Enterprise Networking.

Cybersecurity Agency of Catalonia - Spain

Cybersecurity Agency of Catalonia - Spain

Cybersecurity Agency of Catalonia is responsible for implementing public policies in the field of cybersecurity and developing the cybersecurity strategy of the Generalitat de Catalunya.