Iran’s Hackers Are Opportunistic, Patient, and Fearless

The disparate but sometimes overlapping hacker groups that work at the direction of Iran’s Ministry of Intelligence and IRGC are demonstrating “growing expertise,” the U.S. intelligence community said in February in its annual threat assessment. Iran, the assessment concluded, takes an “opportunistic approach” to cyber operations, particularly those that target U.S. and allied critical infrastructure. For example, experts in industrial control systems (ICS)—that is, computer systems that control critical infrastructure—maintain that Iranian hackers lack ICS-specific capabilities, but that has not stopped these operatives from attempting attacks using other means. As the Russian ransomware attack on Colonial Pipeline nearly a year ago vividly showed, attackers do not need ICS-specific capabilities to cause a massive disruption of critical infrastructure.

Instead, as the U.S., UK, and Australian governments disclosed late last year, Iranian government-sponsored hackers are targeting the unpatched business networks of critical infrastructure operators using vulnerabilities from as many as three years ago and a Microsoft Exchange vulnerability that received front-page headlines in early 2021 for its severity and scale. These hackers “are actively targeting” U.S. healthcare and public health companies and companies in other industries, the three governments concluded, not for a particular strategic reason, but because these companies are low-hanging fruit when they do not mitigate known vulnerabilities in their systems.

Similarly, in early 2022, researchers at cyber threat intelligence firm Checkpoint discovered Iranian hackers working for the IRGC who were exploiting the widely reported Log4j vulnerability to conduct attacks against unspecified victims. They are not the first hackers to take advantage of this vulnerability, but it is so prevalent across thousands of systems that it is a ripe avenue for attack.

That Iranian hackers are opportunistic does not mean that they are not deliberate. In a November 2021 assessment of Iranian cyber capabilities, Microsoft determined that Tehran’s hackers are displaying more patience and persistence, particularly in their social engineering—the first step in many cyber operations. Whereas operatives previously sent bulk unsolicited emails with malicious attachments, they are now using much more time-consuming and individualized—and often successful—tactics to win the trust of victims in order to lead them to click malicious links and install malware. A more patient adversary is a more dangerous one.