In a world increasingly interconnected through digital channels, the domain of cybersecurity has become a battlefield for nations. The recent surge in cyberattacks against Israel, as disclosed by Gaby Portnoy, the head of the Israel National Cyber Directorate, at the 10th global Cybertech conference in Tel Aviv, underscores the evolving nature of modern conflicts. This article delves into the details of these cyber confrontations, tracing their origins, examining their impact, and exploring the broader geopolitical implications.

The Outbreak of the Cyber Warfare

On October 7, the same day Hamas’s military wing commander Mohammed Deif and Hamas leader in Gaza Yahya Sinwar orchestrated an attack that shook the physical security of Israel, a parallel cyber onslaught was unleashed. Directed by Iran’s supreme leader Ali Khamenei, cyberattacks spearheaded by Iran and its proxy, Hezbollah, began targeting Israel relentlessly. This marked a significant escalation in cyber aggression, leveraging the chaos of physical conflicts to breach digital defenses.

The Intensification of Cyber Operations

Since the onset of the conflict, the intensity and frequency of cyberattacks have tripled, targeting various sectors across Israel including academia, tourism, media, finance, transportation, health, government, and technology. Gaby Portnoy highlighted the unprecedented level of cooperation between Iranian groups and Hezbollah in these cyber operations, stressing the escalated threat level that now continuously hovers over Israel.

In an alarming revelation, Portnoy detailed how the Iranian Intelligence Ministry employs civilian proxies to carry out cyberattacks from an office in Tehran, disguised as a tech company. This clandestine group, along with the Hezbollah-affiliated Lebanese Cedar, was implicated in a cyberattack on Ziv Medical Center in Safed. Though the attack was thwarted without disrupting hospital operations, sensitive medical information was compromised.

Data Breach Statistics

The statistics presented in the National Cyber Directorate’s annual report for 2023 paint a grim picture of the cybersecurity landscape in Israel. In just three months following the October 7 attack, Israel recorded 3,380 cyber incidents—a 2.5-fold increase compared to previous years. Approximately 800 of these incidents were classified as having significant potential for damage, underscoring the serious nature of the threats.

Legal and Political Ramifications

The increase in cyberattacks has not only security implications but also significant legal and political ramifications. The Justice Ministry’s recent investigation into a cyber incident, where activist hackers claimed to have breached its servers and extracted substantial data, reveals the vulnerabilities and the potential for international legal disputes.

Global Implications and International Cooperation

Portnoy’s call at the Cybertech conference for global collaboration in combating cyberterrorism highlights the borderless nature of cyber threats. His warning that the attacks targeting Israel today could be directed at any nation tomorrow underscores the need for a unified international response to cyber threats. The establishment of a common cybersecurity language and framework among nations could be pivotal in preempting and mitigating future cyberattacks.

Industry Insights

Gil Shwed, founder of Check Point Software Technologies, also addressed the conference, noting that the sophistication and strength of cyberattacks have doubled since the conflict began. Shwed emphasized the need for consolidation in the cybersecurity market to enhance the effectiveness of digital defenses. His remarks about the necessity of collaborative efforts in the cyber realm resonate with Portnoy’s call for international cooperation.

The escalation of cyberattacks against Israel during the ongoing conflict with Hamas highlights a critical shift in how modern warfare is conducted. No longer confined to the physical battlefield, wars are increasingly being fought in the digital realm. The incidents described by Gaby Portnoy at the Cybertech conference serve as a stark reminder of the pervasive and persistent nature of cyber threats. As nations continue to grapple with these challenges, the importance of robust cyber defenses and international cooperation becomes ever more apparent. This situation demands vigilant monitoring, swift action, and, most importantly, a united global stance against cyberterrorism.

The Iranian Cyber Threat: A Detailed Analysis of Strategy, Operations, and Impact

Introduction

In the realm of cyber warfare, few nations have evolved as rapidly and strategically as Iran. Since the early 2010s, Iran has established a coherent national cyber strategy, buttressed by robust state institutions and growing technological and operational capabilities. Today, Iran stands alongside North Korea as a formidable force in the second tier of global cyber powers, trailing only behind heavyweights like the United States, Russia, China, the United Kingdom, and Israel. This strategic evolution reflects not only Iran’s indigenous capabilities but also the influence and assistance from major powers like Russia and China.

Iran’s Cyber Strategy and Ambivalent Cyber Posture

Iran’s journey into the cyber domain has been marked by an ambivalent yet strategic approach. Authoritarian by nature, the Iranian regime perceives the cyber realm as both a threat and an opportunity. On one hand, it views cyberspace as a vehicle for Western influence and domestic dissent, potentially destabilizing the regime. On the other, it recognizes the power of cyber tools in propagating state propaganda, controlling public opinion, and enhancing governmental control.

This dual perspective has made cyber operations a core component of Iran’s asymmetric warfare strategy, allowing it to engage with more powerful adversaries such as Israel and the United States indirectly and with minimal risk. Cyber capabilities have thus become a cornerstone of Iran’s national security doctrine, emphasizing offensive operations.

Iran’s Cyber Operations: Scope and Impact

Iran’s cyber operations have been diverse and impactful, targeting a range of entities across the globe, especially those in the Middle East and key adversaries like Israel and the United States. Since 2010, these operations have included significant cyber espionage activities, disruptive attacks, and cyber information warfare.

Cyber—An Overview

The Iranian cyber threat represents just one aspect of the extraordinary information revolution that has swept across the globe in recent decades. This revolution has fundamentally altered how we create, store, and manage information, transforming virtually every aspect of our daily lives and national operations. The staggering pace at which data is produced today is epitomized by the fact that in just two days, the international community generates as much data as it did from the dawn of civilization up until 2003.

By 2019, nearly half of the world’s households possessed a computer, marking a significant milestone in global connectivity. The proliferation of mobile technology has been even more remarkable; by 2021, there were approximately 15 billion mobile phones in use worldwide. In 2022, the number of devices connected to the internet soared to over 26 billion. Each of these devices not only signifies a leap in technological and societal advancement but also serves as a potential gateway for malicious cyber activities.

The onset of the artificial intelligence (AI) revolution marks the beginning of a new era in cyber capabilities. AI’s integration into various sectors introduces profound advantages and equally significant vulnerabilities. The period between 2005 and 2019 witnessed personal data breaches affecting more than 11.5 billion individuals across over 9,000 cyberattacks. The economic repercussions of global cybercrime, which totaled $8.4 trillion in 2012, are projected to double by 2025.

Ransomware attacks, which compel victims to pay a ransom to regain access to their encrypted systems, have become a primary method of cybercrime and, increasingly, of politically motivated attacks. The World Economic Forum has identified large-scale breaches of cybersecurity as one of the five most serious risks facing the world today.

The potential impact of cyberattacks on military operations is particularly alarming. Such attacks could disable weapon systems, distort their accuracy, disrupt communications, and adversely affect both troop and civilian morale. More disturbingly, successful cyberattacks on critical nonmilitary infrastructure could have systemic effects on a nation’s warfighting capabilities.

Tamir Pardo, former head of Mossad, has likened cyber warfare to a silent nuclear weapon—the ultimate weapon capable of dismantling countries. Traditional military defenses designed to protect national borders are becoming obsolete as the battlefield shifts predominantly to the civilian sphere. In this context, cyberattacks on civil infrastructure could potentially have more devastating consequences than conventional nuclear attacks. Whereas the destructive impact of nuclear weapons is localized or regional, the systemic effects of cyber weapons can be far-reaching and enduring.

For instance, a successful cyberattack on a state’s electrical grid could cripple both its economy and military, fundamentally altering the outcome of a conflict. Cyberattacks targeting water supplies, communication networks, and transportation systems could lead to widespread fatalities. These could include incidents of exposure to harsh weather conditions, dehydration, vehicular accidents, and severe traffic disruptions. Cyber operations could also extend to commandeering control over monitoring systems at critical facilities like nuclear reactors, refineries, or chemical plants, potentially leading to catastrophic failures.

The financial sector is not immune to these threats; cyberattacks could manipulate financial transactions or obliterate financial records, causing widespread economic chaos. Moreover, crucial societal databases, including those related to population registration, academia, agriculture, food distribution, and various manufacturing sectors, are all vulnerable to disruption or destruction via cyber means.

The realm of cyber has also profoundly affected intelligence collection and operations. The development of cyber capabilities has allowed intelligence agencies to transition from resource-intensive traditional espionage to more efficient and extensive cyber operations. For example, in 2020, Russian malware targeted sensitive defense-related facilities across several countries, including the United States, Canada, Mexico, and parts of Europe and the Middle East. Similarly, Chinese-affiliated hackers have launched extensive cyberattacks against technology firms and financial institutions across the globe, resulting in losses estimated in the trillions of dollars.

Furthermore, cyber-information operations have proven particularly effective against Western electoral processes. Notably, Chinese cyber operations targeted the U.S. presidential campaigns of Barack Obama and John McCain in 2008 and Joe Biden in 2020. The Russian interference in the 2016 U.S. presidential election is perhaps the most prominent example of a cyber operation aimed at undermining democratic institutions and sowing discord within the Western alliance.

While cyberattacks have rarely been directly lethal, their ability to cause physical damage and disrupt critical systems is escalating. The sheer volume of cyberattacks increases the likelihood of isolated successes, which can significantly undermine public confidence in national and international systems. The cyber realm offers a relatively low-cost, anonymous, and deniable means for state and non-state actors to exert influence or coercion. Even adversaries lacking the capability to target highly secured systems can erode a nation’s economic stability and public morale through sustained attacks on less-defended targets.

Why Cyber is Different

Quick Definitions and Categories of Cyber Operations

Before delving into the unique attributes of cyber as a domain of conflict, it’s crucial to understand the different types of cyber operations:

• Computer Network Attacks (CNA): These involve actions aimed to disrupt, damage, deny, deface, or destroy computer systems and networks, often referred to as cyber sabotage. CNAs may also serve as deterrents in strategic operations.
• Computer Network Exploitation (CNE): This category includes clandestine operations that penetrate computer and communications systems to collect, alter, or delete information. Often used for intelligence operations and domestic suppression, CNE is essentially cyber espionage.
• Computer Network Influence (CNI): Also known as cyber information operations, CNI efforts manipulate information and communications to influence perceptions of individuals, groups, or the general populace. These operations can serve to promote political objectives, disrupt electoral processes, and undermine governmental legitimacy and effectiveness.

Distinctive Characteristics of Cyber Operations

Cyber operations differ fundamentally from kinetic operations due to several distinctive characteristics:

Speed and Preparation

Cyberattacks can occur instantaneously, leaving virtually no time for preparation or for decision-makers to formulate a response, other than deploying automated defenses. This aspect of cyber operations demands a high level of readiness and preemptive security measures. In contrast, sophisticated cyberattacks involving espionage and infiltration may unfold over months or even years, requiring meticulous planning and persistence.

Accessibility and Disparity of Power

Unlike kinetic warfare, which is generally the purview of state actors or organized terrorist groups, the cyber realm is accessible to anyone with a computer and basic technical skills. This accessibility democratizes the use of force, allowing even individuals or small groups to carry out attacks that can have significant impacts. Furthermore, the proliferation of advanced computing technologies means that state-of-the-art cyber capabilities are no longer exclusive to powerful states or large corporations. As a result, smaller states or well-funded nonstate actors can potentially develop substantial cyber capabilities and achieve disproportionate effects.

No Geographic Limitations

Cyber weapons are unique in that they have no geographic constraints. They can be deployed globally against an unlimited number of targets almost simultaneously, crossing national borders undetected and often without the targeted states even realizing their networks have been compromised and their sovereignty breached. This ability to operate across borders without physical presence makes cyber weapons exceedingly potent and strategically versatile.

Nature of Impact

While kinetic attacks typically cause localized damage, cyberattacks can have systemic or nationwide consequences. For example, a cyberattack on a single electrical grid could lead to widespread social, economic, and military chaos, far exceeding the immediate area of the attack. This potential for broad systemic impact makes cyber weapons particularly effective for achieving strategic objectives indirectly and covertly.

Minimization of Collateral Damage

Cyber weapons can be targeted with precision that is difficult to achieve with conventional weapons, thereby minimizing collateral damage. Their effects can also be designed to be temporary or reversible, offering an advantage in situations where non-permanent disruption is the strategic goal.

Challenges in Attribution

Attributing a cyberattack to a specific actor is notoriously difficult. Cyber operatives can disguise their activities and even execute attacks that leave no trace, making it challenging for the targeted entities to detect and respond. However, advancements in forensic and intelligence capabilities have improved states’ and firms’ abilities to attribute cyberattacks more accurately, enhancing accountability and response strategies.

Target-Specific Nature

Unlike conventional weapons that can be used broadly across different targets, cyber weapons are often highly specific. A piece of code developed to compromise a particular type of system may be completely ineffective against another, even if the systems are superficially similar. This specificity requires a high degree of customization in cyber warfare, making the development and deployment of cyber weapons a highly skilled and resource-intensive endeavor.

The distinctive features of cyber operations — their speed, accessibility, lack of geographic limitations, indirect yet potent effects, challenges in attribution, and the precision of attacks — set them apart from kinetic warfare. These characteristics necessitate a unique strategic approach to defense, preparedness, and international cooperation in the cyber realm. As the digital landscape evolves, so too must our understanding and methodologies in dealing with cyber threats, ensuring that security measures are as dynamic and sophisticated as the threats they aim to counter.

Iran’s Cyber Strategy, Institutions, and Capabilities: An Analytical Overview

The evolution of Iran’s cyber capabilities marks a significant shift in the nation’s defense and strategic operations. The early 2010s saw pivotal events that prompted Iran to expedite the development of its initially limited cyber resources. This analysis delves into the factors that spurred this growth, the institutional framework established to guide and expand these capabilities, and the implications of Iran’s cyber strategy on global cybersecurity dynamics.

Iran’s cyber strategy, institutions, and capabilities based on the information you provided:

Year	Development/Event	Details
2009	Post-election protests	Internet used by Iranian opposition to sustain demonstrations; regime suppresses protests but recognizes potential threats from technology.
2010	Stuxnet attack	First cyberattack causing physical damage; joint US-Israeli operation targeting Iran’s nuclear program, leading Iran to rapidly develop cyber capabilities.
2012	Establishment of cyber institutions	Iran sets up Supreme Cyber Space Council, National Cyber Center, National Passive Defense Organization, Cyber Defense Command, Maher Information Security Center, Committee for Identifying Unauthorized Sites, and FATA.
2015	IRGC recruitment of cyber personnel	IRGC becomes dominant cyber actor in Iran, recruiting thousands and taking charge of offensive cyber operations, including operations by Iranian proxies like Hezbollah.
2016	Cyber budget and educational focus	Iran’s cyber budget reportedly exceeds $1 billion annually. By this year, 18% of university students in Iran are studying computer science. Compulsory military service channels graduates to state security apparatus.
2019	Expansion of offensive operations	Iran focuses on building infrastructure and targets globally for offensive cyber operations, including CNA, CNE, CNI, and ransomware attacks.
2020	Five-year plan to boost digital economy	Discussion of a plan to increase Iran’s digital economy from 6.5% of GDP to 10% by 2025.
2022	Suppression using NIW	National Information Network used to disrupt internet and cellular access during protests, demonstrating control over national cyberspace and ability to suppress opposition.
Ongoing	Asymmetric cyber warfare and strategy evolution	Iran employs measures to maintain deniability in cyber operations, using proxies and a variety of tactics to camouflage activities. A reactive strategy primarily in response to perceived threats from Israel and the US. Cyber is integrated as a critical component of Iran’s national security strategy for deterrence and offensive capabilities.

Catalysts for the Development of Iran’s Cyber Capabilities

Entity/Organization	Establishment Year	Main Functions and Roles
Supreme Cyber Space Council	2012	Responsible for planning and implementing an integrated national cyber strategy.
National Cyber Center	–	Coordinates Iran’s overall cyber activities, disseminates information, and oversees policy implementation.
National Passive Defense Organization	–	Defends Iran’s critical national infrastructure against cyber threats.
Cyber Defense Command	–	Coordinates the military’s cyber operations, primarily managed by the Artesh (regular military).
Maher Information Security Center	–	Acts as Iran’s computer emergency response team, dealing with security breaches and threats.
Committee for Identifying Unauthorized Sites	–	Works alongside FATA (Police for the Sphere of the Production and Exchange of Information) to monitor and regulate internet usage, focusing on both domestic suppression and countering cybercrime.
Ministry of Intelligence and Security	–	Handles signals intelligence and is deeply involved in the intelligence aspect of cyber operations.
Ministry of Information and Communications Technology	–	Oversees broader ICT policies and infrastructure development in Iran.
Islamic Revolutionary Guard Corps (IRGC)	–	Dominant force in Iran’s cyber operations by 2015, directing both defensive and offensive cyber activities, supporting operations of Iranian proxies like Hezbollah.
Basij	–	A paramilitary force under the IRGC, reportedly with 1,000 cyber battalions across Iran, outsourcing cyberattacks to various hacktivist groups.
Hacktivist Groups	–	Iranian Cyber Army, Islamic Cyber Resistance Group, Ashiyane Digital Security Team, and various “Kittens” groups like Flying Kittens, Magic Kittens, Domestic Kittens, Charming Kittens, and Cutting Kittens with diverse targets and modes of operation.
Basij Cyber Council	–	Coordinates the cyber activities of Basij and various independent hacktivist groups.
Institutes (Mabna, Rana, Nasr)	–	Facilitate access to foreign scientific resources for Iranian universities and research organizations, supporting Iran’s technological and scientific advancements.
National Information Network (NIW)	2009 (project initiation)	Aims to counter foreign cultural and political influences, enhance monitoring capabilities, and reduce vulnerability to both external cyberattacks and domestic opposition, echoing the Chinese model of a separate national intranet.

The 2009 Presidential Election and Subsequent Protests

In 2009, Iran faced massive internal unrest following presidential elections widely criticized for alleged vote rigging. The opposition leveraged the internet effectively to organize and sustain large-scale protests. Although the regime eventually suppressed these demonstrations, the events underscored the potential of digital technology to challenge state authority. This realization was a significant motivator for Iran to enhance its control over cyberspace and develop capabilities to both suppress internal dissent and monitor online activities.

The Stuxnet Cyberattack

The year 2010 was a turning point for Iran’s cyber defense posture, marked by the Stuxnet attack—a sophisticated cyber sabotage that targeted Iran’s nuclear enrichment facilities. Widely attributed to a US-Israeli collaboration, Stuxnet not only disrupted Iran’s nuclear program but also highlighted the nation’s vulnerabilities in cyber defense. This incident served as a wake-up call, leading to substantial investments in cyber capabilities to prevent future technological intrusions.

Key Institutions and Their Roles

• Supreme Cyber Space Council: Established in 2012, it is responsible for planning and implementing an integrated national cyber strategy.
• National Cyber Center: Coordinates Iran’s overall cyber activities, disseminates information, and oversees policy implementation.
• National Passive Defense Organization: Focuses on defending Iran’s critical national infrastructure.
• Cyber Defense Command: Manages the military’s (Artesh) cyber operations.
• Maher Information Security Center: Acts as Iran’s computer emergency response team.
• Committee for Identifying Unauthorized Sites and FATA: Monitors internet usage and counters cybercrime. FATA stands for the Police for the Sphere of the Production and Exchange of Information.
• Ministry of Intelligence and Security: Responsible for signals intelligence.
• Ministry of Information and Communications Technology: Involved in broader ICT policies and infrastructure.

Key Actors in Cyber Operations

• Islamic Revolutionary Guard Corps (IRGC): By 2015, the IRGC emerged as a dominant force in Iran’s cyber operations, directing both defensive and offensive cyber activities, and providing support to Iranian proxies like Hezbollah.
• Basij: A paramilitary force under the IRGC, reportedly having 1,000 cyber battalions nationwide. It also outsources cyberattacks to various independent hacktivist groups.

Hacktivist Groups and Their Roles

• Iranian Cyber Army: Known for major cyberattacks.
• Islamic Cyber Resistance Group: Engages in cyber operations aligned with Iran’s ideological goals.
• Ashiyane Digital Security Team: Specializes in digital security and has been involved in various hacking activities.
• Kittens Groups:
  • Flying Kittens: Focuses on gathering intelligence on foreign governments and corporations.
  • Magic Kittens: Targets domestic dissidents.
  • Domestic Kittens: Specifically targets dissidents within Iran and abroad.
  • Charming Kittens: Uses social networking platforms for targeting.
  • Cutting Kittens: Develops tools for website penetration.

Coordination and Strategy

• Basij Cyber Council: Coordinates the activities of Basij cyber battalions and various hacktivist groups.
• Institutes such as Mabna, Rana, and Nasr: Facilitate access to foreign scientific resources for Iranian universities and research organizations.

Operational and Strategic Camouflage

Iran employs various tactics to maintain plausible deniability in its cyber operations. This includes using malware that is frequently abandoned upon exposure and employing trusted intermediaries to outsource operations, thus masking direct involvement.

Evolution of Cyber Strategy

Iran’s cyber strategy has evolved over three primary stages:

• Stage 1 (2009–2011): Initial response to internal and external cyber threats.
• Stage 2 (2012–2018): Establishment of cyber institutions and beginning of offensive cyber operations.
• Stage 3 (2019–present): Expansion of infrastructure targets and offensive operations globally, particularly in information operations and combined cyberattacks (CNA, CNE, CNI, and ransomware).

National Information Network (NIW)

• Established following the model of China’s separate national intranet, NIW aims to effectively counter foreign cultural and political influences, enhance monitoring capabilities, and reduce vulnerability to cyberattacks and domestic opposition.

Evolution and Assessment of Iran’s Cyber Capabilities

Growth in Sophistication and Investment

Since the early setbacks, Iran has made significant strides in its cyber capabilities. By 2016, the nation was investing over $1 billion annually in this sector, with further increases projected in subsequent years. The establishment of a robust educational foundation, with a notable percentage of university students pursuing computer science degrees, reflects a long-term strategy to cultivate a skilled workforce for cyber operations.

The National Information Network: Iran’s Cyber Sovereignty Initiative

Iran’s strategy to mitigate the perceived threats posed by the global internet began in earnest with the development of the National Information Network (NIW). This project, inspired by similar initiatives in China, was aimed at creating a controlled intranet that would allow the government to manage information flows more effectively within the country. Starting in 2009, the NIW was a response to the growing need for internet sovereignty, reflecting a broader move among authoritarian states to control cyberspace.

The NIW involves the localization of internet services and infrastructure. By directing internet traffic within domestic borders, Iran aims to insulate its network from external influences and increase its capability to monitor and censor content. The development of an independent email service, operating system, and search engine for the NIW exemplifies Iran’s commitment to creating a self-sufficient cyber environment. This intranet was ostensibly completed in 2016, but enhancements and expansions have continued, as evidenced by the inauguration of new cloud infrastructures and data centers in 2020.

Internet Shutdowns: Control and Suppression of Dissent

One of the most potent applications of the NIW has been its role in controlling public dissent. During significant political unrest in 2019, and again in the tumultuous protests of 2022, the Iranian government effectively employed internet shutdowns as a tool to stifle protest movements. These shutdowns prevented the organization and mobilization of opposition, and crucially, helped obscure the regime’s repressive actions from both domestic and international audiences. The shutdown following the 2022 protests, sparked by widespread outrage over the enforcement of strict hijab laws, demonstrated the government’s reliance on cyber control to maintain order and suppress public dissent.

Cyber Operations and Strategic Objectives

Iran’s cyber operations extend beyond internal control to encompass a broader range of national objectives. These operations are integral to:

• Preserving the Islamic Republic’s stability and longevity.
• Upholding and promoting Iran’s Islamic values and legal strictures.
• Defending territorial integrity and the safety of its population.
• Fostering socioeconomic growth and public welfare.
• Spreading Iran’s theological and political influence across the region.
• Aspiring for regional dominance and establishing strong international relationships.
• Countering US efforts to contain Iran, particularly concerning its nuclear program.
• Diminishing American influence and countering Israeli state interests in the region.

These objectives underscore the importance of cyber capabilities in Iran’s national security strategy. The cyber domain provides Iran with a platform to achieve asymmetric warfare advantages, especially against technologically advanced adversaries like the US and Israel. This approach leverages cyber operations to execute a range of strategic actions, from disrupting enemy infrastructure to influencing international and regional public opinion, thereby extending Iran’s influence far beyond its physical borders.

In summary, Iran’s nuanced approach to the cyber domain reflects its strategic priorities and security concerns. By harnessing the power of the internet through the NIW and aggressive cyber operations, Iran not only shields itself against external and internal threats but also seeks to assert its influence and position as a formidable player on the global stage. The dual use of cyber tools for suppression at home and assertion abroad highlights the complex role that digital technology plays in modern geopolitical conflicts.

International Cooperation

Iran’s cybersecurity landscape has undergone significant evolution and expansion through its partnerships with key international players, primarily Russia and China. These collaborations have deeply influenced Iran’s cyber capabilities and strategic posture, affecting regional and global cyber interactions. This document provides a detailed analysis of the milestones and developments in Iran’s cyber cooperation with these nations over the past years.

Cyber Cooperation with Russia

The foundation of Iran-Russia cyber relations was officially laid in 2015 when the two nations inked their first agreement focused on cyber cooperation. This marked the beginning of a series of more in-depth collaborative efforts. One of the notable early developments was the establishment of an IRGC cyber defense system, which became operational the same year and was reportedly developed with assistance from Russian and potentially Chinese experts.

In 2016, further consolidation of this partnership was evident when Russia and Iran vowed to work together to challenge what they perceived as “unilateral Western domination” of the software market. This agreement hinted at Iran’s interest in adopting Russian alternatives to widely used Western software, such as Microsoft’s Windows and Office.

The collaboration took a more structured form in 2017 with the signing of a Memorandum of Understanding (MoU) on Information and Communications Technology (ICT). This MoU covered several critical areas, including internet governance, network security, and enhancing international internet connectivity. This was a strategic move to enhance Iran’s sovereign capability over its cyberspace and infrastructure.

By 2018, Iran had taken the initiative to form a bilateral media cooperation committee aimed at countering what both nations described as “Western media terrorism.” This committee was part of another MoU focusing on promoting favorable mutual media coverage, increasing co-production of content, countering Western media narratives, and broadening cooperation on methods of targeting foreign audiences.

Expanding Horizons in 2019-2020

During 2019 and 2020, the cyber relationship between Russia and Iran deepened with the establishment of bilateral working groups. These groups were tasked with providing Iran capabilities in tracking individuals via facial recognition technologies, enhancing cooperation in 5G networks, promoting AI development, and fostering Russian investment in Iranian cyber firms. Notably, this period also included discussions for potential multilateral investments involving Turkey and Azerbaijan.

A significant agreement in 2020 aimed to counter what was described as “increasing information pressure from the West,” designed to discredit both Russia and Iran. This alignment indicated a shared perception of external threats and a unified approach to countering them through strategic information operations and technology exchanges.

A Comprehensive Pact in 2021

The culmination of these efforts was the “Information Security Cooperation Pact” signed in 2021. This extensive pact covered a wide array of domains, including cybersecurity, technology transfers, and measures to detect and respond to cyberattacks. It also included aspects related to the suppression of domestic dissent, diplomatic coordination in the UN, and other multilateral forums to promote international cyber norms and laws aligning with Russian and Iranian interests. The pact reportedly facilitated the provision of advanced Russian surveillance software to Iran, enhancing its capabilities to monitor and potentially hack phones and computers of dissidents and adversaries. While direct evidence was limited, there were suspicions that Iran might have shared some of these technologies and methodologies with Hezbollah and other allied militias.

Strategic Shifts Post-Ukraine Conflict

The ongoing conflict in Ukraine has further deepened strategic cooperation between Iran and Russia, possibly extending to the cyber domain. Although specific details remain sparse, there are indications that Russian-affiliated hackers may have participated in Iranian cyberattacks against Israel, notably during the annual #OpIsrael and Jerusalem Day campaigns.

China’s Role in Enhancing Iran’s Cyber Capabilities

Parallel to its engagement with Russia, Iran has significantly benefited from its partnership with China, particularly in building its cyber infrastructure. In 2021, a pivotal 25-year strategic cooperation agreement was signed between the two countries. This agreement provided for Chinese support in several critical areas, including the development of Iran’s 5G telecommunications infrastructure and access to China’s global positioning system, Beidou.

Moreover, China has played a crucial role in asserting greater Iranian control over its cyberspace, possibly by strengthening the National Information Network (NIW). There were also agreements on new cyber capabilities necessary for intelligence collection. Chinese firms have actively supplied camera and AI capabilities to the IRGC and Basij militia, initially intended for traffic enforcement. However, these technologies were repurposed during the mass demonstrations in late 2022 to enforce Iran’s dress code for women and to identify and arrest demonstrators.

Iran’s strategic cyber partnerships with Russia and China illustrate a robust framework aimed at enhancing its cyber capabilities and asserting its sovereignty over cyber and information domains. These partnerships are characterized by significant technology transfers, cooperative defense mechanisms, and shared strategic interests against perceived Western dominance. As these relationships evolve, they continue to shape the regional and global cybersecurity landscape, underscoring the intricate interplay of international relations and cybersecurity policies.

Major Iranian Cyberattacks Around the World

Iran’s engagement in cyber warfare has evolved significantly over the past two decades, positioning itself as a formidable player in the global landscape of cyber threats. This document presents an in-depth analysis of the major cyberattacks attributed to Iran, shedding light on the strategies, targets, and impacts of these operations.

Early Activities and Disruptive Attacks

The first well-documented cyber activities attributed to Iranian actors date back to 2009. Following the disputed presidential elections, the Iranian Cyber Army, allegedly linked to the Islamic Revolutionary Guard Corps (IRGC), targeted opposition websites through defacements and Distributed Denial of Service (DDoS) attacks. These early attacks were primarily politically motivated, aiming to suppress dissent and control information during a period of internal instability.

Response to Stuxnet and Escalation

The discovery of the Stuxnet virus in 2010, believed to have been developed by the United States and Israel, marked a turning point in Iran’s cyber operations. In retaliation, Iranian hackers escalated their activities, targeting critical infrastructures abroad. Notably, from 2012 to 2013, a series of DDoS attacks disrupted the operations of major American financial institutions, including J.P. Morgan, Chase, Wells Fargo, and American Express. These attacks, dubbed “Operation Ababil,” were a demonstration of Iran’s growing capabilities and willingness to engage in cyber warfare against state actors.

The Shamoon Campaigns

In 2012, Iran executed one of the most destructive cyberattacks to date against Saudi Aramco, the kingdom’s national oil company. The attack deployed the Shamoon malware, which wiped data from approximately 30,000 computers, crippling the company’s operations. This incident underscored the potential of cyber tools to inflict damage on a scale comparable to traditional military methods. Shamoon resurfaced multiple times in subsequent years, targeting various sectors in Saudi Arabia and other Gulf states, indicating a pattern of persistent cyber aggression from Iranian actors.

Expanding Targets and Capabilities

Over the years, Iranian cyber activities have expanded in scope and sophistication. The targets have included critical infrastructure, financial services, government networks, and private sector entities across multiple countries. For example, in 2013, Iranian hackers gained access to the control system of a dam in New York, though the actual damage was limited. This was followed by numerous attacks on the energy and telecommunications sectors, notably in Saudi Arabia, Qatar, and the United States.

The Nuclear Context

The Joint Comprehensive Plan of Action (JCPOA) signed in 2015 did little to deter Iran’s cyber operations. In fact, cyberattacks against global energy and industrial sectors intensified. Following the U.S. withdrawal from the JCPOA in 2018 under the Trump administration, a series of cyberattacks targeted infrastructure, aviation, and manufacturing firms in the U.S. and Europe, demonstrating Iran’s retaliation to geopolitical tensions.

Recent Developments and Persistent Threats

In recent years, the focus of Iranian cyberattacks has broadened to include more direct attacks on civilian targets, as evidenced by the attempted cyberattack on Boston Children’s Hospital in 2021. Moreover, Iran’s cyber units have been implicated in espionage operations that significantly impact international security. Notably, the Charming Kitten group, associated with the IRGC, has been active in espionage and sabotage operations targeting government and civilian entities globally.

Espionage and Data Theft

Iran’s cyber espionage campaigns have been extensive, with attacks on hundreds of universities worldwide to steal research data and intellectual property. These operations have targeted sectors ranging from aerospace and satellite technology to defense and academia, underscoring the strategic importance of cyber espionage in Iran’s statecraft.

Information Warfare

Parallel to its hacking activities, Iran has also engaged in sophisticated information operations aimed at influencing international public opinion and political processes. These operations have used fake news sites, social media bots, and disinformation campaigns to sow discord and manipulate perceptions in the West and among its regional adversaries.

In conclusion , Iran’s cyber capabilities continue to grow, posing a persistent and evolving threat to international security. The scale and sophistication of its operations indicate a strategic use of cyber warfare to complement its regional and global objectives. As Iran continues to face economic sanctions and geopolitical isolation, its reliance on cyber operations as a tool of state power is likely to increase, necessitating vigilant cybersecurity measures by states and private entities alike.

---

TABLE 1 – Major Iranian Cyberattacks Around the World

Major Iranian Cyberattacks Around the World
Year	Target Country/Region	Target Entity	Type of Attack	Impact & Details
2009	Global	Opposition websites	Web defacement, DDoS	Early attacks by the Iranian Cyber Army targeting websites affiliated with opposition groups post-2009 election demonstrations.
2011	Netherlands	DigiNotar	Espionage (CNE)	Breach of digital certificate authority, allowing spying on encrypted communications of tens of thousands of Iranian citizens.
2012	Saudi Arabia	Saudi Aramco	Destructive malware	Shamoon malware attack erased data from 30,000 computers and 10,000 servers, disrupting company operations severely.
2013	USA	New York dam	Infrastructure hacking	Limited impact attack but raised concerns over security of critical infrastructure.
2016	Various	Internet service providers, telecoms	Hacking	Attacks against ISPs and telecom companies expanded to government agencies across the US and 12 European countries.
2016	Various	Universities, private firms	Intellectual property theft	Mabna Institute conducted intrusions into at least 320 universities in 21 countries and nearly 50 private firms, accessing confidential research materials.
2018	Global	Social media platforms	Disinformation	After the murder of Jamal Khashoggi, Iran intensified its disinformation campaigns, targeting Saudi Arabia with bots and fake news sites to disrupt US-Saudi relations and international perceptions.
2019	Bahrain	National Security entities	Malware	Suspected Iranian hackers used Dustman malware, similar to Shamoon, affecting Bahrain’s national oil company and other critical sectors.
2019	Global	Government, commercial targets	Espionage, hacking	Microsoft blocked 99 websites used by Iranian hackers for CNE attacks against DC government agencies, businesses, and individuals.
2019	Global	Major news organizations	Impersonation, disinformation	Phony websites masquerading as major news organizations like the Guardian and the Independent were launched to spread targeted fake news stories, increasing the impact of Iranian propaganda efforts by appearing more credible.
2020	Global	Human Rights Watch, various others	Phishing, espionage	Charming Kittens phishing campaign targeted emails and cloud storage of rights activists, diplomats, academics, and politicians.
2020	USA	Government and media websites	Website hacking, disinformation	Iranian hackers took over a US government website to insert a graphic image of President Trump, and operated the “American Herald Tribune” to pay Americans for writing articles supportive of Iran, which were then used to suggest widespread US support for Iran’s stance.
2021	Turkey	Governmental and private websites	Spear phishing	Attacks motivated by Turkey’s diplomatic changes, involved phishing to download malicious links.
2021	USA	Boston Children’s Hospital	Ransomware	Attempted attack could have disrupted critical medical services. Part of a broader ransomware campaign by Charming Kittens.
2021	Various	Dissidents, opposition groups	Espionage	Cyber operations targeted Iranian dissidents and opposition members in multiple countries, using malicious software distributed via social media and text messages.
2022	Albania	Government servers	Wiper attacks	Highly destructive attacks against Albania’s intelligence and police systems, resulted in severe data loss and diplomatic severance of ties with Iran.
2023	France	Charlie Hebdo subscribers	Data breach, disinformation	Hackers leaked personal information of over 200,000 subscribers of Charlie Hebdo in retaliation to cartoons critical of Iran’s Supreme Leader. This attack also involved using fake Twitter accounts to amplify the impact of the breach and stir public reactions.
2023	Global	Military and intelligence targets	Fake mobile apps	Iran developed and disseminated fake mobile applications mimicking popular platforms like Apple Store and Google Play. These apps were designed to spy on users, particularly targeting military personnel in the Middle East, to gather intelligence through data exfiltration and capturing audio and video, showing Iran’s continued focus on surveillance and intelligence gathering via innovative methods.
2023	Global	Cybersecurity groups	Infrastructure support	An Iranian-affiliated firm provided command-and-control services to various hacking and espionage groups worldwide, including those from China, Russia, and North Korea. This operation highlights Iran’s role in the global cyber-espionage ecosystem, supporting other state-sponsored actors, potentially as a way to gain insights into their operations and strengthen Iran’s own cybersecurity capabilities and offensive strategies.
2023	UK, USA	Nuclear weapons specialists	Phishing	Targeted phishing attack impersonated experts from the Royal United Services Institute, aiming to gather intelligence on US and UK foreign policies related to nuclear weapons.
2023	USA, UK	Nuclear policy experts	Spear phishing	Targeted phishing attacks impersonating credible sources, such as experts from the Royal United Services Institute (RUSI), to gain access to information on American and British foreign policy concerning nuclear issues. The operation was highly selective, focusing on fewer than 10 high-profile individuals in an effort to glean sensitive information that could influence Iran’s strategic positioning.
2023	Various	Information dissemination	Propaganda operations	Continuing their extensive use of information operations, Iran targeted audiences across multiple regions and languages, aiming to shape global perceptions favorably towards Iran while criticizing Western policies. These operations involved the production and dissemination of content through various media channels, promoting narratives that align with Iran’s geopolitical interests and fostering divisions among its adversaries.
2011-2014	Various	Defense, foreign affairs officials	Social engineering, Espionage	Operation Newscaster used fake journalist profiles and a news site to gather sensitive information, targeting US and Israeli defense contractors among others. Over 2,000 computers were compromised.
2011-2023	Various	Information operations	Propaganda, disinformation	Iran conducted numerous information operations across global media and social platforms. These operations aimed to influence public opinion and policy by promoting pro-Iranian narratives and sowing discord among adversaries. This included creating fake news websites, social media accounts, and amplifying specific political messages aligned with Iranian interests, particularly in the US, Europe, and the Middle East.
2012-2013	USA	American financial institutions	DDoS	Attacks on 466 financial institutions including J.P. Morgan, Chase, Wells Fargo, causing customer lockouts and long-term costs in billions for cybersecurity upgrades.
2013-2014	Various	Multiple sectors	Hacking	Control gained over 16,000 computer systems, targeting airlines, energy, defense, and US Navy and Marine Corps intranet.
2013-2017	Global	Universities	Intellectual property theft	Penetrated 320 universities worldwide, stealing vast quantities of data and intellectual property. About 8,000 academic accounts successfully breached.
2014-2019	USA	Aerospace and satellite firms	Social engineering	Campaign used social engineering to steal sensitive information from more than 1,800 accounts in the aerospace and satellite technology sectors.
2014-2020	Various	Dissidents, opposition groups	Cyber espionage	A campaign reportedly breached encrypted messaging systems like Telegram and WhatsApp, targeting Iranian dissidents and minorities.
2015-2018	Various	Global targets	Data destruction, hacking	Attacks on electric grids, water plants, transportation systems, financial institutions, and more. Data destruction at a Las Vegas casino and other firms post-US JCPOA withdrawal.
2016-2020	USA, Global	Electoral systems, public opinion	Election interference	Iranian efforts targeted American elections to sway public opinion and electoral outcomes, using misinformation and cyberattacks to undermine confidence in the electoral process, and attempting to influence the 2020 presidential election by intimidating voters and spreading disinformation about voting security.
2017-2019	Various	Government, military sites	Espionage, hacking	Compromised login details of thousands of officials in the UK, Australia, and New Zealand, targeting parliamentary, military, and diplomatic websites.
2018-2019	Middle East	Various sectors	Phishing, malware	Hackers posing as recruiters from prestigious institutions sent job offers to employees in utilities, energy firms, etc., to download malware.
2019-2020	USA	Social media users	Social media campaign	A broad-reaching campaign was conducted on platforms like Facebook, Twitter, Instagram, and YouTube, criticizing US policies and promoting narratives favorable to Iran, especially concerning US withdrawal from the nuclear deal.
2020-2021	Various	Academics, journalists	Intelligence collection	Multi-year operation targeted academics and journalists in over 30 countries, stealing highly sensitive communications from defense contractors and governments.
2020-2023	Global	Information operations	Propaganda, disinformation	Continued operations aimed at amplifying sectarian and political divisions, using current events like racial tensions in the US to parallel Iranian grievances and promote a narrative of shared victimization under American policies. This was part of a broader strategy to weaken alliances and stir discontent within countries perceived as adversaries.
2021-2023	Various	Critical infrastructure	Hacking, malware	Ongoing attempts and successes in penetrating systems related to critical infrastructure in Western countries, possibly preparing for future disruptive attacks.
2022-2023	USA	Critical infrastructure	Hacking, malware	Charming Kittens penetrated critical infrastructure systems, including seaports and energy sectors, possibly in preparation for retaliatory disruptive attacks.

---

Copyright of debuglies.com
Even partial reproduction of the contents is not permitted without prior authorization – Reproduction reserved