The United States is seeking two Iranian hackers believed to have been conducting years of espionage and cyberattacks at the request of the Iranian government, while also seeking their own personal financial gain. The Iranian hackers, named Hooman Heidarian and Mehdi Farhadi, are accused of conducting cyberattacks against a wide range of targets since at least 2013.
The victims targeted by the two Iranian hackers include several universities in the United States and abroad, a Washington think tank, a defense company, an aerospace company, a foreign policy organization, NGOs, and governments and entities in other countries that the two defendants considered to be Iran's adversaries. Most of the defendants' targets are in the United States, Israel, and Saudi Arabia.
U.S. officials said Heidarian and Farhadi focused on gaining access to accounts , computers and internal networks, from where they stole sensitive and confidential data on topics ranging from national securityforeign policy, nuclear energy and aerospace. The data they stole included unpublished scientific research.
George M. Crouch Jr., head of the FBI's Newark Division, said the two defendants stole personal information from Iranian dissidents, human rights activists and opposition leaders. Prosecutors believe some of the stolen data was handed over to the Iranian government, while others were sold on black markets, as the two Iranian hackers also aimed to make personal financial gains.
As for the tactics and skills of hackers, they have evolved significantly over the years. US officials said that Heidarian had previously operated under the hacker moniker Sejeal and carried out defacement attacks on more than 1,000 sites, on which he posted pro-Iranian messages.
Heidarian is also believed to have mass-spammed Israeli citizens with threatening anti-Israel SMS messages . Over time, Heidarian and Farhadi began to adopt the tactics of state-sponsored hacking groups. These included performing online reconnaissance before launching attacks, using vulnerability scanners to find vulnerabilities in a victim’s network, and using SQL injection exploits to take over vulnerable servers . They also developed malware , keyloggers, and remote access trojans (RATs), eventually creating their own botnet to spam victims and launch DDoS attacks. They also used session hijacking to gain access to accounts, using stolen cookies, and in some cases, they also created hidden forwarding rules for compromised email accounts .
The two hackers face up to 20 years in prison for their crimes, which include espionage and cyberattacks, if they are arrested and convicted in the US. This comes after the US Department of Justice (DoJ) charged two other Iranian hackers with defacement of US sites following the US killing of Iranian military leader Qasem Soleimani
Iranian-funded hackers engaged in both espionage and financial cybercrime are not a new phenomenon. The US indicted another Iranian hacking group in March 2018, which also operated as a hacker-for-hire group for the Iranian regime, while also stealing and selling academic research and documents from Western universities on Iranian-owned sites.
Currently, the two Iranian hackers are wanted by the FBI.
