A confidential FBI warns American businesses of a sophisticated Iranian hacking targeting airlines, the defense sector, energy companies and educational institutions.
According to Reuters, the activity was first discovered earlier this month by security firm Cylance, which said the actors involved are targeting critical infrastructure at organizations around the world. The company said it has already discovered more than 50 victims of the so-called “Operation Cleaver” attack in 16 countries, including the US.
The new FBI report , which Reuters said it saw on Friday, provides technical details about the malware and various other techniques used in the attacks, as well as advice on protecting against hackers. It also asked organizations to contact the agency if they believe they are victims of the Iranian attack.
While the FBI did not provide additional details, Cylance CEO Stuart McClure told reporters that the FBI warning suggests that Operation Cleaver may be larger in scale than reported. He added that it “underscores Iran’s determination to carry out large-scale attacks targeting critical infrastructure.”
Finkle of Reuters said that the FBI’s technical documents indicate that the hackers launched the attacks from two IP addresses located in Iran, but they do not specifically claim that the country’s government was behind the activity. Cylance said it believes the regime in Tehran is behind the attack, but its officials deny those allegations.
According to the Daily Mail , experts say Iran has invested heavily in its cyber capabilities since its nuclear program was hit by the Stuxnet virus in 2010. Dave Kennedy, CEO of TrustedSEC, said these efforts have turned the Iranians into “a serious threat” with “a lot of talent,” and according to Menchie Mendoza of Tech Times , the country is already believed to be responsible for several attacks. “In February, they were believed to be responsible for the devastating attack on Las Vegas Sands Corp , a casino operator,” Mendoza said . “The attack shut down thousands of servers, using destructive malware . The hackers later admitted that the attack was intended to punish Sheldon Adelson , Sands CEO , for commenting on a plan to detonate a nuclear bomb in Iran.”
Although no one has officially claimed responsibility for the development of the Stuxnet trojan, it has often been reported that the US and Israel were involved, with the aim of attacking Iran.
In November, researchers at Symantec, which first discovered Stuxnet , reported a new, similar Trojan that they believe has been used to spy on governments, businesses and researchers for more than six years. The origin of the program, which has been labeled Regin, is unknown, but Symantec said that nearly 100 successful attacks had been discovered as of November 24, 2014.
