Over the past year, tensions over Iran’s nuclear program have permeated into cyberspace at an unprecedented rate, prompting an unending wave of tit-for-tats with Israel. Ostensibly anonymous hacktivist groups presenting as dissidents have repeatedly targeted Iran’s public sector with espionage and sabotage attacks. Both sides have accused the other of orchestrating these attacks. Thus far, the New York Times has confirmed with two U.S. officials that Israel was behind at least one of these events that targeted gas pumps in Iran last October. There are also speculations about the Iranian origin of cyber activities against Israeli entities. The growing pace of these incidents is bringing decades of hostility between the two regional rivals into broad daylight in and through the cyber domain.
This report is the first in a forthcoming series of HackerWatch reports in which the Filterwatch team aims to track malicious cyber activities of Iran as well as any blows to the country from other threat actors. By following these developments, we hope to analyze Iran’s ever-changing landscape of cyberspace, its rationality for offensive and defensive activities, and the big picture of cyber escalation in the Middle East.
HackerWatch will be published biannually and present the most important developments of the preceding six months. This first report focuses on the first half of 2022, exploring two major themes: (1) Iran’s continued targeting of diaspora organizations through phishing, impersonation, and defacements, and (2) the escalation of hacktivist attacks targeting Iran and Israel, with each country accusing the other of orchestrating these activities.
As Iran continues to negotiate with world major powers over its nuclear program – and Israel remains in fierce opposition to any settlement with Iran– malicious cyber activities are on the rise as an extension of the geopolitical tensions between the two states.
Read our full report here.
