Iranian APTs: An overview
Who are the cyber threat actors experts have identified in Iran?
This individual is a guest contributor. MEI is not able to assist with contact requests.
Steph Shample was previously a Non-Resident Scholar with the Middle East Institute’s Strategic Technologies and Cyber Security Program.
For the past 16 years, her career has focused on analyzing Iran in various capacities, including its tense relationships with Middle Eastern countries as well as their bordering states, and countering Iranian roles in terrorism, proliferation, and narcotics.
During her military career, Steph gained operational experience across the Middle East, Levant, and Central and South Asia. She also completed two deployments to Afghanistan, one military and one as a civilian.
Who are the cyber threat actors experts have identified in Iran?
MEI’s Strategic Technologies and Cyber Security Program participated in both the DeepIntel and DeepSec conferences in Austria this past week. Here are our reflections on the conferences, the conversations we had there, and the overall agenda.
Over the past decade, Iran has made a concerted push to expand its cyber capabilities, an effort in which the IRGC has played a central role. Given the IRGC’s expansive and growing power, scholars, analysts, and many Iran watchers have long thought that at some point it could take over control in Iran, replacing the theocratic government with a military one. As Iran approaches an inflection point over the issue of succession after Ayatollah Khamenei, that day could be coming soon, and the IRGC is well placed to bring about such a transition given the hybrid mix of physical and cyber capabilities that it has developed and perfected over recent decades.
Quickly attributing or blaming a country for a cyber incident without technical analysis, proof, and government officials willing to go on record only inflames an already tense situation.
Blurring the lines between the physical world and the online one, the Iranian group known as the “Nakhsa Warriors” remains cloaked in mystery. Their identity and status are unclear. Are they a military force that carries out operations, an online group of like-minded individuals that share content, part of an Iranian disinformation campaign — or perhaps something else altogether?
The April 2019 Israeli elections between incumbent Prime Minister Benjamin Netanyahu and his competitor Benny Gantz were fraught with tension even before external entities got involved. But when Israel’s internal security service, Shin Bet, revealed that suspected Iranian cyber actors had accessed Gantz’s mobile phone, there was yet another issue to contend with, albeit one not specific only to Israeli elections: interference.