US Releases Iranian Hacker

30 year old Iranian hacker Nima Golestaneh was extradited to the US from Turkey last year suspected of hacking attack against American military aerospace contractor Arrow Tech Associates (Vermont, USA).

In October 2012 Golestaneh broke into the servers of the company which builds ballistics prediction and testing software, and accessed its databases in attempt to steal software worth $millions.

US investigators identified that Golestaneh was in Turkey and he was then extradited to the US last year for trial on charges of wire fraud, unauthorized access to computers and money laundering.

However Golestaneh was pardoned by the United States and sent back to the Islamic Republic before being sentenced.
It seems that Golestaneh was part of an active Iranian hacking team that targets both US infrastructure and defense companies as well as the Las Vegas Sands casino email system.

Massive Power Cut Brings Turkey To Stop : Iran Cyber Attack

Turkey is in process of recovering from a major power cut that brought the country almost to a stop. According to some media reports from Turkey almost the entire country was affected by the massive power cut. Officials are considering the possibility that they were hit by a major cyber attack that was directed at its critical infrastructure.
 

The Turkish government is currently presenting the power cut as technical issue but some suspect that a state sponsor could have authorized this massive cyber attack against Ankaras electric grid and other features of its critical infrastructure.

Turkish officials said that the issue stems from technical problem with the computer system of the Turkish Electricity Conduction Company which is responsible for controlling power lines.

Prime Minister Ahmet Davutoglu stated that every possibility including a terrorist attack is being investigated.

Turkish Energy Minister Taner Yildiz added that officials were investigating whether the power outage was result of a cyber attack. The energy minister said: «I also cannot say whether or not there was a cyber attack. The most important thing for us is to bring the system back to life. This is not something we frequently experience. »

If officials do determine that Turkey was hit by major cyber attack, Iran will likely be seen as primary suspect.

The power cut happened as tensions increasingly rise between Iran and Turkey over past few weeks. Although it takes time to determine attribution from a cyber attack some news outlets report that authorities are highly suspicious that Iran has supported the attack.

Turkish President Recep Tayyip Erdogan recently said condemning the Shiite regime: «Iran is trying to chase [the Islamic State] from the region only to take its place». Turkish president also condemned Iran for aiding «terrorist groups» in taking over Yemen. The remarks that reportedly angered Iranian government officials who demanded an apology from Turkey. 

The two countries have also had major falling out in diplomatic relations due to the Syrian civil war. While Iran is strong supporter of the Assad regime Turkey fiercely opposes Assads grip on Syria. The countries also find themselves on opposite sides about the current conflict in Yemen.

Iran dedicated major resources towards expanding its cyber warfare capabilities over past few years.

Some speculated that Iran became one of the number one cyber threats such as China and Russia. Iran was once considered a D-grade cyber threat. Now its almost on the same level as Russia or China.

Iran also showed that it has the ability to breach the United States critical infrastructure network where Iran infiltrated U.S. water, gas, and transit systems while also successfully breaching airport security networks.

In February Irans Ayatollah Khamenei said in an address to his military cyber units: «You are the cyber war agents… get yourselves ready for such war wholeheartedly. »

Operation Cleaver: Mass Hacking By Iranian State

Iranian hackers have been identified as the source of coordinated attacks against more than 50 targets in 16 countries, many of them corporate and government entities that manage critical energy, transportation and medical services.

According to Cylance, a security firm based in California in USA, over the course of two years Iranian hackers managed to steal confidential data from a long list of targets and in some cases infiltrated victims computer networks to such an extent that they could take over, manipulate or easily destroy data on those machines.

Cylance called the attacks “Operation Cleaver” because the word cleaver appeared often in the attackers malicious code.

The hackers used a set of tools that can spy and even shut down critical control systems and computer networks, and aimed them at targets in the United States, Canada, Israel, India, Qatar, Kuwait, Mexico, Pakistan, Saudi Arabia, Turkey, the United Arab Emirates, Germany, France, England, China and South Korea. 

 

Victims of the attacks include: US Marine Corps, a major airline, a medical university, an energy company that specializes in natural gas production, a car manufacturer, a major military installation and a large military contractor. The Islamic Republic also concentrated attacks on oil and gas industries and universities in the United States, India, Israel and South Korea and managed to steal pictures, passports and specific identifying information for students and faculty. 

 

Cylance said it also collected worrying evidence of attacks on transport networks, including airlines and airports in South Korea, Saudi Arabia and Pakistan. Researchers said they found evidence that hackers gained complete remote access to airport gates and security control systems, “potentially allowing them to spoof gate credentials.”

See here for full report: http://www.cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf