The attacks are believed to have affected thousands of computers at the Saudi civil aviation and transportation agencies, harkening back to a devastating Iranian cyberattack in 2012 that nearly crippled the Saudi state oil company, Aramco.
The Saudi Arabian Monetary Agency, the nation’s central bank, denied a Bloomberg report last week that it was hit, too.
Cybersecurity experts caution that they cannot say for sure that the attacks that began Nov. 17 are from Iranian hackers. But they note a series of similarities to the 2012 cyberattack and say Iranian hackers are especially active.
“Since the (U.S.) election especially, there’s been a pretty drastic increase in the amount of targeting of Saudi and Israeli institutions by hacking groups that we absolutely know are based out of Iran,” said Collin Anderson, an independent researcher currently writing a report on Iranian cyber warfare for the Carnegie Endowment for International Peace.
Anderson said “reasonable degrees of evidence” link the hacking to the Islamic Revolutionary Guard Corps, Iran’s most powerful security and military organization.
Cyber experts commonly refer to the malicious code infecting Saudi computers as Shamoon 2.0, a new version of the Shamoon malware that hit Aramco in 2012. The code is also known as disttrack.
“The infection capability doesn’t cause any particular hardware damage we know of but it does ‘brick’ your computer,” said George Avetisov, cofounder and chief executive of HYPR Biometric Security, a New York City firm that handles cybersecurity solutions for clients.
A “bricked” computer is one left completely useless, like a brick.
The malicious attack began at 8:45 p.m. on Thursday, Nov. 17, the start of the weekend in Saudi Arabia, where employees work Sunday to Thursday. That allowed the virus to spread for days before employees returned. It also marked the beginning of Lailat al Qadr (Night of Decree), an important Muslim holiday that is the holiest night of the year.
The Shamoon 2.0 malware wiped hard drives in infected computers clean and left an image of the lifeless body of a 3-year-old Syrian boy, Alan Kurdi, who was found on a Turkish beach 15 months ago and became a symbol of the European refugee crisis. The 2012 Shamoon attack left an image of a burning U.S. flag.
How many Saudi computers were destroyed in the recent attack is not known.
“Historically, Saudi Arabia has been very opaque about these sorts of attacks,” Anderson said.
Avetisov said the recent attacks were “not particularly stealthy” because the infection spread through a specific software driver, almost a calling card from Iranian hackers.
“As someone who scours the internet looking at false flags,” he said, referring to deceptive covert operations made to look like they were done by someone other than the real authors, “I can’t see a motive. What would you achieve with a false flag like this?”
He said attacks on key government agencies can be testing for further attacks.
“Usually you see attacks of a large scale as potentially a precursor for a much larger event. It remains to be seen if that’s the case here,” Avetisov said.
The Iranian hackers appeared to use email as bait to implant the malware.
“These are crimes of opportunity essentially,” Anderson said. “It’s really like these Iranian groups getting lucky based off of social engineering rather than, you know, highly technical operations conducted with zero day exploits.”
Anderson referred to a type of vulnerability that can give an attacker freedom within a host computer system to wreak havoc. Such vulnerabilities are usually detected by large teams of elite hackers working for governments.
The U.S.-Israeli cyber worm known as Stuxnet at the turn of the decade destroyed a great number of centrifuges Iran was using for its nuclear weapons program.
“Especially for Iran, there’s not really a lot of costs involved with these activities . . . not a lot of chance that anyone is going to get extradited,” Anderson said.
Iran Briefing | News Press Focus on Human Rights Violation by IRGC, Iran Human Rights
May 08, 2017 Comments Off on Iran tested high-speed torpedo in the Strait of Hormuz, US official says
Apr 24, 2017 Comments Off on Iran, Russia Boost Military Ties Amid U.S. Action in Syria
Apr 17, 2017 Comments Off on Saudi Arabia Warns Iran Is Trying To Turn Yemen Into A ‘Missile Base’
Apr 15, 2017 Comments Off on Rouhani: Iran does not need ‘permission to build missiles’
May 21, 2017 Comments Off on Student Imprisoned For Refusing to Collaborate With Iran’s Intelligence Ministry Denied Medical Care
May 17, 2017 Comments Off on Iran refuses hospital transfer for jailed human rights defender on hunger strike for 40 days
May 16, 2017 Comments Off on As election looms, democracy in Iran is but a mirage under theocracy
May 13, 2017 Comments Off on Intel Report: Iran Refining Nuke Delivery System in Flagrant Violation of Ban
May 10, 2017 Comments Off on IRAN SAYS U.S. AND ALLIES’ MILITARY MOVES IN SYRIA WILL FAIL, AS TROOPS SEEN TRAINING REBELSIRAN SAYS U.S. AND ALLIES’ MILITARY MOVES IN SYRIA WILL FAIL, AS TROOPS SEEN TRAINING REBELS Iranian Foreign Minister Mohammad Javid Zarif has warned the U.S. and its allies against pursuing military action...
May 04, 2017 Comments Off on Top two candidates in Iran election beholden to same masterTop two candidates in Iran election beholden to same master “Iran’s provocative actions threaten the United States, the region and the world,” Secretary of State Rex Tillerson warned in a major speech last...
Jul 14, 2016 Comments Off on Corps’ one hundred thousand of triggered missiles in Lebanon:An official Israel-threatening by CorpsIran Briefing: Since August 7, 1979, when Ayatollah Khomeini declared the last Friday of Ramadhan as “Quds Day”, the Islamic Republic has always tried to hold an imposing ceremony by using state resources as well as requiring people’s involvement. This year’s Quds march had fundamental...