CISA Warns of Iran’s Offensive Cyber Capabilities

Amid renewed tension between the U.S. and Iran, the Cybersecurity and Infrastructure Security Agency issued a warning to be vigilant for activity from Iranian hackers.

“Iranian cyber threat actors have been continuously improving their offensive cyber capabilities,” reads the alert released Thursday evening by the National Cyber Awareness System. “They continue to engage in more conventional offensive cyber activities ranging from website defacement, distributed denial of service attacks, and theft of personally identifiable information, to more advanced activities—including social media-driven influence operations, destructive malware, and, potentially, cyber-enabled kinetic attacks.”

CISA used almost the exact language to describe threats associated with Iran in January when it issued an alert following the U.S. assassination of General Qasem Soleimani, a prominent leader of the country’s military intelligence operations.

Thursday’s alert, in which CISA encouraged users and administrators to review previous advisories for information on Iranian advanced persistent threat actors’ tactics, techniques and procedures, comes in the wake of another high-profile assassination last week. Iran has attributed the killing of Mohsen Fakhrizadeh, its top nuclear scientist, to Israel, and the country’s foreign minister on Thursday implied the West is complicit for not condemning what he referred to as an act of terrorism.

“I believe this communication is meant more for the Iranian government than anything,” said Mike Hamilton, former vice chair of the Department of Homeland Security’s state, local, tribal and territorial government coordinating council, regarding the alert. “Because of the recent assassination, tensions are running high, and some retaliation is expected. A kinetic response is not possible but a cyber response is, and actors would work hard to avoid attribution. This is letting the Iranians know that our defenses are up, we know their TTPs and can identify them if they choose to act.”

CISA Warns of Iran’s Offensive Cyber Capabilities