Expect the U.S.-Iran Conflict to Continue to Play Out in Cyberspace

Now that Iran appears to have ended its retaliation for the deadly strike against Islamic Revolutionary Guard Corps Quds Force commander Major General Qassem Soleimani, Americans might be breathing a sigh of relief. Indeed, President Trump indicated Wednesday that he would seek to avoid further kinetic strikes on Iranian targets. This is a good thing, but Americans should expect this conflict to continue to play out in cyberspace within our nation.

Iran is one of the world’s top cyber adversaries, with sophisticated nation-state capabilities and contractors at the state’s disposal. Iran was behind the deployment of destructive wiper malware Shamoon that targeted Saudi Aramco oil refineries in 2012, destroying its systems within days. It was also responsible for the attack that cost the Sands Las Vegas Corporation (owned by Sheldon Adelson, a prominent supporter of Israel) over $40 million in 2014. In 2013, Iran attempted a cyber operation against the Bowman Dam in upstate New York. And the SamSam Ransomware, which targeted several cities, universities, transport hubs, and hospitals for three years and caused $30 million in damage, was attributed to two Iranian citizens operating within their country. In 2019 analysts at the top cybersecurity firms were worried about a group associated with the IRGC planning a cyber operation targeting the United States, possibly laying the groundwork for something destructive. Their fears were based on observations of a new campaign of phishing emails aimed at federal agency and private company employees. These are the operations that we do know about.