Accessibility links

Breaking News

Iran-Backed Cybergroup Accused Of Targeting Critical U.S. Sectors


Advanced persistent threat (APT) is a designation often given to state-backed hackers.
Advanced persistent threat (APT) is a designation often given to state-backed hackers.

U.S., British, and Australian authorities say a hacker group "associated" with the Iranian government is behind cyberattacks on targets in the United States and Australia, including in the health-care and transportation sectors.

"The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the transportation sector and the health-care and public-health sector, as well as Australian organizations," according a joint advisory issued on November 17.

Advanced persistent threat (APT) is a designation often given to state-backed hackers.

Since at least March 2021, the group has exploited vulnerabilities in Microsoft Exchange and Fortinet software to break into computer networks, including those of a U.S. municipal government and a children's hospital in the United States, the advisory said.

The group leveraged the initial hack for additional operations such as data theft, ransomware, and extortion.

The advisory did not identify any specific targets for the hackers, or say how successful they have been.

Microsoft said in a blog post that it had observed "six Iranian threat groups" deploying ransomware since September 2020 "in waves every six to eight weeks on average."

"As Iranian operators have adapted both their strategic goals and tradecraft, over time they have evolved into more competent threat actors capable of conducting a full spectrum of operations," it said.

Iranian officials did not immediately comment on the accusations.

In July, Facebook said it had disrupted a group of hackers in Iran behind "espionage operations" targeting mostly U.S. military personnel and companies in the defense and aerospace industries.

  • 16x9 Image

    RFE/RL

    RFE/RL journalists report the news in 27 languages in 23 countries where a free press is banned by the government or not fully established. We provide what many people cannot get locally: uncensored news, responsible discussion, and open debate.

RFE/RL has been declared an "undesirable organization" by the Russian government.

If you are in Russia or the Russia-controlled parts of Ukraine and hold a Russian passport or are a stateless person residing permanently in Russia or the Russia-controlled parts of Ukraine, please note that you could face fines or imprisonment for sharing, liking, commenting on, or saving our content, or for contacting us.

To find out more, click here.

XS
SM
MD
LG