Widening Middle Eastern war increases cyber risk | Computer Weekly

With the United States entering a widening Middle Eastern conflict following a series airstrikes of airstrikes against nuclear targets in Iran over the weekend, organisations across Europe and North America should be on high alert for the possibility of cyber attacks conducted by threat actors backed by or supportive of Iran.

Iranian threat actors have been highly engaged in attacking Israeli targets since the 7 October 2023 Hamas attacks, but in a series of warnings over the past 48 hours, government officials and cyber experts said that the likelihood of disruptive cyber attacks hitting US and allied targets, including in the UK, where the government has issued statements in support of president Trump’s airstrikes, has increased.

In a bulletin issued on Sunday 22 June via its National Terrorism Advisory System (NTAS), the US Department for Homeland Security said the ongoing Iran conflict was likely to cause an uptick in “low-level” cyber attacks against US networks by pro-Iranian hacktivists, while state-backed operators may also become increasingly active.

“Both hacktivists and Iranian government-affiliated actors routinely target poorly secured US networks and internet-connected devices for disruptive cyber attacks,” the alert said.

The alert also acknowledged that targets perceived to be Jewish, pro-Israel, or linked to the US government or military could be particularly at risk of cyber actions. The alert also warned of the possibility of attacks on critics of the Iranian regime.

“Iran already targets the US with cyber espionage which they use to directly and indirectly gather geopolitical insight and surveil persons of interest,” said John Hultquist, chief analyst at the Google Threat Intelligence Group.

“Persons and individuals associated with Iran policy are frequently targeted through organisational and personal accounts and should be on the lookout for social engineering schemes. Individuals are also targeted indirectly by Iranian cyber espionage against telecoms, airlines, hospitality, and other organisations who have data that can be used to identify and track persons of interest.”

Hultquist added: “Iran has had mixed results with disruptive cyber attacks and they frequently fabricate and exaggerate their effects in an effort to boost their psychological impact.

“We should be careful not to overestimate these incidents and inadvertently assist the actors. The impacts may still be very serious for individual enterprises, which can prepare by taking many of the same steps they would to prevent ransomware.”

James Turgal, vice president of global cyber risk and board relations at Optiv – who also spent over 20 years in law enforcement at the FBI – said the possibility of spillover from the conflict into civilian infrastructure was a definite concern.

“You can’t always control the third party or unintended consequences when malware and destructive code, such as wipers or ransomware, are used in offensive operations,” he explained.

“Because of the global interconnectedness of our software supply chain, these destructive attacks may propagate beyond intended targets, affecting global networks or multinational subsidiaries. For example, a cyber attack on a logistics company in Israel could unintentionally impact global shipping operations or foreign suppliers.

Turgal added: “As both sides leverage state-aligned hacker groups, non-state actors may adopt similar tools or feel emboldened to launch their own campaigns globally. This can increase attacks on soft targets like schools, hospitals or small businesses.”

Based on the use of cyber-focused and kinetic military operations seen during the Ukraine war, Turgal said that a similar scenario may now be in play in the Middle East, “with unimaginable unintended consequences” including attacks on Western critical infrastructure targets.