US sanctions cyber actors backed by Iran’s Intelligence Ministry

The Iranian regime uses its Intelligence Ministry as a tool to target innocent civilians and companies, and advance its destabilising agenda around the world

US Treasury Secretary Steven Mnuchin

THE United States on Thursday sanctioned an Iranian hacking group with links to Iran’s Ministry of Intelligence for targeting hundreds of individuals and entities in 30 countries across Africa, Asia, Europe, and North America.

The sanctions will apply to the Iranian cyber threat group Advanced Persistent Threat 39 (APT39), 45 associated individuals and a front company, Rana Intelligence Company (Rana), the State Department confirmed in a statement.

The US claims that Iran’s government used APT39 and its associates as a front to carry out “a years-long malware campaign that targeted Iranian dissidents, journalists, and international companies in the travel sector.”

Cyber security firms tracking APT39 have said that the group’s focus is on the telecommunications and travel industries, suggesting it intends to conduct monitoring, tracking, or surveillance operations against specific individuals.

There is also evidence to suggest that the group is collecting information that could benefit the decisionmaking process of a nation-state, according to the cybersecurity group FireEye.

“The Iranian regime uses its Intelligence Ministry as a tool to target innocent civilians and companies, and advance its destabilising agenda around the world,” US Treasury Secretary Steven Mnuchin said in a statement.

“The United States is determined to counter offensive cyber campaigns designed to jeopardise security and inflict damage on the international travel sector,” he added.

The Trump administration, which is hawkish on Iran, has also pledged to revive all prior international sanctions on the country starting September 19 under a “snapback” mechanism included in the 2015 Iran deal.