Tehran intensifies its effort to cause pain in the physical world with attacks on lightly-protected tankers and refrigerators
By Feliz Solomon
TEL AVIV -- Operators of small-town water stations locked out of control panels across the Midwest. Networks on two Texas-bound energy tankers breached as they crossed into the Atlantic Ocean. Hundreds of refrigerators in European grocery stores ratcheted up to a blistering 120 degrees Fahrenheit.
Three cyberattacks since this summer with real-world impacts and one main suspect: Iranian hackers.
Iran has long been viewed as a second-tier cyber threat, lacking the technological and strategic sophistication of China, Russia and North Korea. Now, as the U.S. war with Iran grinds on, Tehran is flexing a new level of aggression that has cybersecurity experts warning that the Islamic Republic has become a more dangerous foe.
Tehran is expanding its targets and making the jump to attacks that inflict real-world harm, according to cyber officials and defense experts. The shift shows both a stronger grasp on new tools like artificial intelligence and a willingness to use them against a wider range of targets.
"What Iran is doing right now is learning from the last war," Yossi Karadi, the head of the Israel National Cyber Directorate, told The Wall Street Journal. "I always assume that my enemy in the next war won't be the same as the last one. It will be a better one."
Since it began developing cyber capabilities in the early 2000s, Iran's primary target has been Israel, where it has carried out persistent attacks and tested out its techniques. Over the years, Iran broadened its targets to Gulf rivals like Saudi Arabia and the United Arab Emirates, while attacks in the U.S. took aim at Israeli-made devices.
Tehran turbocharged its cyber program after being on the receiving end of a computer worm called Stuxnet developed by the U.S. and Israel to infiltrate the control systems of Iran's nuclear centrifuges and command them to destroy themselves. The worm was discovered in 2010 and that attack is widely viewed as the first cyber operation to cause physical destruction.
With some exceptions -- such as Iran's 2012 Shamoon attack that wiped out tens of thousands of computers belonging to the Saudi oil giant Aramco -- Iranian cyberattacks were largely crude operations like influence campaigns. Iran-linked hacktivist teams were notorious for carrying out "hack and leak" attacks, swiping personal data and releasing it to undermine public figures and institutions. More recently, they have targeted internet-connected surveillance cameras.
In recent years, U.S. and Israeli officials say Iran has shifted focus to two tactics that can be used together to maximize real-world damage. The first is data wiping, which destroys files that computers need to operate. The second is hacking into programmable logic controllers, or PLCs, devices that are increasingly used to automate all sorts of industrialized actions from transportation to manufacturing and logistics.
These PLCs are embedded in operational technology systems, or OT, the connective tissue between virtual commands and physical objects. They are in traffic lights, sewage pumps and power grids -- woven throughout each country's critical infrastructure. Stuxnet was a PLC attack.
Nicholas Andersen, the acting head of the U.S. Cybersecurity and Infrastructure Security Agency, or CISA, told the Journal that these devices are an "element of our infrastructure that I think we see being threatened by Iranian threat actors in particular."
These types of attacks became more common a few years ago and are almost always carried out by a group called CyberAv3ngers, according to Sergey Shykevich, the director of threat intelligence at the Israeli cybersecurity firm Check Point. The group is also known as Shahid Kaveh, a unit of Iran's cyber command under which it operates.
In late 2023, CISA said CyberAv3ngers was behind an attack on Israeli-made Unitronics systems, used in U.S. water management. The agency issued an advisory earlier this year warning of more Iranian attacks, updated days before water systems were breached in at least seven states. In September, U.S. officials said they were investigating whether Iran was involved in cyberattacks on two Texas-bound tankers.
U.S. and French officials suspect the Iranian hackers were also behind the recent attacks in Europe, which hit cold-chain storage in France and elsewhere, sparking fires and spoiling food when temperatures were cranked up remotely overnight. Many of the targets were supermarkets in rural towns, which experts say can be easier to attack than cities.
"It's a good illustration for people just to be able to see what the impact could be on their day-to-day lives," Andersen said on the sidelines of the Cyber Week conference in Tel Aviv.
Iran, a repeated cyberattack target itself, has denied carrying out attacks abroad. Iran's ambassador to France, Mohammad Amin-Nejad, told the Journal that if Tehran had the capabilities it wouldn't use them against Europe, but would instead hit the U.S. or Israel, suggesting another country was to blame.
Each of the world's main cyber aggressors -- China, Russia, Iran and North Korea -- traditionally had its own signature style of attack. China tends to work covertly, geared toward espionage and pre-positioning inside critical systems to prepare for future conflicts. Russia typically aims to cause chaos and physical disruption, complementing kinetic warfare. North Korea uses cyberattacks to make money through theft and extortion.
"Iran is a very bizarre animal in this respect, because they just do whatever they can," said Shalev Hulio, the chief executive of Israeli cybersecurity firm Dream.
Those capabilities appear to be expanding. Hulio said that as AI models proliferated, Iran has been figuring out how to use them for bigger and faster attacks. Where it once used AI to enhance social engineering, he said Iran now uses it to scan code for zero-day vulnerabilities and reverse-engineer patches, which tells attackers where holes are before users can fix them.
"They're trying to position themselves as a global threat actor," he said.
Cybersecurity experts say Iran's capabilities still lag behind the pack, but its sheer willingness to cause havoc make it a force to be reckoned with.
"Now we have another country to worry about, another threat adversary," said Mark Montgomery, a retired rear admiral and expert on cyber threats at the Foundation for Defense of Democracies, a Washington think tank long critical of Iran.
"There's a level of consequence coming to cyberattacks now that we probably haven't seen in the past," he said. "A piece of malicious cyber code can have the same disruptive effect as an explosive device."
Shykevich, of Check Point, said Iran may be shifting its targets from Israel to the U.S. and Europe because the impacts are bigger there -- and the defenses weaker.
"They're definitely not at the level of Russia or China technologically," he said. "They are just more aggressive and blunt."