U.S. imposes sanctions on Iran's intelligence agency in response to a suspected Albanian government attack

The U.S. Treasury Department has announced sanctions against Iran's Ministry of Intelligence and Security (MOIS) and its Minister of Intelligence, following a series of malicious cyber activities targeting the U.S. and its allies globally.

The sanctions come in response to attacks traced back to July, when threat actors linked to Iran and the MOIS launched attacks against the computer systems of the Albanian government, a NATO ally. These attacks forced Albania to suspend online services for its citizens.

According to a report released by Mandiant Threat Intelligence last week, a group of advanced persistent threat actors, known as MuddyWater, have been operating as a unit within the MOIS. MuddyWater has been active in targeting upstream sources of intelligence, such as telecommunications firms and companies with potentially valuable personal identifiable information.

APT 42, previously known as UNC788, is another APT group attributed by Mandiant to the Iranian Revolutionary Guard Corps. APT 42 has engaged in harvesting credentials through spear phishing campaigns, surveillance, and deploying malware. The group has also been linked to targeting dissidents and organizations considered opponents of Iran globally.

Since at least 2007, Iran has been engaged in malicious cyber activity against government and private sector organisations, including critical infrastructure targets. MuddyWater has exploited publicly known vulnerabilities to deploy ransomware, target private organisations, and access sensitive data on computer systems.

The designation of the MOIS and its Minister of Intelligence comes at a time of heightened tension between Iran and the U.S. and its allies. In recent weeks, talks have intensified to renegotiate the Iran nuclear deal. President Joe Biden recently took military action against Iran-linked groups in Syria.

It's worth noting that APT 42 is unrelated to the Treasury activity currently sanctioned by U.S. authorities. This latest action by the U.S. Treasury Department is aimed at holding Iran accountable for its destabilising activities in the region, including its malicious cyber operations.

U.S. imposes sanctions on Iran's intelligence agency in response to a suspected Albanian government attack