LONDON, Dec 13, (Agencies): As US President Donald Trump reimposed harsh economic sanctions on Iran last month, hackers scrambled to break into personal emails of American officials tasked with enforcing them, The Associated Press has found – another sign of how deeply cyberespionage is embedded into the fabric of US-Iranian relations.
The AP drew on data gathered by the London-based cybersecurity group Certfa to track how a hacking group often nicknamed Charming Kitten spent the past month trying to break into the private emails of more than a dozen US Treasury officials. Also on the hackers’ hit list: high-profile defenders, detractors and enforcers of the nuclear deal struck between Washington and Tehran, as well as Arab atomic scientists, Iranian civil society figures and DC think-tank employees.
“Presumably, some of this is about figuring out what is going on with sanctions,” said Frederick Kagan, a scholar at the American Enterprise Institute who has written about Iranian cyberespionage and was among those targeted. Kagan said he was alarmed by the targeting of foreign nuclear experts. “This is a little more worrisome than I would have expected,” he said.
The hit list surfaced after Charming Kitten mistakenly left one of its servers open to the internet last month. Researchers at Certfa found the server and extracted a list of 77 Gmail and Yahoo addresses targeted by the hackers that they handed to the AP for further analysis. Although those addresses likely represent only a fraction of the hackers’ overall effort – and it’s not clear how many of the accounts were successfully compromised – they still provide considerable insight into Tehran’s espionage priorities. “The targets are very specific,” Certfa researcher Nariman Gharib said.
In a report published Thursday, Certfa tied the hackers to the Iranian government, a judgment drawn in part on operational blunders, including a couple of cases where the hackers appeared to have accidentally revealed that they were operating from computers inside Iran. The assessment was backed by others who have tracked Charming Kitten. Allison Wikoff, a researcher with Atlanta-based Secureworks, recognized some of the digital infrastructure in Certfa’s report and said the hackers’ past operations left little doubt they were governmentbacked. “It’s fairly clear-cut,” she said. Calls to Iranian officials were not returned late Wednesday, the beginning of the weekend in the country. Iran has previously denied responsibility for hacking operations, but an AP analysis of its targets suggests that Charming Kitten is working in close alignment with the Islamic Republic’s interests.
The most striking among them were the nuclear officials – a scientist working on a civilian nuclear project for the Pakistan’s Ministry of Defense, a senior operator at the Research and Training Reactor in the Jordanian city of Ramtha, and a high-ranking researcher at the Atomic Energy Commission of Syria. The trio suggested a general interest in nuclear technology and administration. Others on the hit list – such as Guy Roberts, the US Assistant Secretary of Defense for Nuclear, Chemical, and Biological Defense Programs – pointed to an eagerness to keep track of officials charged with overseeing America’s nuclear arsenal.
“This is something I’ve been worried about,” Roberts said when alerted to his presence on the list. Still more targets are connected to the Iran deal – a 2015 pact negotiated by former US president Barack Obama’s administration and other world powers that called for Tehran to curb its uranium enrichment in exchange for the lifting of international sanctions.
Trump tore up the deal in May over the objections of most of America’s allies and has re-imposed a series of punishing restrictions on Iran since. One of Charming Kitten’s targets was Andrew J. Grotto, whose tenure on the US National Security Council straddled the Obama and Trump administrations and who has written about Iran’s nuclear ambitions. Jarrett Blanc, a US State Department official involved in the implementation of the nuclear deal under Obama, was also on the list. He said news of his targeting was no shock.
“I’ve retained contact with Iranian counterparts since leaving government,” he said. “I’d be very surprised if there were not Iranian groups trying to hack into my various email accounts.” Like the Russian hackers who have chased after America’s drone, space and submarine secrets, the list indicates that Iranian spies were also interested in the world of US defense companies. One of those targeted is a senior director of “breakthrough technology” at the aerospace arm of Honeywell International Inc, the New Jersey-based industrial conglomerate; another is a vice-president at Virginia-based Science Applications International Corp, a prominent Pentagon contractor.