The reckless hackers worse than hostile cyber states – and their targets

Iranian hackers are expanding operations against the UK and allies to include soft civilian targets such as food, water and medicine, security experts believe, following a wave of attacks across Europe. This week, France accused Tehran of responsibility for cyber attacks of “unprecedented scale and aggression” on supermarket fridges last month, which destroyed thousands of tonnes of food, and also affected blood banks. Seven European countries were hit by a similar attack last week that caused losses at hundreds of stores. Europe’s top cybersecurity official warned this week that Iranian operations could target internet-connected devices in private citizens’ homes next. “Today it was fridges, tomorrow it could be routers, the day after tomorrow it could be home appliances,” said Juhan Lepassaar, executive director of EU cybersecurity agency ENISA. The British government has described Iran as a leading source of cyber attacks, and noted that the threat has increased since the US and Israel launched a war against the country in February. Iran has said the UK is a “legitimate target” after allowing the US to use British air bases for bombing raids. The Islamic Republic is suspected of carrying out an attack in August that shut down a UK power plant for four days in the first case of its kind. Hackers are now seeking out softer targets Recent attacks suggest a change in approach as hackers go beyond critical infrastructure to seek out softer targets, experts believe. Dr Andreas Krieg, a Middle East specialist at the School of Security Studies, King’s College London, said: “What concerns me most is the choice of targets. We tend to think about cyber warfare in terms of attacks on national electricity grids or government computer systems. Iran is demonstrating that much softer civilian infrastructure can be equally attractive.“Supermarket refrigeration, local electricity generators, water treatment, food distribution, ports, hospitals, pharmaceutical storage and logistics networks all offer opportunities for disruption.” Boxes of perished goods are seen outside an Intermarche supermarket in Paris the day after a cyberattack targeted refrigeration systems at French supermarket chains (Photo: Lucien Libert/ Reuters) Many of these have already been targeted in recent Iran-linked operations against Europe and the US – with one recent case affecting supplies of defibrillators to the NHS – and typically have security systems that can be easily overwhelmed. “Many industrial control systems were designed to operate machinery, not withstand hostile intelligence services,” said Krieg. “Tehran can exploit fairly basic weaknesses to achieve effects that once required physical sabotage.” Krieg believes Iran could wreak similar havoc on the UK food supply, as was caused by the supermarket attack in France. “All it takes is for someone to identify and use a backdoor that is not properly closed,” he said. Cybersecurity experts suggest the supermarket attacks could be a model for low-cost, high-impact disruption targeting allies of the US and Israel. Graeme Stewart, director of public sector sales at Check Point, a global cybersecurity company, told The i Paper: “This is effectively the Iranians signalling: ‘We’re not happy with your behaviour. Look at what we can do.’ It’s a shot across the bows.” Soft civilian targets such as food suppliers are low-hanging fruit compared with better-protected critical infrastructure such as nuclear power plants, he notes, and carry less of a risk of triggering escalation. Home appliances such as internet-connected doorbells and routers could be vulnerable, he added, although such small-scale targets would probably be delegated to Iran-affiliated “hacktivists” rather than the state itself. Attacks on such targets could serve a purpose of psychological warfare. The French supermarket hack was enabled by poor security, said Stewart. But internet-connected Operational Technology (OT) software in the UK, which controls thousands of systems from traffic lights to ventilation systems, could be equally vulnerable. “The cybersecurity around OT has been completely neglected,” he said. Hackers also have a new weapon in AI, which allows them to search for vulnerabilities 1,000 times faster than a human could, said Stewart. Britain’s National Cyber Security Centre declined to comment on what targets could be under threat. NHS defibrilliator supplies were affected by a recent Iran-linked cyber attack (Photo: Getty) Why hacktivists may be more dangerous than the state Some independent criminal hacking groups could pose a greater danger than the state itself. Iran has rapidly developed its cyber warfare capabilities in recent years, with an ecosystem of state agencies, aligned groups, and freelance operatives. “The Islamic Revolutionary Guards Corps [IRGC, Iran’s elite military structure] maintains dedicated offensive units, but Iran also benefits from contractors, criminal hackers and nominally independent hacktivist identities such as CyberAv3ngers and Handala. Some are closely associated with state structures, while others operate more opportunistically,” said Krieg. CyberAv3ngers is associated with the IRGC unit France has accused of being responsible for the supermarket hacks, and is also believed to be behind a spate of attacks on infrastructure in the US, Israel and Europe. Babak Taghvaee, an author and expert on the Iranian military, suggests such groups could be even more dangerous than direct actors for the state. “Sometimes, these hacker groups or companies want to show off their power by carrying out these kinds of attacks [like the French supermarkets] to draw the attention of the regime, secure huge amounts of funding, or get projects to carry out cyber attacks against the regime’s adversaries… Once they become famous and make a name for themselves, they are given larger contracts to carry out more severe attacks.” He suggested that these groups were unlikely to mind if such attacks had fatal consequences. “If necessary, they are even willing to carry out attacks against water desalination plants or water purification plants and kill civilians, as they do not care about people’s safety and wellbeing,” he said. Ken Katzman, a former CIA agent and Iran expert, now at the Soufan Center think-tank, suggested that Iran’s campaign was intended to deter European countries from involvement in the US-Israeli war, which Donald Trump signalled on Monday he does not intend to resume. But Katzman said a strategy that involved targeting civilians could backfire. “They want to make sure Europe stays out,” he said. “But it’s a big risk for Iran to start getting European citizens animated against them. They would want their governments to respond.”