US sanctions Iran intelligence over Albania cyberattack

Personnel of the Embassy of the Islamic Republic of Iran leave the embassy, as Albania cuts ties with Iran and orders diplomats to leave over cyberattack, in Tirana, Albania, on September 8, 2022. (REUTERS)

• Albania, a NATO member, cut diplomatic ties with Iran and expelled its embassy staff this week over the cyberattack
• Since at least 2007, Iran's intelligence agency and its proxies have been accused of conducting cyber operations

WASHINGTON: The U.S. government on Friday imposed sanctions on Iran's intelligence agency and its leadership in response to malicious cyberattacks on Albanian government computer systems in July.
The Treasury Department's Office of Foreign Assets Control designated Iran’s Ministry of Intelligence and Security and Esmail Khatib, who heads the ministry, for what it said were cyber-related activities against the U.S. and its allies.
Albania, a NATO member, cut diplomatic ties with Iran and expelled its embassy staff this week over the cyberattack. It was the first known case of a country cutting diplomatic relations over a cyberattack.
The Albanian government has accused Iran of carrying out the July 15 attack, which temporarily shut down numerous Albanian government digital services and websites.
Microsoft, which assisted Albania in investigating the cyberattack, said in a blog post Thursday that it was moderately confident the hackers belong to a group that has been publicly linked to Iran’s Ministry of Intelligence and Security.
It said the attackers were observed operating out of Iran, used tools previously used by known Iranian attackers and had previously targeted “other sectors and countries” consistent with Iranian interests. The destructive malware deployed was also previously used by a “known Iranian actor,” it said.
“Iran’s cyber attack against Albania disregards norms of responsible peacetime State behavior in cyberspace,” Brian Nelson, Treasury's under secretary for terrorism and financial intelligence, said in a statement.
“We will not tolerate Iran’s increasingly aggressive cyber activities targeting the United States or our allies and partners," he said.
Since at least 2007, Iran's intelligence agency and its proxies have been accused of conducting cyber operations targeting public and private entities around the world.
Treasury, which uses an Obama-era executive order that targets people and entities that engage in malicious cyber activities as an authority to impose the sanctions, has been ratcheting up its financial penalties on Iran this year.
This comes as President Joe Biden’s administration has been working to renew the tattered Iran nuclear deal, which placed curbs on Iran’s nuclear program in exchange for billions of dollars in sanctions relief, which Iran insists it has never received.