Written by Shannon Vavra
Jun 21, 2019 | CYBERSCOOP
Even as geopolitical tensions spike between Iran and the U.S. following an Iranian takedown of a U.S. drone, Iran-linked cyber-operations continue to focus on espionage and not destructive activities, a senior U.S. intelligence official says.
David Hogue, the technical director for the National Security Agency’s Threat Operations Center, tells CyberScoop Iranian-linked hacking groups are focused on traditional intelligence gathering.
“I think they’re trying to get more insights onto what U.S. policymakers are either knowledgeable of or think of them,” Hogue said in an interview with CyberScoop on Friday.
The past year has enflamed geopolitical tensions between Iran and the U.S. following the Trump administration’s withdrawal from the Iran nuclear deal. In April, the Trump administration took the unprecedented step of declaring a branch of Iran’s military to be a terrorist organization. Just last week, the administration blamed Tehran for attacks on two oil tankers in the Gulf of Oman. The Pentagon subsequently announced increased troop deployments to the region.
The attack against the unmanned, unarmed drone left the Pentagon poised to launch retaliatory strikes against three targets Thursday, although President Trump called off the strikes Thursday evening.
Hogue would not go so far as to use the names private cybersecurity firms have assigned several Iranian hacking groups, but indicated he is watching APT 33 and APT 34, which have commonly been associated with Iran.
By brute force
As an example of what the hacking groups are doing, Hogue said they have been trying to crack into military accounts through password spraying, a brute-force technique that continuously feeds passwords into login sites until one happens to work.
“Due to the commonality of shared passwords it can be successful if all of a sudden you get one,” Hogue said. “Detecting that is very hard because obviously people mistype their passwords all the time.”