Americans have long found comfort in the two oceans that separate us from Middle East wars, but the vulnerabilities Iranian cyber operations pose bring these conflicts much closer to home. Through cyber intrusion, Iran has already disrupted our water supply and healthcare sector while continuing to threaten our energy and telecommunications infrastructure. If we fail to force an end to Iran’s cyber warfare, collaborate with our partners to alert the public on Iranian threats, and help communities address key cybersecurity concerns, the Iranian state and cybercriminals may cause irreversible damage to American infrastructure.
Attempting to disrupt U.S. military operations and the American government, cybercriminals within the Islamic Revolutionary Guard Corps’ (IRGC) Cyber Economic Command and Iran’s Ministry of Intelligence (MOIS), such as Handala Hack Team and APT Iran, launched direct cyberattacks targeting American troops and officials. These attacks not only demonstrated Iran’s intent to harm the American warfighter, but also compromise our defense apparatus. Handala claimed responsibility for seizing the personal information of U.S. servicemembers stationed in the Middle East and hacking the U.S. Federal Bureau of Investigations Director’s email, while APT Iran claimed to steal details on the F-35 fighter jet from Lockheed Martin.
Iran has also carried out cyberattacks on critical infrastructure in the continental United States, demonstrating its reach and determination to harm noncombatants. Attacking infrastructure can quickly undermine our way of life, such as threatening our school safety, clean water, food access, and heating and cooling systems. In a horrifying incident in March, Handala likely launched the most significant wartime cyberattack against the United States, with hackers claiming to have wiped between 80,000-200,000 devices, prompting surgery delays at hospitals and panic amongst patients nationwide. Then, in July, several American towns issued water advisories after a coordinated cyberattack struck water facilities across the United States, with cybersecurity experts noting that the techniques mirror past Iranian hacking operations.
As Iran openly hacked U.S. infrastructure, the regime also launched cyberattacks on Israel and America’s Arab partners, pressuring them to curtail relations with the United States. While claiming responsibility for cyberattacks on military and critical infrastructure systems across the Middle East, including in Israel, Jordan, Kuwait, Bahrain, Saudi Arabia, and the United Arab Emirates (U.A.E.), Iranian forces also combined cyberoperations with kinetic strikes to maximize their damage. Handala has claimed to have hacked the facility and stolen around 430,000 classified documents.
While the Trump administration has recently expanded the U.S. government’s jurisdiction to combat foreign cybercriminals, Iranian cybergroups’ recent threats to our water, energy, and telecommunications sectors suggest they feel empowered to continue launching attacks.
As U.S. forces in the Middle East combat Iranian missiles and drone attacks on our troops and allies, the United States must counter the full range of Iranian aggression, including the regime’s use of cyberwarfare. Until we do that, Iran will continue to have a means of pressuring the United States and targeting Americans. Therefore, U.S. officials should publicly signal a firm position that Washington will only agree to end the war and will hinge any future deal with Iran if the regime halts cyberattacks on U.S. and partner infrastructure.
But linking a deal may not entirely stop Iran from finding loopholes to resume its malign operations. Therefore, the intelligence community and U.S. foreign partners should exchange common tactics, techniques, and procedures of Iranian cybercriminals and inform the public on these identifying features. By exposing Iran’s common hacking signatures, government’s can prepare their people to recognize and thwart Iran’s operations.
Meanwhile, the U.S. Cybersecurity and Critical Infrastructure Security Agency (CISA) should lead a nationwide hands-on cybersecurity educational initiative with state, local, and tribal governments, as well as major infrastructure stakeholders, such as telecommunications, water, and energy companies aimed at identifying zero-day vulnerabilities and providing them with the necessary tools and resources to fix them. Within this initiative, any organization CISA assesses to have a direct role in operating our critical infrastructure must meet a series of cybersecurity conditions CISA sets, and must undergo annual reviews ensuring full compliance with CISA safeguards.
Iran’s kinetic attacks and assault on the Strait of Hormuz aren’t the only actions causing international chaos. Iran’s cyber warfare has infiltrated the daily lives of American citizens and disrupted military operations overseas. It is essential that Washington treat any cyberattack targeting our military assets, civilians, and international partners like any other kinetic strike. Therefore, we must hold Iran accountable for its cyberattacks while actively collaborating with our foreign partners and rigorously bolstering our cyber defenses nationwide.
Edited 10/19
Lt Gen Michael Groen, USMC (ret.) was Director of the Joint Artificial Intelligence Center (JAIC) and was a participant in the Jewish Institute for National Security of America (JINSA) 2023 Generals and Admirals Program.
Sarah Havdala is a policy analyst at JINSA.
Read the original piece in RealClearDefense.