It was only a few weeks ago that I was writing about a CISA alert warning about the dangers of Iranian-government-sponsored hackers exploiting Log4J vulnerabilities to strike at varied targets across the globe. I argued that Iran’s actions illustrate what the future of cyber warfare will look like as countries increasingly strike at digital rather than physical targets to exert their influence. Hammering home that point, CISA has already issued another alert cautioning against an entirely different kind of attack perpetrated by Iranian hackers.
With this latest action, Iran has shown both a willingness to use cyber attacks to achieve their geopolitical ambitions, along with ingenuity in their methods. Of course, most countries are jockeying with each other in cyberspace, and labeling any of their motivations as “good” or “bad” probably misunderstands the pugilistic nature of international relations. Other countries are doing what Iran does – and putting even more resources behind the effort. But even with those caveats, it’s hard not to see Iran as a country both willing and able to play the role of cyber supervillain – someone who makes digital space more dangerous for everyone.
To help put that claim in a greater context, let’s take a look at the latest attack.
Attack Autopsy
Starting around May 2021, Iranian state cyber actors calling themselves “Homeland Justice” (with nationalistic flair) infiltrated the network of the Albanian government. They hid inside for the next year, maintaining continuous network access while quietly accessing and exfiltrating email content. The attackers conducted lateral movements, ran network reconnaissance, and began credential harvesting beginning in May 2022. And by the middle of that summer, they had everything they needed to launch a devastating ransomware attack. The Albanian government never stood a chance.
Ransomware was launched on their networks in July 2022, accompanied by a threatening message directed at a group critical of Iran’s Revolutionary Guard with several thousand members living in Albania. While simultaneously stealing and encrypting the data with one attack, the offenders were also wiping raw disk drives using a separate attack in a strategy orchestrated to inflict maximum damage almost immediately. Numerous government digital services and websites were temporarily knocked offline. Unfortunately, that was just the start.
Homeland Justice then created a website and social media profiles taking credit for the attacks and publishing proof. Their goal was not just to gloat. They also release the data, first posting a poll to ask what data people wanted, then releasing videos and zip files with the leading responses. So not only was the Iranian government stealing another country’s data – they were offering it up for anyone else to exploit for whatever purposes they wanted. Twisting the knife even more, Homeland Justice struck the Albanian government again in September 2022 with a similar barrage of ransomware attacks.
Understandably enraged, the Albanian government formally cut diplomatic ties with Iran – the first such response to a cyber attack. The Albanian Foreign Minister Olta Xhacka commented, “The aggressiveness of the attack, the level of attack, and moreover the fact that it was a fully unprovoked attack left no space for any other decision.”
Implications of the Attack
The technical details of the attack – plus the prevention CISA suggests – are worth a closer look, especially since Iran has been willing to attack almost any target anywhere. But in this instance, the mechanics of the attack are less interesting than the motivations behind it and the implications for future attacks.
Iran sponsored this attack ostensibly in response to the anti-government sentiment gaining traction in parts of the population. Cracking down on dissent is nothing new for governments. But doing so by launching a multi-month cyber attack on a small, distant country, bragging about it online, then offering to share the spoils has no historical precedent that I can think of. What effect this will have on the ongoing protest movement in Iran remains to be seen. No matter the outcome, though, Iran has pioneered a new way for states to undermine activist movements, and many will not hesitate to deploy similar tactics to maintain their hold on power.
I’m also struck by how this attack weaves together different tactics and techniques, combining a lengthy infiltration effort with a shock-and-awe ransomware attack followed by online data leaks and a surprise second punch. It’s devious. It’s also a little bizarre in its determination. I’m sure an Iran expert could give some important context into why Iran hit Albania so hard. But when they felt compelled to do so, they had both the means and the certainty of success – how many attacks between nation-states can say the same thing?
What will Iran do next? Even if you don’t agree with my “cyber supervillain” characterization, it’s a question everyone’s wondering. And given recent events, they should probably be worrying about it too.
#iran #cyberattack
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.
Tom Okman, Co-founder of Nord Security
Since the establishment of Nord Security and until this year, we have operated without external funding – and we have learned many lessons. Last week, I had the great honor of presenting our main takeaways from this bootstrapping journey on the stage of Web Summit. Here are the four main insights that I shared for founders focused on bootstrapping their business:
#1 Perfect your company’s mission
Your company’s mission is not just a catchy slogan you place on your “About” page and then forget about it. Your mission is the underlying DNA of every meeting and every creative solution, and it works in the background every time your people decline offers from other companies.
When you raise funding, it’s easy to lose sight of why you started your company in the first place. But when you are bootstrapping, your mission and your customers guide your business path. So bootstrapping founders, instead of focusing on raising the next round of funding, look for innovative ways to turn their mission into a reality. They are also more receptive to what customers are saying to them. That feedback naturally helps polish and evolve your mission over time, which in turn helps improve your corporate and product strategies. And it comes with a bonus – the company develops a solid internal culture.
#2 Build local, ship global
Some entrepreneurs are wary of using local talent pools, especially if the business is starting outside established startup hubs like Silicon Valley or Israel. However, that was not the case in our story. In fact, we were fortunate to start our company in Lithuania. While funding was scarce when we started, the local ecosystem, partners, and infrastructure helped us immensely in getting our business off the ground. People in Lithuania are talented and keen to prove themselves to their international peers. So one of our best decisions early in the business was to tap into that talent pool and support from local associations and policymakers.
Today, more than ever, talent and support for entrepreneurs are spread throughout Europe, both in traditional tech hubs and rising startup center’s. As a result, the startup world is getting flatter, so now is the best time to take advantage of building locally while shipping globally.
#3 Focus on the customer
Customers are royalty, especially when entrepreneurs operate without external funding. In such cases, customers become leading investors and the most sustainable source of financing, and startups must focus on them above all else. So to be successful, entrepreneurs have to build a product that their customers will love and want to pay for, meaning that creating a market fit for products becomes central to a startup’s survival. Unfortunately, you don’t have a large treasure chest on your side when you are bootstrapped, so the key is to be efficient in adapting to your customer’s feedback.
#4 Take risks and be nimble
The bootstrapping route empowers entrepreneurs to take charge of the big decisions when it comes to vision, hiring, operations, or finances. That gives self-funded startups an edge because they can be much more flexible, agile, and tenacious than other companies. But at the same time, not taking outside financing pushes entrepreneurs to be hungrier in finding ways to improve their business. Because knowing that customers are critical, you can’t simply spend your way out of problems. In Nord Security’s case, it usually meant taking risks and being the pioneer in educating the market and customers about a new use case, product feature, or upcoming challenges.
While such a situation might sound precarious, in a way, it also means returning to what makes startup culture great – the ability and willingness to be inventive and take risks. But it is essential to be decisive when things need to be fixed and be bold in pivoting because inertia can sometimes be more dangerous than recklessness. This combination can prove extremely potent if entrepreneurs allow themselves to be guided by their leading investors – the customers – and their mission-driven culture. But only if founders are willing to lean into it fully. 
