The U.S. Treasury’s Office of Foreign Assets Control (OFAC) announced on Friday that it had imposed sanctions against Tehran’s Ministry of Intelligence and Security (MOIS) and Minister of Intelligence Esmail Khatib, following an Iranian cyberattack on Albania.
The attack in July disrupted state computer systems in Albania, forcing it to suspend online services and leaking supposed government documents and personal information of residents. In response, Albania severed diplomatic relations with Iran on September 7.
On Saturday, Albania accused Iran of carrying out yet another cyberattack, against computer systems used by its state police.
“Iran’s cyberattack against Albania disregards norms of responsible peacetime state behavior in cyberspace, which includes a norm on refraining from damaging critical infrastructure that provides services to the public,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian Nelson. “We will not tolerate Iran’s increasingly aggressive cyber activities targeting the United States or our allies and partners.”
U.S. Secretary of State Antony Blinken said in a press release, “Iran’s cyberattacks targeting civilian government services and critical infrastructure sectors can cause grave damage to these services and disregard norms of responsible peacetime state behavior in cyberspace. The United States will continue to use all appropriate tools to counter cyberattacks against the United States and our allies.”
The Intelligence Ministry and its proxies, which include subordinate groups known as MuddyWater and APT39, have since at least 2007 conducted malicious cyber operations targeting government and private-sector organizations throughout the world, and “across various critical infrastructure sectors,” according to the Treasury’s press release.
In November 2021, MuddyWater was believed to be involved in a cyber campaign against Turkish government entities. The organization allegedly delivered documents infected with malware through spear-phishing emails to gain access to the targeted computer systems.
