U.S. Treasury Sanctions Iranian Hackers for Attacks on American Orgs

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) announced sanctions against two Iranian companies and four individuals accused of engaging in cyberattacks on behalf of the Iranian Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC).

These cyber operations targeted a range of U.S. companies and government agencies, utilizing tactics such as spear phishing and malware to infiltrate and disrupt operations.

The sanctioned entities and individuals have been implicated in a comprehensive cyber espionage campaign aimed at destabilizing U.S. critical infrastructure and compromising sensitive information.

The U.S. Department of Justice, in coordination with the Federal Bureau of Investigation, has also unsealed indictments against the four individuals, reflecting the severity and coordinated nature of the cyber threats.

Brian E. Nelson, Under Secretary of the Treasury for Terrorism and Financial Intelligence, emphasized the persistent threat posed by these actors, stating, “Iranian malicious cyber actors continue to target U.S. companies and government entities in a coordinated, multi-pronged campaign intended to destabilize our critical infrastructure and cause harm to our citizens.” He reaffirmed the commitment of the United States to a “whole-of-government approach” to counter these threats.

The primary company involved, Mehrsam Andisheh Saz Nik (MASN), formerly known as Mahak Rayan Afzar, has been directly linked to the IRGC-CEC and various Iranian advanced persistent threat (APT) groups, such as Tortoiseshell. This company, along with Dadeh Afzar Arman (DAA), another front company, played a crucial role in the orchestration of these cyberattacks.

Individuals named in the sanctions include Alireza Shafie Nasab, Reza Kazemifar Rahman, Hosein Mohammad Haruni, and Komeil Baradaran Salmani, all of whom have held significant roles in these malicious activities. Their actions range from developing and testing malware aimed at U.S. job seekers, particularly military veterans, to conducting widespread spear-phishing campaigns targeting multiple U.S. entities, including the Department of the Treasury.

Up to $10 Million Reward & Possible Relocation

These individuals conducted malicious cyber ops against U.S. firms and government agencies on behalf of Iran's IRGC.

If you have info on them, contact us. Your tip could be worth millions of $ and a plane ticket to somewhere new. pic.twitter.com/EjOGLXDeJl

— Rewards for Justice (@RFJ_USA) April 23, 2024

Impact of sanctions

As a result of these sanctions, all property and interests in property of the designated persons that are in the United States or under the control of U.S. persons are blocked and must be reported to OFAC. These measures are part of a broader strategy to prevent these individuals and companies from accessing the international financial system and to deter further malicious activities.

The sanctions are issued under the counterterrorism authority of Executive Order (E.O.) 13224, as amended, highlighting the U.S. government's determination to treat cyberattacks as a significant national security threat akin to terrorism.

For U.S. companies and government agencies, it is vital to enhance cybersecurity measures, particularly against common vectors like spear phishing. Organizations should invest in comprehensive employee training to recognize and respond to cybersecurity threats, implement robust incident response strategies, and regularly update their cybersecurity frameworks to defend against evolving threats.

For more information on how to navigate and comply with OFAC regulations, entities should consult the Treasury's guidance and FAQs related to sanctions and cybersecurity threats.