WASHINGTON: The Justice Department said Wednesday that three Iranian citizens have been charged in the United States with ransomware attacks that targeted power companies, local governments and small businesses and nonprofits, including a domestic violence shelter.
The charges accuse the hacking suspects of targeting hundreds of entities in the US and around the world, including inside Britain, Australia, Iran, Russia and the US, encrypting and stealing data from victim networks, and threatening to release it publicly or leave it encrypted unless exorbitant ransom payments were made. In some cases, the victims made those payments, the department said.
But a separate US Treasury announcement of sanctions said the three were part of a larger hacking group tied to Iran’s powerful Islamic Revolutionary Guard Corps (IRGC), and the US State Department has offered a $10 million reward for information on them.
The indictment identified the three as Mansour Ahmadi, Ahmad Khatibi Aghda, and Amir Hossein Nikaeen Ravari.
It said that between October 2020 and August 2022, the men used known vulnerabilities in computer systems to attack multiple targets in the United States, stealing their data and demanding up to hundreds of thousands of dollars to have it returned.
Those included local governments, a shelter for victims of domestic violence, a children’s hospital in Boston, accounting firms and electricity generating companies.
The victims were not methodically chosen but were “targets of opportunity” whose computer systems were vulnerable to hacking, officials said.
“The indictment does not allege that these actors undertook these actions on behalf of the Government of Iran,” a senior Justice Department official told reporters.
The three “engaged in a pattern of hacking, cyber-theft, and extortion largely for personal gain,” FBI Director Chris Wray said in a separate statement.
But a concurrent announcement by the US Treasury said the three were part of a group of 10 Iranian hackers targeted with sanctions that was backed by the Revolutionary Guards.
“This IRGC-affiliated group is known to exploit software vulnerabilities in order to carry out their ransomware activities, as well as engage in unauthorized computer access, data exfiltration, and other malicious cyber activities,” the Treasury said.
Their actions align with those of known Iranian cyberattack operations which private cybersecurity groups have dubbed “APT35,” “Charming Kitten” and “Phosphorous,” Treasury added.
The Biden administration has tried to go after hackers who have held US targets essentially hostage, often sanctioned or sheltered by adversaries. The threat gained particular prominence in May 2021 when a Russia-based hacker group was accused of conducting a ransomware attack on Georgia-based Colonial Pipeline, which disrupted gas supplies along the East Coast.
Iran-based hackers have also been a focus over the last year, with the FBI last year thwarting a planned cyberattack on a children’s hospital in Boston that was to have been carried out by hackers sponsored by the Iranian government.
“The cyber threat facing our nation is growing more dangerous and complex every day,” FBI Director Christopher Wray said in a statement accompanying the indictment unsealed Wednesday. “Today’s announcement makes clear the threat is both local and global. It’s one we can’t ignore and it’s one we can’t fight on our own, either.”
the Treasury Department’s Office of Foreign Assets Control sanctioned 10 individuals and two entities affiliated with Iran’s Islamic Revolutionary Guard Corps who it says have been involved in malicious cyber activities, including ransomware. The Treasury Department identified the three defendants in the Justice Department case as employees of a technology firm it says is affiliated with the Revolutionary Guard.
John Hultquist, vice president for threat intelligence at the cybersecurity firm Mandiant, said his team has been tracking the Iranian actors for some time and assessed they are contractors for the Revolutionary Guard who have been moonlighting as criminal hackers.
The actions come amid an apparent stalemate in talks between the US and Iran over the possible revival of a 2015 nuclear deal. Israel and some US lawmakers of both parties are pushing the Biden administration to get tougher on Iran, calling the negotiations on Iran’s nuclear program a failure.
The three accused hackers are thought to be in Iran and have not been arrested, but the Justice Department official said the pending charges make it “functionally impossible” for them to leave the country.
(With AFP and AP)
3 Iranian citizens charged in broad hacking campaign in US
https://arab.news/6cucw
3 Iranian citizens charged in broad hacking campaign in US
- Mansour Ahmadi, Ahmad Khatibi and Amir Hossein Nikaein are citizens of Iran who own or are employed by private technology companies in the country
- Treasury Department also sanctioned 10 individuals and two entities affiliated with Iran’s Islamic Revolutionary Guard
Kingdom sends aircraft loaded with food, medical supplies to Lebanon
- Saudi aid agency KSrelief has transported hundreds of tonnes of aid to region since October
RIYADH: Saudi Arabia sent its 24th relief plane to Lebanon on Tuesday with humanitarian supplies including food and medical aid.
The conflict between Israel and Iran-backed Hezbollah has intensified of late, forcing thousands of Lebanese to flee their villages and neighborhoods while under fire in southern Lebanon and the country’s capital, Beirut.
Arab nations like Saudi Arabia and the UAE have sent aid supplies to Lebanon to help those displaced.
The aid plane flying the latest mission took off from King Khalid International Airport near Riyadh and headed to Rafic Hariri International Airport in Beirut, the Saudi Press Agency reported.
A statement from the Saudi aid agency KSrelief said the aid deliveries showed that the Kingdom was “standing with needy and affected countries … in the face of crises and difficulties.”
KSrelief launched an initiative in October to transport hundreds of tonnes of medical supplies and food aid to Lebanon.
Childhood cancer patients in Lebanon must battle disease while under fire
- More than war, parents fear that their children will miss life saving chemotherapy treatment
- Among the tens of thousands fleeing their homes among them are families with children battling cancer
BEIRUT: Carol Zeghayer gripped her IV as she hurried down the brightly lit hallway of Beirut’s children’s cancer center. The 9-year-old’s face brightened when she spotted her playmates from the oncology ward.
Diagnosed with cancer just months before the conflict between Hezbollah and Israel erupted in October 2023, Carol relies on weekly trips to the center in the Lebanese capital for treatment.
But what used to be a 90-minute drive, now takes up to three hours on a mountainous road to skirt the heavy bombardment in south Lebanon, but still not without danger from Israeli airstrikes. The family is just one among many across Lebanon now grappling with the hardships of both illness and war.
“She’s just a child. When they strike, she asks me, ‘Mama, was that far?’” said her mother, Sindus Hamra.
The family lives in Hasbaya, a province in southeastern Lebanon where the rumble of Israeli airstrikes has become part of daily life. Just 15 minutes away from their home, in the front-line town of Khiam, Israeli troops and Hezbollah fighters clash amidst relentless bombardments.
On the morning of a recent trip to Beirut for her treatment, the family heard a rocket roar and its deafening impact as they left their home. Israeli airstrikes have also hit vehicles along the Damascus-Beirut highway, which Carol and her mother have to cross.
The bombardment hasn’t let up even as hopes grew in recent days that a ceasefire might soon be agreed.
More than war, Hamra fears that Carol will miss chemotherapy.
“Her situation is very tricky — her cancer can spread to her head,” Hamra said, her eyes filling with tears. Her daughter, diagnosed first with cancer of the lymph nodes and later leukemia, has completed a third of her treatment, with many months still ahead.
While Carol’s family remains in their home, many in Lebanon have been displaced by an intensified Israeli bombardment that began in late September. Tens of thousands fled their homes in southern and eastern Lebanon, as well as Beirut’s southern suburbs — among them were families with children battling cancer.
The Children’s Cancer Center of Lebanon quickly identified each patient’s location to ensure treatments remained uninterrupted, sometimes facilitating them at hospitals closer to the families’ new locations, said Zeina El Chami, the center’s fundraising and events executive.
During the first days of the escalation, the center admitted some patients for emergency care and kept them there as it was unsafe to send them home, said Dolly Noun, a pediatric hematologist and oncologist.
“They had no place to go,” she added. “We’ve had patients getting admitted for panic attacks. It has not been easy.”
The war has not only deepened the struggles of young patients.
“Many physicians have had to relocate,” Noun said. “I know physicians, who work here, who haven’t seen their parents in like six weeks because the roads are very dangerous.”
Since 2019, Lebanon has been battered by cascading crises — economic collapse, the devastating Beirut port explosion in 2020, and now a relentless war — leaving institutions like the cancer center struggling to secure the funds needed to save lives.
“Cancer waits for no one,” Chami said. The crises have affected the center’s ability to hold fundraising events in recent years, leaving it in urgent need of donations, she added.
The facility is currently treating more than 400 patients aged from few days to 18 years old, Chami said. It treats around 60 percent of children with cancer in Lebanon.
For Carol, the war is sometimes a topic of conversation with her friends at the cancer center. Her mother hears her recount hearing the booms and how the house shook.
For others, the moments with their friends in the center’s playroom provide a brief escape from the grim reality outside.
Eight-year-old Mohammad Mousawi darts around the playroom, giggling as he hides objects and books for his playmate to find. Too absorbed by the game, he barely answers questions, before the nurse calls him for his weekly chemotherapy treatment.
His family lived in Ghobeiry, a neighborhood in Beirut’s southern suburbs. Their house was marked for destruction in an Israeli evacuation warning weeks ago, his mother said.
“But till now, they haven’t struck it,” said his mother, Suzan Mousawi. “They have hit (buildings) around it — two behind it and two in front of it.”
The family has relocated three times. They first moved to the mountains, but the bitter cold weakened Mohammad’s already fragile immune system.
Now they’ve settled in Ain el-Rummaneh, not far from their home in the southern Beirut suburbs known as Dahiyeh, which has come under significant bombardment. As the Israeli military widened the radius of its bombardment, some buildings hit were less than 500 meters (yards) from their current home.
The Mousawis have lived their entire lives in Dahiyeh, Suzan Mousawi said, until the war uprooted them. Her parents’ home was bombed. “All our memories are gone,” she said.
Mohammad has 15 weeks of treatment left, and his family is praying it will be successful. But the war has stolen some of their dreams.
“When Mohammad fell ill, we bought a house,” she said. “It wasn’t big, but it was something. I bought him an electric scooter and set up a pool, telling myself we’d take him there once he finishes treatment.”
She fears the house, bought with every penny she had saved, could be lost at any moment.
For some families, this kind of conflict is not new. Asinat Al Lahham, a 9-year-old patient of the cancer center, is a refugee whose family fled Syria.
“We escaped one war to another,” Asinat’s mother, Fatima, added.
As her father, Aouni, drove home from her chemotherapy treatment weeks ago, an airstrike happened. He cranked up the music in the car, trying to drown out the deafening sound of the attack.
Asinat sat in the back seat, clutching her favorite toy. “I wanted to distract her, to make her hear less of it,” he said.
In the medical ward on a recent day, Asinat sat in a chair hooked to an IV drip, negotiating with her doctor. “Just two or three small pinches,” she pleaded, asking for flavoring for her instant noodles that she is not supposed to have.
“I don’t feel safe … nowhere is safe … not Lebanon, not Syria, not Palestine,” Asinat said. “The sonic booms are scary, but the noodles make it better,” she added with a mischievous grin.
The family has no choice but to stay in Lebanon. Returning to Syria, where their home is gone, would mean giving up Asinat’s treatment.
“We can’t leave here,” her mother said. “This war, her illness … it’s like there’s no escape.”
Why has Israel increased its attacks on Syria?
- The Syrian Observatory for Human Rights war monitor has recorded at least 86 Israeli attacks, with 199 Iran-backed fighters, Syrian soldiers and 39 civilians killed
- Observatory head Rami Abdel Rahman said Israel has mainly hit border crossings, Damascus apartments, and the positions of Iran-backed groups
BEIRUT: Last week Israel launched its deadliest strikes on Iran-backed groups in Syria, killing more than 100 fighters in the latest escalation since two months of full-blown Israel-Hezbollah war spilled over.
What are the reasons for this escalation, and what exactly is Israel targeting in Lebanon’s neighbor Syria?
Israel intensified its strikes against Syria from September 26, days after launching an intense bombing campaign mainly targeting Hezbollah strongholds in Lebanon.
Since then, the Syrian Observatory for Human Rights war monitor has recorded at least 86 Israeli attacks, with 199 Iran-backed fighters, Syrian soldiers and 39 civilians killed.
On November 20, Israeli strikes on the city of Palmyra killed 106 Tehran-backed fighters, with one raid targeting a meeting of commanders.
It was the deadliest Israeli attack on Iran-backed groups since Syria’s war erupted in 2011, said the Britain-based Observatory which has a network of sources inside the country.
The casualties included 73 pro-Iran Syrian fighters, 11 of whom worked for Hezbollah which also lost four Lebanese members. The remaining 29 casualties were mostly from Iraq’s Al-Nujaba group.
On Monday, Israel struck again, this time at a crossing on the Syria-Lebanon border, the latest in a wave of attacks targeting such routes since September.
Observatory head Rami Abdel Rahman said Israel has mainly hit border crossings, Damascus apartments, and the positions of Iran-backed groups, including Hezbollah weapons and ammunition depots.
“Syria today has become a de facto part of Israel’s battlefield,” he said.
On November 19, Syrian Foreign Minister Bassam Sabbagh visited ally Tehran and condemned “more than 130” Israeli attacks on his country since the Gaza war started in October 2023.
These included an April 1 attack on an Iranian diplomatic building in Damascus that killed seven Islamic Republic Guard Corps members including two generals, triggering Iran’s first ever attack on Israel.
Since 2011, Israel has carried out hundreds of strikes in Syria, mainly targeting the army and Iran-backed groups.
Israel rarely comments on such strikes, but has repeatedly said it will not allow Iran to expand its presence there.
Israel’s military said Monday’s strikes targeted “smuggling routes to transfer weapons to” Hezbollah, and follow other operations against “Syrian regime smuggling routes” in recent weeks.
For Century Foundation analyst Sam Heller, “the deterrent balance that had existed between Hezbollah and Israel has broken down” since the Lebanon war.
“Israel is now bombing Lebanon at will, and additionally hitting what are purportedly Hezbollah and Iran-linked targets in Syria without fear of real reprisal” by the group.
“This all seems like an attempt by Israel to sustainably weaken Hezbollah,” as it pounds its “logistical lines via Syria and pushes for a resolution to the war that will prevent Hezbollah from resupplying and rebuilding,” Heller added.
Renad Mansour of Chatham House said Israel’s Syria strikes “targeted the financial and military supply chains that fuel the axis of resistance” — Iran-backed armed groups that include Hezbollah and Palestinian, Yemeni and Iraqi militants.
On Sunday, UN special envoy for Syria Geir Pedersen said it was “extremely critical” to end the Lebanon and Gaza fighting to avoid dragging Syria into a regional war.
Escalating Israeli attacks have added to the country’s woes after 13 years of conflict and successive economic crises compounded by Western sanctions.
Damascus has not responded to Israel’s attacks and has tried to distance itself from the Gaza and Lebanon wars.
“Any counterattack against Israel would invite massive retaliation against Syria’s leadership or essential infrastructure,” Heller said.
A source close to Hezbollah said “Syria’s role is not to attack Israel, but rather to serve... as a supply line from Iran and Iraq to Hezbollah.”
Tehran and Baghdad fear that Israeli strikes, which have already hit Yemen’s Houthi militants, could hit their territory even if a ceasefire is agreed, the source said, requesting anonymity to discuss sensitive matters.
Last week, Israel called on the UN Security Council to pressure Iraq into halting attacks launched by Iran-backed groups from its soil.
Tehran-backed Iraqi factions have claimed near-daily drone attacks on Israel in solidarity with allies Hamas and Hezbollah. Most of the attacks were intercepted.
The Baghdad government, which is dominated by pro-Iran parties, has accused Israel of trying to legitimize attacking Iraq, saying it was already taking measures to prevent attacks on Israel launched from its territory.
For more than a year, “Iraq has managed to stay relatively insulated from this wider regional war,” Mansour told AFP, adding that Iran and the United States also pushed for this.
But “in this time of transition between US President (Joe) Biden and (Donald) Trump, the Iraqi government is concerned that (Israeli Prime Minister Benjamin) Netanyahu has even more of a free hand to go after all the axis of resistance,” he said.
UK campaigners file emergency injunction over F-35 exports to Israel
- Move follows ICC issuing of warrants for Netanyahu, Gallant
- ‘UK is now arming suspected war criminals,’ says Global Legal Action Network lawyer
LONDON: Campaigners in the UK seeking to block the sale of F-35 parts to Israel are applying for an emergency high court injunction after the International Criminal Court issued an arrest warrant for Israeli Prime Minister Benjamin Netanyahu.
The government has until Friday to file a defense against the campaigners from Global Legal Action Network and Al-Haq.
It is “unconscionable” that British manufacturers of F-35 parts continue to sell weapons systems that are used to kill Palestinians in Gaza, campaigners said.
On Nov. 18 at a high court hearing, the government admitted that potential damage to the UK-US relationship played a role in the continuation of exports.
In earlier hearings, ministers, some of whom have admitted that Israel is in breach of international law, were asked about the rationale for continuing exports.
The court was set to hear the case again in January next year.
Government ministers have said that F-35 parts enter a general export pool and that it is impossible to determine the destination of each part.
The Labour government reversed a decision by the former Conservative government to allow some arms export licenses to Israel to remain in place, finding a risk that the exports could be used to breach international humanitarian law.
GLAN lawyer Charlotte Andrews-Briscoe said: “It is unconscionable that the UK continues to allow British-made components for F-35s to be used in Israel’s extermination campaign against Palestinians.
“As of Thursday, the UK is now arming suspected war criminals who have been indicted by the world’s preeminent criminal court.
“For 13 months, GLAN and Al-Haq have argued that weapons sales to Israel are unlawful. When will it be enough? Does the UK government have any red lines?”
The emergency injunction follows the ICC’s issuing of arrest warrants for Netanyahu; former Israeli Defense Minister Yoav Gallant; and Hamas military chief Mohammed Deif.
The Israeli leader condemned the court’s decision as “antisemitic.”
GLAN and Al-Haq’s injunction is a sign of the impact caused by the ICC warrants.
Al-Haq spokesperson Zainah El-Haroun said: “The latest arrest warrants issued against Israeli Prime Minister Netanyahu and former Defense Minister Gallant for the commission of war crimes and crimes against humanity add to the insurmountable evidence that British weapons, particularly F-35 components, are being used to commit international crimes, including genocide.”
Militia detains 300 migrants in the desert in Libya’s effort to contain sea crossings
- The group in a post on Facebook condemned smuggling and human trafficking and said its patrols would continue efforts to block smuggling routes
- The apprehensions come as Libya remains a primary point of departure for men, women and children from the Middle East and Africa aiming to reach Europe
TRIPOLI: Libyan military officials said Monday they apprehended hundreds of migrants traversing the country’s vast desert hoping to ultimately cross the Mediterranean Sea in pursuit of a better life in Europe.
The 444 Brigade, a powerful militia group that operates under the auspices of the Libyan army, said in a statement that its patrolling commanders detained more than 300 migrants and referred them to authorities.
The group in a post on Facebook condemned smuggling and human trafficking and said its patrols would continue efforts to block smuggling routes. It posted satellite images of the desert and pictures of what appeared to be migrants sitting in rows in front of armed and masked militants.
The apprehensions come as Libya remains a primary point of departure for men, women and children from the Middle East and Africa aiming to reach Europe. Many are escaping war or poverty and many employ smugglers to help them negotiate treacherous deserts and sea routes. Roughly 38,000 people have arrived in Italy and Malta from Libya this year, according to UNHCR, the United Nations Refugee Agency.
The overcrowded boats used by migrants and smugglers are known to routinely capsize and a key priority for European leaders has been to encourage North African countries to prevent migrants from reaching the sea. But unlike in Morocco and Tunisia — where tens of thousands of migrants also attempt to pass through en route to the southern shores of Europe — fighting between rival governments in Libya has added additional challenges to migration management partnerships.
Migrant apprehensions are rarely reported in Libya, though the country’s state news service LANA reported more than 2,000 arrests in July.
The oil-rich country plunged into turmoil after a NATO-backed uprising toppled longtime dictator Muammar Qaddafi. Since then, the country has been divided between dueling governments in the east and west, each backed by militias and foreign powers. Human traffickers have for years benefited from the political chaos.
United Nations High Commissioner for Human Rights Volker Türk in July said migrants in the country had been subjected to torture, forced labor and starvation while being detained.
