Iran shifted focus of cyberattacks from US to Israel, Microsoft says
Iran trained most of its cyber might away from the United States toward Israel since the Gaza war began last year, according to a report by technology giant Microsoft.
Iran trained most of its cyber might away from the United States toward Israel since the Gaza war began last year, according to a report by technology giant Microsoft.
"Iranian nation-state actors used ransomware in a cyber-enabled influence operation, marketing stolen Israeli dating website data," Microsoft said.
Following October 7, when Iran-backed Hamas led an attack on Israel, the report cites a marked increase in cyber operations aimed at Israel. From October 7, 2023 to July 2024, "nearly half of the Islamic Republic's cyber operations… targeted Israeli companies", it said.
Iran's cyber efforts are not confined to Israel. The report adds that Iranian and Russian actors are leveraging the ongoing conflicts to spread "divisive and misleading messages through propaganda campaigns" beyond the immediate geographical boundaries of the conflicts.
Microsoft emphasized the continued targeting of the US and Persian Gulf nations, particularly the UAE and Bahrain due to their normalization of ties with Israel.
Cyber defense chief Gaby Portnoy warned in June that since the outbreak of the Gaza war on October 7, cyberattacks by Iran have become more aggressive, targeting not only Israel but also its allies.
“We have identified that Iran is attacking its allies and other countries for information extortion and damaging digital services,” said Portnoy, head of the Israel National Cyber Directorate (INCD), at the Cyberweek annual conference held at Tel Aviv University.
Portnoy warned that the information stolen from government systems is then used for Iranian cyberterrorism, making Iranian cyber aggression "an international problem, not only an Israeli one, and therefore the solution needs to be international".
Also in August, Microsoft released its Threat Intelligence Report, which provided a comprehensive analysis of how various groups orchestrated influence campaigns aimed at swaying voters, particularly in swing states.
These operations were complemented by intelligence-gathering activities on political campaigns, potentially establishing a foundation for future interference, it said.
Canada's move was made alongside the US Treasury Department's decision to list the group as a specially designated global terrorist entity.
Samidoun, which means "the steadfast ones" in Arabic, had been registered as a non-profit in Canada since March 2021.
"Violent extremism, acts of terrorism or terrorist financing have no place in Canadian society or abroad," Canada's Public Safety Minister Dominic LeBlanc said in a statement.
"The listing of Samidoun as a terrorist entity under the Criminal Code sends a strong message that Canada will not tolerate this type of activity, and will do everything in its power to counter the ongoing threat to Canada’s national security and all people in Canada.”
The US and Canada allege that Samidoun has links with another terrorist-designated group, the Popular Front for the Liberation of Palestine (PFLP).
Samidoun describe themselves on their official website as being advocates for the release of Palestinian prisoners. The organization did not immediately respond to an Iran International request for comment.
According to Public Safety Canada (PSC) many of those prisoners have ties to assassinations and attacks against Israel.
The PSC says Samidoun has been operating since 2011 and has 20 chapters around the world, including Iran, which Canada designated as a state supporter of terrorism.
Elham Abedini is listed as the coordinator of Samidoun's Iran chapter on Samidoun's official website.
NGO Monitor, a research institute that has been investigating and raising concern over Samidoun to governments around the world since 2018, says the group has an informal connection to the Islamic Republic of Iran through a shared ideology and Iran's pursuit of soft power.
The non-profit's communications director Itai Reuveni told Iran International that Iran uses groups like Samidoun to exert its ideology and influence in the West without revealing themselves as the source.
"This fits to the Iranian practice to only use proxies. Samidoun is part of the proxies. Not just Hezbollah and Hamas, but also through soft power proxies " says Reuveni.
The anti-west, anti-Israel and pro-Islamic Republic narrative fits in with Iran's narrative that it wants to export through groups like Samidoun, who have direct access to the West, Reuveni added.
In July, a top US intelligence official revealed that the Iranian government provided financial support for the pro-Palestinian demonstrations rocking US campuses. An Iran International exclusive also found evidence that Iran was behind campus protests rocking McGill university in Canada.
Matthew Levitt, the director of the Reinhard Program on Counterterrorism and Intelligence at The Washington Institute for Near East Policy, said Samidoun was "explicitly active in some of the most vile pro-violence behavior at campus protests. "
Levitt, the author of Hezbollah: The Global Footprint of Lebanon's Party of God, says Iran has definite ties to the PLFP, for which Samidoun was acting as "sham charity" front, according to a US treasury statement on Wednesday.
“Organizations like Samidoun masquerade as charitable actors that claim to provide humanitarian support to those in need, yet in reality divert funds for much-needed assistance to support terrorist groups,” said US treasury official Bradley T. Smith in the statement.
Samidoun and Iran
Samidoun's director, Charlotte Kates, accepted an official "human rights award" in Iran on August 4th, an accolade that was also bestowed on the secretary-general of militant group Palestinian Islamic Jihad (PIJ).
Kates also appeared on Iran State TV, where she praised Hamas’ Oct. 7 attack on Israel.
“I spoke about the brave, heroic October 7 operation and the legitimacy of the resistance,” Kates said, dedicating the award to the “martyrs and prisoners of Palestine.”
In a March 2024 Samidoun-hosted webinar, Kates praised Hamas as “the people that are on the frontlines, defending Palestine and fighting for its liberation".
Kates is also under a hate speech investigation in Canada for praising the attack.
Samidoun's website covered Kates's meeting with Kazem Gharibabadi, Iran's Secretary-General of the High Council for Human Rights at the awards ceremony in Tehran. Kates also took part in a joint live interview with Gharibabadi.
The existence of Samidoun's Tehran chapter and their participation in Iranian state events could not happen without the Iran government's approval, says NGO Monitor's Reuveni.
Palestinian Islamic Jihad, the PFLP, and the Popular Resistance Committees have themselves cited a relationship with Iran including military support.
Kates's husband, Khaled Barakat, also a director of Samidoun, was identified by the US treasury statement as allegedly backing the fundraising and recruitment efforts to support the PFLP's "terrorist activity against Israel". Israeli security service Shin Bet alleges that Barakat is an active senior member of the PFLP.
The PFLP operates in Gaza and the West Bank and participated in attacking Israeli civilians on Oct. 7, the treasury department added.
Some Iran watchers like Jason Brodsky say that the PFLP's direct links to Iran are evidence enough linking Samidoun to the Islamic Republic.
Brodsky, policy director of United Against Nuclear Iran (UANI), says Kates' official visits to Iran, appearance on state TV and meeting with high-level officials like Iran's Judiciary Chief Gholamhossein Mohseni Ejei points to an official link with the Islamic Republic.
In 2011 by the United States Department of State and the European Union sanctioned Ejei for his role in suppressing the 2009 Iranian presidential election protests.
"My concern is that the Islamic Republic likes to cultivate these individuals who have access to the West," Brodsky said.
"She is engaged in messaging that is very much in line with the Islamic Republic's ideological outlook," added Brodsky.
According to NGO monitor, Samidoun does not publish financial information, and is only registered in Vancouver, British Columbia.
However, Samidoun is a fiscally sponsored project of the Alliance for Global Justice (AFJG), an Arizona-based organization. The AFJG also is a fiscal sponsor for left-wing initiatives including the Palestinian Campaign for the Academic and Cultural Boycott of Israel (PACBI).
In May 2019, PayPal, DonorBox, and Plaid shut down online donations to Samidoun due to its alleged links to the PFLP.
Samidoun has also been listed as a terrorist entity in Israel and banned in Germany and the Netherlands. The Dutch parliament voted to designate Samidoun a terrorist organization this week.
“Europe chose the path of confrontation instead of interaction with Iran by starting a new round of sanctions under the false pretext that Iran has sent missiles to Russia. Now Europe must wait to pay the cost of its decision,” Kayhan argued on Wednesday in an article titled “Europe Shut the Sky to Iranian Flights, Block the Sea to European Ships."
“Iran definitely has more capabilities to put pressure on Europe today in the gambit that they started,” the ultra-hardline daily whose managing editor, Hossein Shariatmadari, is an appointee of Supreme Leader Ali Khamenei, wrote, arguing that preventing European vessels from reaching their destinations in the Persian Gulf will be more costly to Europe than the ban on Iranian flights.
Iran Air, the only Iranian airline operating flights to European Union countries, suspended all its services to Europe due to new sanctions imposed by the European Union that targeted Iran Air, Mahan Air which is partly owned by a Revolutionary Guards (IRGC) linked company, and Saha Airlines, a civil operator owned by the Islamic Republic of Iran Air Force.
The United States and its Western allies accuse Iran of using its civilian flights to send weapons including missiles to Russia for its war in Ukraine. The Islamic Republic denies any missile transfer to Russia.
There have always been allegations that the Islamic Republic uses its civilian fleet for military transfers.
Iran International acquired the audio file of an interview with former foreign minister Mohammad-Javad Zarif in April 2021. In the interview that was never published in Iran, Zarif criticized Qasem Soleimani, the slain commander of the extra-territorial arm of the Revolutionary Guards (IRGC), the Qods Force, of using Iran Air flights for shipments, presumably fighters and weapons, to Syria rather than the allegedly IRGC-linked Mahan Air which he said was less safe.
Mahan Air was designated by the US Treasury in 2011 for "providing financial, material and technological support” to the IRGC. These were followed by bans by several European countries including Denmark and Germany in the following years until the airline lost all its flights to European destinations by Spain joining the embargo in 2020.
Iranian officials and hardliners have periodically called for the closure of Hormuz as retaliation for various Western actions. Around 21 percent of the world's crude oil passes through the straits, heavily patrolled by both Iran and Western navies. This means that a closure of Hormuz will also stop all of Iran's oil shipments and a significant portion of China's oil inports. From January to September, China imported 4.2 mb/d of crude via the Strait of Hormuz, accounting for 43% of its seaborne crude.
Iranians have taken to social media since the announcement of the Iran Air sanctions and the country’s suspension of its flights to European destinations to voice their frustration.
There were unconfirmed reports on social media Wednesday that an Iran Air flight to Turkey was not granted permission to land for several hours due to the EU sanctions.
Iran Air sanctions mean that no Iranian can fly directly to destinations in the Western Hemisphere without using a connecting flight from other regional airports such as those in Turkey, the United Arab Emirates, or Qatar.
Some netizens contend that the suspension of direct flights to Europe will highly affect expatriate Iranians including students and their families, including the elderly and the sick who will find it very difficult to find their way through non-European airports to board connecting flights.
