Cyber espionage investigator
Iran has expanded its cyber warfare capabilities in recent years, exposing vulnerabilities in US defenses, meddling in election campaigns even, while policymakers in Washington debate the proper response.
Asked about Iran's Supreme Leader Ali Khamenei's characterization of any negotiations with Washington over Tehran's disputed nuclear program as unwise, Republican Senator Rick Scott said, "I think he's foolish."
"If you look at everything he's been trying to do, it's failed," the Florida Senator said at the sidelines of a bipartisan luncheon, citing setbacks to Iran's network of militant allies in the region at the hands of Israel's US-armed military.
The 15-month campaign has put on the backfoot an array of Islamist armed factions in the occupied Palestinian territories, Lebanon, Iraq and Yemen have long been funded and armed by Tehran.
Israel decapitated the leadership of Hezbollah in Lebanon and helped bring about the downfall of the Assad dynasty in Syria, Iran's oldest Arab ally.
The blows and a direct attack on Iran on Oct. 26 have left Iran weakened and brought the issue of Iran's disputed nuclear program and a deal to resolve it in greater focus.
"Clearly everybody would rather them decide not to have a nuclear weapon and stop giving money to their proxies," Scott said. "We feel sorry for the people of Iran, but they're going to have to take matters in their own hand and get a better government."
Trump has said he much prefers a deal over Iran's nuclear program over any military confrontation but reimposed harsh sanctions from his first term.
The renewal of the so-called "maximum pressure" campaign has cheered Iran hawks in Washington, mostly Republicans, who long criticized what they viewed as a permissive attitude by the Joe Biden administration on Iran.
Democrats meanwhile have struggled to mount an effective opposition to Trump's blizzard of executive orders aimed at downsizing government and reining in policy priorities they championed under Biden.
Their qualms with Trump in the foreign policy sphere have mostly focused on the planned gutting of USAID, the world's largest donor of humanitarian aid.
"Quite honestly, Iran has gotten really used to a paper tiger in the White House," Senator Kevin Cramer of North Dakota said. "They no longer have that. And I think we have to flex our muscles and then back up whatever it is we say."
Cramer told Iran International's Arash Aalaei that Khamenei's remarks ought not to shock Washington but rather bring into focus the nature of their adversary, expressing no misgivings about Trump's stated reluctance to punish Iran and preference for an agreement.
"I have no doubt that when (Trump) says he wants to sit down and negotiate, he's going to be negotiating with somebody who he's got a headlock on."
Nahid Modarresi, an undocumented Iranian refugee who lives in hiding from Turkish authorities, is one among the tens of thousands of Iranian asylum-seekers whose fate hangs in the balance.
“I hide myself because I am too afraid to go outside," Nahid told Iran International.
Protected person status, a legal term under international law offering protection if host governments are unable, was granted to Nahid in 2018 by the United Nations High Commissioner for Refugees (UNHCR).
The Turkish Supreme Court recently revoked it, throwing her life into disarray.
Though there are no official statistics, at least 3,000 Iranians who once had been granted protected persons status have had it revoked by Ankara, a Turkey-based Iranian researcher who works with asylum seekers told Iran International, declining to be identified for safety reasons.
Nahid says she fled Iran in 2018 over her sexual orientation and has since publicly engaged in human rights activities aimed against the country's Islamic authorities.
“My life is in danger,” said Nahid. “If I get sent back to Iran, they will arrest me and maybe execute me.”
Homosexuality in Iran is punishable by death for men and by 100 lashes for women. On repeated offenses, women can be also executed.
Nahid gained prominence in the human rights community for public campaigning after her sister Elham Modarresi was imprisoned for taking part in the Woman, Life, Freedom protest movement that rocked Iran in 2022.
Elham was taken by security forces from the home she shared with her family to Kachooie Prison outside Tehran in 2022 and was tortured and denied medication for a genetic liver condition, she and Nahid told Iran International.
In 2023, Elham was released on bail and managed to escape to her sister in Turkey.
Nahid advocated to help move her sister to Canada where she successfully had a liver transplant that helped save her life, but Nahid herself was left behind.
"I am very worried for my sister. I am so scared for her," Elham told Iran International.
Iranian refugees vulnerable in Turkey
Now faced with the revocation of her protected persons status, Nahid is speaking out and making a plea for herself and all Iranian refugees.
“It’s not just me and my situation. It's all political fighters from Iran. We fight the Islamic Republic,” said Nahid.
Nahid’s legal counselor in Ontario Hooshang Lotfi has filed an application to bring her to Canada and found five people willing to sponsor her. Pleading her case to Canadian authorities, Lotfi says Nahid's time is running out.
UNHCR's departure
In September 2018, the United Nations High Commissioner for Refugees (UNHCR) ended registration and refugee status determination procedures in Turkey in what it described as a response to Ankara's improvement of its immigrant population registry and refugee status determination process.
The UNHCR's departure followed by a European Union-Turkey migration agreement has put Iranian refugees in a precarious position, said Behnam Daraeizadeh, a senior fellow at the Canada-based Centre for Human Rights in Iran (CHRI).
“It is a big challenge and unfortunately has led to more deportations for the individuals who have already been accepted by the UN."
Since the change, organizations like CHRI have reported that Turkish authorities stepped up efforts to detain and deport unregistered migrants.
“These activists face arbitrary detention, possible torture, sham convictions on national security charges, and years of prison if they are extradited back to Iran,” said CHRI Executive Director Hadi Ghaemi.
Sina Rostami, a 35-year-old Iranian in exile in Turkey described to Iran International the horrors of what he has faced for months at a Turkish deportation camp.
“The way they treat us here is like we’re not humans,” said Sina, a Woman, Life, Freedom protestor who faces deportation to Iran. Sina’s sleeping quarters that he shares with six people and the washrooms have no lights. Sina said he often has to wait 12 to 14 hours before he is permitted recreation outdoors.
The Turkish government has not responded to Iran International's request for comment on these allegations.
A hub for refugees
Turkey is the world's leading host of refugees and is a middle ground between conflict zones and Western countries where migrants seek better lives.
Daraeizadeh said the Turkish government lobbied the UN so it could have more control over asylum seekers in a setback to the asylum-seekers.
Since Iran provided political support to President Recep Tayyip Erdogan after a failed coup in 2016, many activists argue Turkey is not keen on sheltering Iranians political asylum seekers.
Despite the risks, Iranians continue to flee their homeland as security forces keep up a crackdown on dissidents.
As a cyber espionage investigator focused on Iranian state-sponsored hacking, I’ve observed these operations evolve steadily—from initial reconnaissance to targeted intrusions.
Even when US agencies unmask these hackers, legal and enforcement actions often drag on for months or years, allowing adversaries to rebrand and operate under new aliases.
Yaser Balaghi Inalou, one of three Iranian hackers recently indicted by the Department of Justice for a hack and leak operation targeting the 2024 presidential election, was exposed as early as 2015 by the Israeli security firm Check Point.
Had US agencies exposed him at the time, it might have fractured his network and even disrupted the attack on Donald Trump’s 2024 campaign.
With President Trump’s second term underway and the possibility of deepened tensions between Tehran and Washington, a cohesive and decisive strategy to address this threat seems imperative.
Intelligence agencies may unmask hackers quickly. But those unmasked would regroup and evolve if legal and enforcement responses are delayed. Greater collaboration may be required between federal agencies like the FBI and the Department of Homeland Security, even with private cybersecurity firms, to ensure swift countermeasures such as targeted sanctions and asset freezes.
Also important would be rebuilding trust in US whistleblower programs. Insider intelligence from those with firsthand knowledge of Iranian cyber operations—whether from inside Iran or abroad—can be invaluable.
The current track record of the Rewards for Justice (RFJ) program discourages potential informants. Its FAQ page still highlights cases from 1995 and 2007, with no reference to payouts for whistleblowers in Iranian cyber operations.
Providing a recent example on its website or social media could restore credibility and encourage more people to come forward. As it stands, many of those engaging with the program on social media view it as more of a stunt than a serious incentive.
Public exposure of Iranian cyber operatives is another critical measure. Many operatives hide behind the guise of IT professionals. Publishing updated lists of identified operatives in English and Persian could help rid these groups of the secrecy on which they rely.
Sanctions and asset seizures also remain powerful tools. Iran’s cyber operations are largely directed by state entities like the Ministry of Intelligence and the Islamic Revolutionary Guard Corps (IRGC), already designated as a terrorist organization by the US. Expanding efforts to track and freeze financial assets tied to these entities could significantly disrupt Tehran’s ability to fund its hacker networks.
The importance of swift and proportional countermeasures cannot be overstated. Delayed responses—sometimes by as much as a year—reduce deterrence and embolden threat actors.
Strengthening alliances and building a collective defense mechanism would also enhance deterrence by creating a more formidable response.
The United States relies on digital systems, from essential public services to financial networks. As the reliance grows, so does the threat posed by Iranian cyber operations, likely expanding as Tehran tries to avoid traditional military confrontation.
With the changing of the guards in Washington, new policies should be devised to protect the US digital infrastructure while holding Iran accountable for its online aggression. The implications of inaction are clear—continued vulnerability and escalating threats.
