Recent reports reveal how the Iranian regime has been using malicious apps to spy on users’ smartphones. The report was issued in one of the most recent publications of the France-based National Council of Resistance of Iran (NCRI), widely held as the most influential Iranian opposition party.
Producing publicly available apps loaded with malware is and has been a broad-based strategy of the Iranian regime for quite some time. The regime has created close to 100 spyware apps, including Mobogram, Telegram Farsi, Hotgram, Wispi, and Telegram Talayi, all designed to resemble popular apps. These programs have already been unwittingly downloaded by hundreds of Iranian citizens.
The appearance of Telegram Black shows the risk these programs pose to international users as well. According to Alireza Jafarzadeh, the deputy director of the NCRI-US, the Iranian security apparatus contains “a unit called the Intelligence Organization, a specific department allocated to cyberwarfare. This is the department that deals with the cyberwarfare against the Western countries [and] against its own population.”
In some ways, these reports are old news.
Iran has been using the internet to suppress its own citizens forever. This practice has been on the uptick ever since the recent protest movement began in Iran last December.
What is important to note about this story are two very important points in regards to US national security, both to the threat posed by Iran specifically, as well as the broader cyber integrity of the United States as a whole.
Iran is expanding its cyberwarfare tactics to an international scale. In fact, there is much evidence to suggest that one of the main motivations of the regime to implement cyber repression on the Iranian people is to test the efficiency of various tactics and then export them to enemy countries.
“The Iranian regime is currently hard at work to test the success of these apps on the people of Iran first,” said Jafarzadeh. “If not confronted, its next victims will be the people of other nations.”
Speaking to the Senate Select Committee on Intelligence almost two weeks ago, Director of National Intelligence Dan Coats voiced a similar sentiment. “Iran will try to penetrate US and allied networks for espionage and lay the groundwork for future cyberattacks,” said Coats in his statement.
All of this confirms the theory posed by several experts over the past months that Iran will resort to the cyber realm to target its adversaries. This applies to both direct cyberattack as well as intelligence-gathering operations. Iran has a strong track record on this already.
In late 2017, for instance, British intelligence officials reported that a series of hacks in June 2017 that targeted several Parliament members, including Prime Minister Theresa May, was executed by cybercriminals connected to the Iranian government. The hacks affected some 9,000 accounts and exposed approximately 100 sensitive communications. While Iran may not be the most advanced in cybercapabilities, the country has proven itself capable enough to execute substantial operations.
The second takeaway from these reports is the implication for cyber integrity of the civilian realm. Much talk has been generated about threats to domestic information systems in the United States ever since reports by American intelligence agencies came out back in October, warning of the exposure of “critical infrastructure” to “state actor” attacks. The importance of this warning and others that followed was underscoring the vulnerability of the private sphere in general as the most likely cybertarget of America’s enemies. Planting malware in publicly accessible app venues could prove to be one of the most effective routes to target the West in the digital sphere.
Until now, Iran’s 80-million-strong population has been a testing ground to determine the most successful methods for cyberintrusion and attack. The evidence shows the method adopted by the regime to create malicious apps disguised as legitimate. It is no surprise that this same tactic is now being used to target international users. The aforementioned NCRI report lists a handful of supposedly problematic apps that are available outside of Iran. The list includes Mobogram, Telegram Farsi, and Telegram Black. U.S. media has reported that most, if not all, are indeed still available for download.
Noteworthy in these reports is that the specific tactic being used by Iran-backed programmers to disseminate their malicious apps has been producing “forks,” or unofficial copies of other officially licensed programs. Using this method will likely lead Iran to produce replicas of the most popular applications in the US in the hopes that users will take the bait.
Iran' attempts to hide viruses in popular applications smacks of the growing concern revolving around the so-called “supply chain hack,” namely the danger of devices and programs becoming infected with malware at some point before reaching the consumer. This threat has become increasingly more central in the world of IT security over the past several years. This danger has prompted a new level of awareness to ensure the digital products Americans use, either devices or programs, are secure from the point of manufacture to the point of delivery.
