US Sanctions Iranian Nationals Over DDoS Bank Attacks
DDoS
7 Iranians Already Indicted by Justice Department Over US Banking Disruptions
The U.S. Treasury Department has announced sanctions against 11 individuals and organizations with alleged ties to Iran, some of whom have been accused of helping to launch distributed denial-of-service attacks against dozens of U.S. banks from 2011 to 2013.
See Also: Effective Cyber Threat Hunting Requires an Actor and Incident Centric Approach
The sanctions follow the Justice Department in March 2016 indicting seven Iranians suspected of participating in the DDoS campaign against U.S. banks. Some allegedly worked on behalf of the Iranian government, including the Iranian Revolutionary Guard Corps – a branch of Iran’s armed forces (see 7 Iranians Indicted for DDoS Attacks Against U.S. Banks).
Now, those same seven Iranian nationals have been added to the Treasury Department’s Specially Designated Nationals list. “Their assets are blocked and U.S. persons are generally prohibited from dealing with them,” according to the Treasury Department.
“Treasury will continue to take strong actions to counter Iran’s provocations, including support for the IRGC-Qods Force and terrorist extremists, the ongoing campaign of violence in Syria, and cyberattacks meant to destabilize the U.S. financial system,” Treasury Secretary
The Justice Department accused Fathi, Firoozi and Shokohi of running “ITSEC’s portion of the DDoS campaign,” alleging that Shokohi, a computer hacker who helped build the botnet that was used to launch DDoS attacks, “received credit for his computer intrusion work from the Iranian government towards his completion of his mandatory military service requirement in Iran.”
The Justice Department accused Ahmadzadegan, Ghaffarinia, Keissar and Saedi of being responsible for “managing the botnet used in Mersad’s portion of the campaign.”
Ahmadzadegan, Mersad’s co-founder, “was also associated with Iranian hacking groups Sun Army and the Ashiyane Digital Security Team (ADST), and claimed responsibility for hacking servers belonging to the National Aeronautics and Space Administration (NASA) in February 2012,” the Justice Department alleged.