The United States slapped sanctions on two Iranian entities and 45 associated individuals who carried out a malware campaign targeting Iranian dissidents, journalists and international travel companies, the US Treasury Department said on Thursday. "Today, the US Department of the Treasury's Office of Foreign Assets Control imposed sanctions on Iranian cyber threat group Advanced Persistent Threat 39 (APT39), 45 associated individuals, and one front company, the statement read. "Masked behind its front company, Rana Intelligence Computing Company (Rana), the Government of Iran employed a years-long malware campaign that targeted Iranian dissidents, journalists, and international companies in the travel sector," the statement added. In his reaction to the sanctions, US Secretary of State Mike Pompeo tweeted, saying: "Today, the US sanctioned 47 Iranian individuals and entities involved in the Iranian regime's global cyber threat network. We will continue to expose Iran's nefarious behavior and we will never relent in protecting our homeland and allies from Iranian hackers." Meanwhile, US Treasury Secretary Steven T. Mnuchin said: "The Iranian regime uses its Intelligence Ministry as a tool to target innocent civilians and companies, and advance its destabilizing agenda around the world." "The United States is determined to counter offensive cyber campaigns designed to jeopardize security and inflict damage on the international travel sector," Mnuchin added. According to the statement, Rana advances Iranian national security objectives and the strategic goals of Iran's Ministry of Intelligence and Security by conducting computer intrusions and malware campaigns against perceived adversaries, including foreign governments and other individuals the MOIS considers a threat. The 45 designated individuals served in various capacities while employed at Rana, including as managers, programmers, and hacking experts. These individuals provided support for ongoing MOIS cyber intrusions targeting the networks of international businesses, institutions, air carriers, and other targets that the MOIS considered a threat. The FBI advisory, also released on Thursday, details eight separate and distinct sets of malware used by the Iranian ministry through Rana to conduct their computer intrusion activities. This is the first time most of these technical indicators have been publicly discussed and attributed to the ministry by the US government. By making the code public, the FBI is hindering the ministry's ability to continue their campaign, ending the victimization of thousands of individuals and organizations around the world. — Agencies
