Israel-Iran cyber hostilities continue beyond ceasefire – FT
Cyber operations between Israel and Iran have intensified since June’s brief war despite a ceasefire, the Financial Times reported, citing Israeli officials and cybersecurity experts.
Cyber operations between Israel and Iran have intensified since June’s brief war despite a ceasefire, the Financial Times reported, citing Israeli officials and cybersecurity experts.
“It heated up after the start of the war, and it’s still going on,” one Israeli official told the FT.
Since the June 24 ceasefire, Iranian-aligned groups have attempted to exploit a recently identified Microsoft server software vulnerability to attack Israeli companies, according to chief executive of Israeli cyber threat intelligence company ClearSky, Boaz Dolev.
While the missiles stopped following the ceasefire that ended the 12-day war which saw massive destruction both sides, Iran's cyber war has continued at full pace, as reported by Iran International last month.
“Although there is a ceasefire in the physical world, in the cyber arena, [the attacks] did not stop,” Dolev added.
Spear-phishing messages purporting to be from diplomats and the prime minister’s office have also surged, cyber security company Check Point told the FT.
During the June conflict, Israel-linked hackers carried out some of the most disruptive strikes of the campaign. Gonjeshke Darande, a group widely regarded as aligned with Israel, claimed responsibility for destroying $90mn from Iran’s Nobitex cryptocurrency exchange and crippling services at Bank Sepah and Bank Pasargad by disabling their main and backup data centers.
While Iran’s capabilities were not to be underestimated, none of the wartime attacks on Israel had dramatic impact, Moty Cristal, a crisis negotiator and lieutenant colonel in the Israeli military reserves, told the FT.
Dolev said Iranian-linked groups had retaliated with hack-and-leak operations against about 50 Israeli companies, alongside attempts to plant malware aimed at destroying computer systems.
While they appeared unable to penetrate the defenses of Israel’s military or largest firms, he said, the attackers targeted smaller, more vulnerable businesses in their supply chains.
These included logistics and fuel providers as well as human resources firms, with hackers later releasing the CVs of thousands of Israelis with defense and security backgrounds.
On Friday, Armenia and Azerbaijan signed a deal at the White House to settle a longtime dispute over the corridor, a strip of land which became a flash point in the two rivals’ decades-long conflict.
The deal gives Washington leasing rights to develop the transit corridor, which would connect Azerbaijan with its exclave, Nakhchivan. It will be renamed the Trump Route for International Peace and Prosperity (TRIPP). Though it will operate under Armenian legal jurisdiction, the US will lease the land to a private American company to manage construction and logistics.
“The Islamic Republic will not easily overlook the issue of Zangezur,” Ali Bagheri Kani, the secretary of Iran's Strategic Council on Foreign Relations, told state broadcaster IRIB on Saturday evening in reaction to the US-brokered peace deal.
The Strategic Council on Foreign Relations is responsible for formulating strategies and policies and coordinating all foreign affairs activities. Its members and chair are appointed by the Supreme Leader.
Russia’s foreign ministry had also taken a position and said other countries would not remain silent, Bagheri Kani added.
Russia, a traditional ally and broker in the strategically vital South Caucasus, was excluded from the deal, despite its border guards stationed on the Armenia-Iran border.
While supporting the summit, Moscow urged that solutions be developed by regional countries themselves with support from their immediate neighbors—Russia, Iran, and Turkey—warning against the “sad experience” of Western mediation in the Middle East.
Kayhan calls plan a 'betrayal'
Bagheri Kani's remarks followed a sharply worded piece in Kayhan, a daily under the supervision of Supreme Leader Ali Khamenei, which described the agreement to build the Zangezur corridor as “a great betrayal” and warned that it “must not go unanswered” by the Islamic Republic.
“Iran should use the levers at its disposal to confront them and, as a first step, can invoke the Geneva and Jamaica conventions to ban the passage of US- and Israeli-affiliated vessels through the Strait of Hormuz,” wrote the daily on Sunday.
'Corridor will fail,' Khamenei advisor says
Ali Akbar Velayati, senior adviser to Khamenei, also rejected the project, warning Iran would stop its establishment “even without Moscow’s help” and accusing Washington of trying to reshape the South Caucasus.
“Mr Trump thinks the Caucasus is a piece of real estate he can lease for 99 years,” Velayati told the IRGC-affiliated Tasnim News Agency on Saturday.
“This passage will not become a gateway for Trump’s mercenaries," he said, referring to Azerbaijan and Armenia. "It will become their graveyard."
Armenian Prime Minister Nikol Pashinyan and Azerbaijani President Ilham Aliyev signed the US-brokered peace accord at the White House with US President Donald Trump.
The deal grants Washington exclusive development rights to a strategic route across Armenia linking mainland Azerbaijan to its Nakhchivan exclave, bypassing both Iran and Russia.
The White House has promoted the “Trump Route for International Peace and Prosperity” as a boost to energy exports and trade in the South Caucasus.
Armenia and Azerbaijan have fought repeated wars over Nagorno-Karabakh since the late 1980s, most recently in 2023 when Baku regained full control of the enclave. While Russia mediated previous agreements, its sway has diminished since the 2022 invasion of Ukraine.
In spite of the hardliners' reactions, Iran’s foreign ministry on Saturday welcomed the peace text as an important step toward stability. However, it cautioned that projects near its borders must proceed “within the framework of mutual interests, with respect for national sovereignty and territorial integrity, and without foreign interference.”
“Iranian threat-related activities directed at Canada and its allies are likely to continue in 2025 and may increase depending on developments in the Middle East and the Iranian regime’s own threat perceptions,” the Canadian Security Intelligence Service said in a statement.
The CSIS told The Globe and Mail on Saturday it is actively investigating death threats in Canada linked to the Islamic Republic.
“Given the need to protect our sources, tradecraft and methods, however, we cannot confirm or deny specific investigative details,” said CSIS spokesperson Magali Hébert.
The agency’s warning follows an announcement by Iran International that two of its Canada-based journalists were targeted by the Islamic Republic in recent weeks.
"It's very, very intense and very threatening," Adam Baillie, spokesman for Iran International, told The Canadian Press.
"People get all sorts of messages of, 'We know where you live, remember we watch you, remember we know all about you, we know where your family lives.' It's that kind of thing," Baillie said.
UN appeal over threats to journalists
On Tuesday, Iran International filed an urgent appeal with United Nations experts urging them to take action against Iran over serious risks to the lives and safety of their journalists worldwide and relatives inside Iran.
Over the past six weeks, the Iranian authorities have intimidated and threatened 45 journalists and 315 of their family members with death unless they stop working for Iran International by specific deadlines, Iran International said in a statement.
Carlos Nagore Diaz, spokesperson for UN special rapporteur on freedom of expression Irene Khan, said “several UN Special Rapporteurs are considering taking urgent action on the renewed credible threats to life,” but confirmed that “any communications with the Iranian regime are currently confidential.”
In its reply to the UN, Iran’s permanent mission rejected “allegations made about the threats or kidnapping plans” and described Iran International as “an anti-Iranian network” whose operatives “will be dealt with according to the relevant laws.”
UN rapporteurs wrote in May 2024 that intimidation of the channel’s staff “may amount to violations of the sovereignty” of the countries in which they operate.
In March 2023, Iran International presenter Pouria Zeraati was stabbed in London. Two Romanian nationals were later charged.
In late June, IRGC forces in Tehran detained the family of another Iran International presenter to pressure them into ending their cooperation with the network.
CSIS’s warning also comes after an alleged Iranian plot to assassinate former Canadian justice minister Irwin Cotler, which the Royal Canadian Mounted Police says it foiled last year. Cotler remains under 24-hour police protection.
Last week, Canada joined Britain, the US, France, Germany, the Netherlands, and Denmark in condemning what they called “a growing number of threats from Iranian intelligence services on their soil,” including collaboration with organized crime networks to target dissidents.
