The recent cyberattack on Albania by Iran highlights the intensification of conflict within cyberspace.

Earlier this month the “strongest public response to a cyberattack” was witnessed when Albania severed diplomatic relations with Iran over its role in the devastating cyberattacks against Albania’s government infrastructure. This cascading incident highlights the vast differences in nation-state capabilities and defences within cyberspace, and how offensive cyber operations can devastate those nations caught in the middle.

On 17 July 2022, Albania was hit by a series of cyberattacks that targeted public services and government websites. The attack, claimed by ‘HomeLand Justice’ employed new family ransomware malware, ROADSWEEP, and a new variant of a wiper malware, ZEROCLEAR. Since Albania is a NATO member, and these attacks are happening during Russia’s ongoing invasion of Ukraine, the local media speculated that Russia was the culprit.

This speculation faded quickly after a US cyber threat intelligence firm, Mandiant, attributed the cyberattack and the ‘HomeLand Justice’ group to Iran. Their analysis was aided by the imagery used on the ‘HomeLand Justice’ group’s Telegram channel. Iran had posted a banner image which depicted an eagle swooping down on a smaller bird within the Star of David.

Source: Mandiant

The smaller bird—a character from the Angry Bird franchise—seemed innocuous but provided analysts a clear link to Iran. John Hultquist, Vice President, Mandiant Threat Intelligence, explained that the smaller bird had been claimed by ‘Predatory Sparrow’, a threat actor that has conducted offensive cyber operations against Iran.

Source: Mandiant

In fact, since July 2021, the ‘Predatory Sparrow’ threat actor has been conducting measured, destructive, and disruptive cyber operations against Iran. Their offensive cyber operations disrupted rail services, cut off fuel distribution, and even destroyed a steel plant affiliated with the Iranian Revolutionary Guard Corps.

There’s no clear evidence to suggest that Albania’s government had a role in ‘Predatory Sparrow’s operations, yet Iran deemed them a fair target in responding against ‘Predatory Sparrow’s actions. The prevailing theory, supported by a new report from Microsoft, suggests that ‘Predatory Sparrow’ is linked to the exiled Iranian opposition group, the Mujahedin-e-Khalq (MeK) which operates out of Albania and Israel. This is further supported by terrorist threats that cancelled a planned MeK conference in Albania.

Given ‘Predatory Sparrow’s year-long destructive cybercampaign, Iran was justifiably itching to respond. Albania, regarded by Iran as a “safe haven” for the MeK, is more of an ‘unwitting conspirator’ than a knowing participant in this ongoing cyber conflict. Albania is considered to be the “fifth largest source of cybercrime in Europe”, which only recently took steps to develop a cybercrime centre, and received 18 million euros in November 2021 to establish a cyber military force. After a massive leak of citizen data in December 2021, Albania brought in US firms to bolster its cyber defences.

Even though Albania lacked proper cyber defences, it is a member of NATO. The military alliance has been reinvigorated, following Russia’s invasion of Ukraine and in February 2022, it reaffirmed that a cyberattack on a NATO member state could trigger Article 5—the alliance’s collective defence clause, last activated by the US after the 9/11 terror attacks. However, NATO has since declined to clarify what threshold a significant cyberattack (or “an accumulation of smaller ones”) would need to cross for an Article 5 decision.

Albania, regarded by Iran as a “safe haven” for the MeK, is more of an ‘unwitting conspirator’ than a knowing participant in this ongoing cyber conflict.

Declaring Article 5, is a political decision, much like a declaration of war. One is inclined to speculate whether Albania’s fellow NATO members, actively engrossed with the Russian invasion, sought to avoid sparking a ‘second front’ in the Middle East. Albania, opted against Article 5, despite the disruption and destruction of its government services and systems, and chose to cut diplomatic ties with Iran. This move did little to deter Iran from conducting yet another offensive cyber operations against Albania’s border system.

What has been unfolding is a perfect case of a comprehensive conflict within cyberspace. The most noteworthy observation is the difference in the playing field between sophisticated cyber actors and other countries.

Those countries that have been on the receiving end of cyber action or cyber-enabled espionage, have gone on to develop both their offensive and defensive capabilities. Often taking a traditional military posture that favours strengthening offensive capabilities over defensive capabilities, Iran is a prime example of this.

On the defensive side, the US has been dealing with offensive cyber action and cyber-enabled espionage from Iran, North Korea, China, and Russia for more than 15 years. NATO members such as the United Kingdom (UK), France, Canada, and Germany have grown to deal with similar threats—albeit within a smaller timeframe. To defend their economies and societies, these nations have spent billions in growing a cybersecurity industry and building defenses against offensive cyber operations.

Escalation in cyber conflict
Ironically, this conditioning: building capacity, developing resilience, and strengthening response times, has likely contributed to the intensification of cyber events that this author and Jason Healey, a Senior Research Scholar at Columbia SIPA, alluded to in December 2021.

Source: CCDCOE

Cyber events are now routinely crossing thresholds that would have been viewed as increasingly risky 20 years ago. The result is that offensive cyber operations are now manageable for countries such as the US but are now catastrophic for smaller countries that are thrust into the cyber conflict space. The potential scale of this effect likely makes smaller countries ideal targets for sophisticated actors looking to demonstrate their capabilities. Iran appears to have stronger evidence on Israel’s role in the ‘Predatory Sparrow’ campaign (the two countries have been exchanging attacks for years) but opted to attack Albania’s government for harbouring the MeK—using the disruptive incident to send a message to Iran’s enemies.

This incident is chilling because it shows the spread of sophisticated cyber capabilities, and the growing intent to conduct such operations. Most theories around cyber conflict have kept the US as a key player in such conflicts—‘Predatory Sparrow’ and Iran’s response have shown that this is outdated.

The result is that offensive cyber operations are now manageable for countries such as the US but are now catastrophic for smaller countries that are thrust into the cyber conflict space.

The US does continue to play a tremendous role in how cyberspace is shaped. Over several years, it has taken great strides in developing its cyber policy and responses, both domestically and internationally. The US government was first to support Albania’s diplomatic decision against Iran, was quick to sanction Iranian officials over the incident, and US firms and law enforcement have been involved in the initial incident response and capacity development. However, the US continues to make cyberspace an increasingly ‘quintuply dangerous’ area of conflict with its 2018 National Cyber Strategy.

The US’ military has an inherently offence-oriented posture with its ‘Persistent Engagement’ strategy and ‘Hunt Forward’ operations continuing to escalate tensions within cyberspace. These actions are achieved by infiltrating and confronting adversaries within their own networks. These operations can be conducted using networks belonging to the US’ allies (with and without consent) which could mislead counter-cyber operations.

Whether intentional or not, the US’ policies serve as a benchmark which are subsequently modified for individual countries. For adversaries, these policies are intended to confuse and confound any hope of attribution. This pushes adversaries to look for smaller, less cyber-capable countries that can be made an example of. Such efforts are only making cyberspace more dangerous.

VIRPRATAP VIKRAM SINGH – orfonline

Following a cyberattack on its IT system, Albania accused Iran and cut all diplomatic ties. In the background, the conflict over the hosting of anti-ayatollah Iranian movement MEK

On September 7, Albanian Prime Minister Edi Rama announced in a video message his government’s decision to cut off, effective immediately, the diplomatic relations with the Islamic Republic of Iran, accusing Tehran of being the author of a massive cyberattack which hit the digital infrastructure of the Balkan country on July 15.

Albania– Iran: broken relations and cyberwarfare

According to the head of the government the breach was carried out by four Iran-affiliated groups and was unsuccessful. Its objectives were to paralyse Albania’s digital public services, steal data, and take possession of governmental communications. Minister for Europe and Foreign Affairs Olta Xhaçka declared that Tirana decided to sever diplomatic relations after consultations with US and EU allies. Iranian diplomats left the country in the following hours.

To conduct the investigation on the breach, Albania hired American cybersecurity company Mandiant and Microsoft, which found out that the hackers undermined around 10% of Albania’s governmental digital network and have had access to the system since May 2021. NATO, USA, EU, and Great Britain officially supported Tirana after the strike, which was followed by another cyber-attack on the customs border patrol’s computer system on September 10, always to be blamed on Tehran according to Albania’s government. The Balkan country has entered in a climate of hybrid warfare (as happened with Estonia in 2007), paying the price for being a NATO member and a main ally of America’s foreign policy and its interests.

Officially denying any responsibility for this wave of cyber-violations, Tehran pins the breakdown of relations with Albania on a Washington-designed “plot”, mentioning the hosting by Tirana of the exiled Iranian organisation Mujahedeen El-Khalq (Mek ), counting 3,000 members and at the core of the tensions between Tirana and Tehran.

Mek

The organisation’s mission is to overthrow Teheran’s theocratic government. Founded in Iran in 1965 to oppose the policies of the Pahlavi dynasty’s last emperor and operating in an internal political context defined by Islamist-Marxist ideology, anti-capitalism, and anti-Americanism, MEK took part in the insurrection that brought to power the ayatollah Khomeini (1979). Advocating for the separation between state and church, the group clashed with the theological republic installed in Tehran, becoming the target of violence, judicial persecutions, and execution of its members. The repression forced the group’s leaders to take refuge in Paris and accept relocation to Iraq in return for militarily supporting Baghdad’s war against Iran (1980–1988). MEK took the shape of a secret organisation, which obliged its members to practice celibacy, while its unsuccessful anti-Iranian military struggle continued even after the Baghdad–Tehran armistice. In 1991, the organisation contributed to Saddam Hussein’s successful effort to crush the Kurdish rebellion that had broken out at the end of the Gulf War in Northern Iraq. Identified by the US Department of State as the author of the assassination of 6 American citizens in Iran in the 70’s, MEK was designated as a “Foreign Terrorist Organization” (FTO) by Washington. EU, Canada, Japan, and Great Britain followed suit and added the group into their list of terrorists. The US disarmed the group after the outbreak of the Iraq War in 2003 and listed its members as “protected persons” under the 1949 Geneva Convention, later having the movement removed from the FTO list. MEK’s internal “restyling” in this period included its official abandonment of the use of violence. Iran’s rising influence in Baghdad, after the formation of a Shia-led filo-Tehran government, forced the US to search a sanctuary outside the Middle East for the group that had become the target of armed attacks. After Romania’s refusal to give them shelter – as asked by the UN on humanitarian grounds, Albania stepped up – a new NATO member at the time and very close US ally since the 1990s – to heed America’s request. In 2006, Albania had already taken in the Chinese Uighurs that had been detained in Guantanamo and again last year it accepted to host Afghan civilians (many of which were US collaborators) fleeing Kabul after the Taliban’s return to power.

The USA expressed gratitude for this UN coordinated accommodation. However giving shelter to a group posing as a future government-in-exile and promoting cyber-propaganda and annual rallies calling for the overthrow of the ayatollahs automatically placed Tirana in a diplomatic conflict with Iran. The expulsion of Middle Eastern diplomats, detection of anti-MEK planned attacks, and exchanges of accusations between both countries’ highest authorities have preceded the current escalation.

Trump, Iran, and Albania

After the relaxation of relations between Iran and the West in the late stage of Obama’s presidency and the resumption of economic activities on oil trade, Tehran and the USA clashed again during Trump’s term. The tycoon unilaterally withdrew Washington from the JCPOA (Joint Comprehensive Plan of Action) designed to limit Iran’s nuclear enrichment program, resumed the sanctions policy against Tehran and ordered the execution of Qasem Soleimani, leader of Islamic Revolutionary Guard Corps.

In this context, Trump’s administration saw MEK as a leverage to exert pressure on the ayatollahs’ regime to weaken it, inducing Tehran to renounce plans of regional hegemony in the Middle East and activities against US allies Saudi Arabia and Israel. In Albania, all major political forces consider it fruitful accommodating MEK, well aware that the USA is the only reliable ally on overall security. Apart from verbally condemning the cyberwarfare against Albania, Washington has recently sanctioned Iran’s Ministry of Intelligence and Security (MOIS) and its minister Esmail Khatib for “malign cyber activities”, while National Security Advisor Jake Sullivan called Edi Rama to express America’s solidarity after the cyberattack.

Sanctions on MOIS and Khatib will remain symbolic due to the fact that the ministry and its responsible person do not possess assets in the USA liable to be seized, but their consequences on attempts between Iran and the West to resume talks on JCPOA are huge. Tehran’s cyberwarfare on a NATO country calls into question the Middle Eastern country’s willingness to reach a new worthwhile agreement on its nuclear programme for both counterparts. On the one hand, Western European countries, which are involved in the talks, need to normalise relations with Iran in order to purchase its natural gas (17% of world reserves are located there) after facing hardships with Russian supply due to the Ukrainian War; on the other hand, the Islamic Republic needs revenues in order to bring technological improvements to the domestic market of this form of energy.

Gjergji Kajana – Balcanicaucaso