Russian hackers cloak attacks using Iranian group

Iranian hackers became unwitting dupes for Russian attacks

An Iranian hacking group was itself hacked by a Russian group to spy on multiple countries, UK and US intelligence agencies have revealed.

The Iranian group - codenamed OilRig - had its operations compromised by a Russian-based group known as Turla.

The Russians piggybacked on the Iranian group to target other victims.

A National Cyber Security Centre (NCSC) investigation, begun in 2017 into an attack on a UK academic institution, uncovered the double-dealing.

Crowded space

The NCSC discovered that the attack on the institution had been carried out by the Russian Turla group, which it realised was scanning for capabilities and tools used by Iran-based OilRig.

In an investigation that lasted months, it became clear the Russian group had targeted the Iranian-based group and then used its tools and access to collect data and compromise further systems.

Attacks were discovered against more than 35 countries with the majority of the victims being in the Middle East. At least 20 were successfully compromised. The ambition was to steal secrets, and documents were taken from a number of targets, including governments.

Intelligence agencies said Turla was both getting hold of information the Iranians were stealing but also running their own operations using Iranian access and then hoping it would hide their tracks.

Microsoft has said Iranian hackers were behind a series of attacks carried out in 2017

Victims might have assumed they had been compromised by the Iranian-based group when in fact the real culprit was based in Russia.

There is no evidence that Iran was complicit or aware of the Russians' use of their access or that the activity was done to foment trouble between countries but is a sign of the increasingly complex world of cyber-operations.

"This is getting to be a very crowded space," explained Paul Chichester, director of operations for the NCSC, the protective arm of the intelligence agency GCHQ.

He adding he had not previously seen such a sophisticated attack carried out. Separately it has been reported in leaks that the US and UK also have similar capabilities.

Mr Chichester said he would not describe the Russian hack attacks as a "false flag" since it was not an attempt to deliberately frame someone else.

The NCSC would also not directly attribute the attacks to the Russian and Iranian states but Turla has previously been linked by others to Russia's Security Service, the FSB, and OilRig to the Iranian state.

'We can identify them'

The investigation was primarily a UK one but the details are being revealed jointly by the NCSC and America's NSA. A report of Turla compromising another espionage group was made by the private security company Symantec in June.

Mr Chichester said the purpose of revealing the details was to help others detect this activity and defend themselves.

"We want to send a clear message that even when cyber-actors seek to mask their identity, our capabilities are a match for them and we can identify them," he said.

How the two groups will react to the exposure is not something officials said they could predict.