Found 28 bookmarks
Newest
Targeting Iran’s Leaders, Israel Found a Weak Link: Their Bodyguards
Targeting Iran’s Leaders, Israel Found a Weak Link: Their Bodyguards
nytimes.com By Farnaz FassihiRonen Bergman and Mark Mazzetti 2025/08/30 Israel was able to track the movements of key Iranian figures and assassinate them during the 12-day war this spring by following the cellphones carried by members of their security forces. The meeting was so secret that only the attendees, a handful of top Iranian government officials and military commanders, knew the time and location. It was June 16, the fourth day of Iran’s war with Israel, and Iran’s Supreme National Security Council gathered for an emergency meeting in a bunker 100 feet below a mountain slope in the western part of Tehran. For days, a relentless Israeli bombing campaign had destroyed military, government and nuclear sites around Iran, and had decimated the top echelon of Iran’s military commanders and nuclear scientists. The officials, who included President Masoud Pezeshkian, the heads of the judiciary and the intelligence ministry and senior military commanders, arrived in separate cars. None of them carried mobile phones, knowing that Israeli intelligence could track them. Despite all the precautions, Israeli jets dropped six bombs on top of the bunker soon after the meeting began, targeting the two entrance and exit doors. Remarkably, nobody in the bunker was killed. When the leaders later made their way out of the bunker, they found the bodies of a few guards, killed by the blasts. The attack threw Iran’s intelligence apparatus into a tailspin, and soon enough Iranian officials discovered a devastating security lapse: The Israelis had been led to the meeting by hacking the phones of bodyguards who had accompanied the Iranian leaders to the site and waited outside. Israel’s tracking of the guards has not been previously reported. It was one part of a larger effort to penetrate the most tightly guarded circles of Iran’s security and intelligence apparatus that has had officials in Tehran chasing shadows for two months. According to Iranian and Israeli officials, Iranian security guards’ careless use of mobile phones over several years — including posting on social media — played a central role in allowing Israeli military intelligence to hunt Iranian nuclear scientists and military commanders and the Israeli Air Force to swoop in and kill them with missiles and bombs during the first week of the June war. “We know senior officials and commanders did not carry phones, but their interlocutors, security guards and drivers had phones; they did not take precautions seriously, and this is how most of them were traced,” said Sasan Karimi, who previously served as the deputy vice president for strategy in Iran’s current government and is now a political analyst and lecturer at Tehran University. The account of Israel’s strike on the meeting, and the details of how it tracked and targeted Iranian officials and commanders, is based on interviews with five senior Iranian officials, two members of the Islamic Revolutionary Guards Corps and nine Israeli military and intelligence officials. The security breakdowns with the bodyguards are just one component of what Iranian officials acknowledge has been a long-running and often successful effort by Israel to use spies and operatives placed around the country as well as technology against Iran, sometimes with devastating effect. Want to stay updated on what’s happening in Iran and Israel? , and we’ll send our latest coverage to your inbox. Following the most recent conflict, Iran remains focused on hunting down operatives that it fears remain present in the country and the government. “Infiltration has reached the highest echelons of our decision making,” Mostafa Hashemi Taba, a former vice president and minister, said in an interview with Iranian media in late June. This month Iran executed a nuclear scientist, Roozbeh Vadi, on allegations of spying for Israel and facilitating the assassination of another scientist. Three senior Iranian officials and a member of the Revolutionary Guards said Iran had quietly arrested or placed under house arrest dozens of people from the military, intelligence and government branches who were suspected of spying for Israel, some of them high-ranking. Israel has neither confirmed nor denied a connection to those so accused. Spy games between Iran and Israel have been a constant feature of a decades-long shadow war between the two countries, and Israel’s success in June in killing so many important Iranian security figures shows just how much Israel has gained the upper hand. President Masoud Pezeshkian of Iran attending a protest in Tehran on June 22, following the U.S. attacks on nuclear sites in Iran. Mr. Pezeshkian himself escaped an attack on a bunker on June 16. Credit... Arash Khamooshi for The New York Times Israel had been tracking senior Iranian nuclear scientists since the end of 2022 and had weighed killing them as early as last October but held off to avoid a clash with the Biden administration, Israeli officials said. From the end of last year until June, what the Israelis called a “decapitation team” reviewed the files of all the scientists in the Iranian nuclear project known to Israel, to decide which they would recommend to kill. The first list contained 400 names. That was reduced to 100, mainly based on material from an Iranian nuclear archive that the Mossad, the Israeli intelligence agency, had stolen from Iran in 2018. In the end, Iran said the Israelis focused on and killed 13 scientists. At the same time, Israel was building its capacity to target and kill senior Iranian military officials under a program called “Operation Red Wedding,” a play on a bloody “Game of Thrones” episode. Brig. Gen. Amir Ali Hajizadeh, the commander of the Revolutionary Guards’ Aerospace Force, was the first target, one Israeli official said. Ultimately, Israeli officials said, the basic idea in both operations was to locate 20 to 25 human targets in Iran and hit all of them in the opening strike of the campaign, on the assumption that they would be more careful afterward, making them much harder to hit. In a video interview with an Iranian journalist, the newly appointed head of the Revolutionary Guards Corps, Brig. Gen. Ahmad Vahidi, said that although Israel had human operatives and spies in the country, it had tracked senior officials and scientists and discovered the location of sensitive meetings mostly through advanced technology. “The enemy gets the majority of its intelligence through technology, satellites and electronic data,” General Vahidi said. “They can find people, get information, their voices, images and zoom in with precise satellites and find the locations.” From the Israeli side, Iran’s growing awareness of the threat to senior figures came to be seen as an opportunity. Fearing more assassinations on the ground of the sort that Israel had pulled off successfully in the past, the supreme Iranian leader, Ayatollah Ali Khamenei, ordered extensive security measures including large contingents of bodyguards and warned against the use of mobile phones and messaging apps like WhatsApp, which is commonly used in Iran. Those bodyguards, Israel discovered, were not only carrying cellphones but even posting from them on social media. “Using so many bodyguards is a weakness that we imposed on them, and we were able to take advantage of that,” one Israeli defense official said. Iranian officials had long suspected that Israel was tracking the movements of senior military commanders and nuclear scientists through their mobile phones. Last year, after Israel detonated bombs hidden inside thousands of pagers carried by Hezbollah operatives in Lebanon, Iran banned many of its officials in particularly sensitive jobs from using smartphones, social media and messaging apps. Smartphones are now completely off limits for senior military commanders, nuclear scientists and government officials. The protection of senior officials, military commanders and nuclear scientists is the responsibility of an elite brigade within the Revolutionary Guards called Ansar al-Mehdi. The commander in chief of Ansar, appointed last August after the new government came into office, is Gen. Mohamad Javad Assadi, one of the youngest senior commanders in the Guards. General Assadi had personally warned several senior commanders and a top nuclear scientist, Mohammad Mehdi Tehranchi, that Israel was planning to assassinate them at least a month before they were killed on the first day of the war, according to two senior Iranian officials with knowledge of the conversation. He had also called a meeting with the team leaders of security details asking them to take extra precautions, the officials said. The cellphone ban initially did not extend to the security guards protecting the officials, scientists and commanders. That changed after Israel’s wave of assassinations on the first day of the war. Guards are now supposed to carry only walkie-talkies. Only team leaders who do not travel with the officials can carry cellphones. But despite the new rules, according to officials who have held meetings with General Assadi about security, someone violated them and carried a phone to the National Security Council meeting, allowing the Israelis to carry out the pinpoint strike. Hamzeh Safavi, a political and military analyst whose father is the top military adviser to Ayatollah Khamenei, said that Israel’s technological superiority over Iran was an existential threat. He said Iran had no choice but to conduct a security shakedown, overhaul its protocols and make difficult decisions — including arrests and prosecution of high-level spies. “We must do whatever it takes to identify and address this threat; we have a major security and intelligence bug and nothing is more urgent than repairing this hole,” Mr. Safavi said in a telephone interview. Iran’s minister of intelligence said in a statement this month that it had foiled an Israeli assassination attempt on 23 senior officials...
·nytimes.com·
Targeting Iran’s Leaders, Israel Found a Weak Link: Their Bodyguards
MuddyWater’s DarkBit ransomware cracked for free data recovery
MuddyWater’s DarkBit ransomware cracked for free data recovery
bleepingcomputer.com - Cybersecurity firm Profero cracked the encryption of the DarkBit ransomware gang's encryptors, allowing them to recover a victim's files for free without paying a ransom. This occurred in 2023 during an incident response handled by Profero experts, who were brought in to investigate a ransomware attack on one of their clients, which had encrypted multiple VMware ESXi servers. The timing of the cyberattack suggests that it was in retaliation for the 2023 drone strikes in Iran that targeted an ammunition factory belonging to the Iranian Defence Ministry. In the ransomware attack, the threat actors claimed to be from DarkBit, who previously posed as pro-Iranian hacktivists, targeting educational institutes in Israel. The attackers included anti-Israel statements in their ransom notes, demanding ransom payments of 80 Bitcoin. Israel's National Cyber Command linked DarkBit attacks to the Iranian state-sponsored APT hacking group known as MuddyWater, who have a history of conducting cyberespionage attacks. In the case investigated by Profero, the attackers did not engage in ransom payment negotiations, but instead appeared to be more interested in causing operational disruption. Instead, the attackers launched an influence campaign to maximize reputational damage to the victim, which is a tactic associated with nation-state actors posing as hacktivists. Decrypting DarkBit At the time of the attack, no decryptor existed for DarkBit ransomware, so Profero researchers decided to analyze the malware for potential weaknesses. DarkBit uses a unique AES-128-CBC key and Initialization Vector (IV) generated at runtime for each file, encrypted with RSA-2048, and appended to the locked file. Profero found that the key generation method used by DarkBit is low entropy. When combined with the encryption timestamp, which can be inferred from file modification times, the total keyspace is reduced to a few billion possibilities. Moreover, they found that Virtual Machine Disk (VMDK) files on ESXi servers have known header bytes, so they only had to brute force the first 16 bytes to see if the header matched, instead of the entire file. Profero built a tool to try all possible seeds, generate candidate key/IV pairs, and check against VMDK headers, which they ran in a high-performance computing environment, recovering valid decryption keys. In parallel, the researchers discovered that much of the VMDK file content hadn't been impacted by DarkBit's intermittent encryption, as those files are sparse and many encrypted chunks fall onto empty space. This allowed them to retrieve significant amounts of valuable data without having to decrypt it by brute-forcing keys. "As we began to work on speeding up our brute force, one of our engineers/team members? had an interesting idea," explained Profero. "VMDK files are sparse, which means they are mostly empty, and therefore, the chunks encrypted by the ransomware in each file are also mostly empty. Statistically, most files contained within the VMDK filesystems won't be encrypted, and most files inside these file systems were anyways not relevant to us/our task/our investigation." "So, we realized we could walk the file system to extract what was left of the internal VMDK filesystems... and it worked! Most of the files we needed could simply be recovered without decryption."
·bleepingcomputer.com·
MuddyWater’s DarkBit ransomware cracked for free data recovery
Hacktivists' Claimed Breach of Nuclear Secrets Debunked
Hacktivists' Claimed Breach of Nuclear Secrets Debunked
Security experts are dismissing a pro-Iranian hacktivist group's claim to have breached Indian nuclear secrets in reprisal for the country's support of Israel. The LulzSec Black group last week claimed to have hacked "the company responsible for Indian nuclear reactors" and to have stolen 80 databases, of which it was now selling 17 databases containing 5.2 gigabytes of data. The group claimed the information detailed the precise location of India's nuclear reactors, numerous chemical laboratories, employee personally identifiable information, industrial and engineering information, precise details of guard shifts and "other sensitive data related to infrastructure." LulzSec Black, named after the notorious hacktivist collective that committed a string of high-profile hits in 2011, claims to be a group of "Palestinian hackers." Previous attacks tied to the group include disruptions targeting Israel, as well as countries that support Israel, including France and Cyprus. Threat intelligence firm Resecurity said the group's nuclear claims vary from being dramatically overstated to outright lies. "This activity is related to the 'pseudo-hacktivist' activities by Iran" designed to provoke fear, uncertainty and doubt, Resecurity told Information Security Media Group. "Many of their statements are overstatements, having no connection to reality. For example, they clearly do not have '80 databases' or even 5.2 GB of data." LulzSec Black's claims arrive amidst U.S. government alerts of the "heightened threat environment" facing critical infrastructure networks and operational technology environments, following Israel launching missile strikes against Iran on June 13 (see: Infrastructure Operators Leaving Control Systems Exposed). While the resulting regional war appears to now be moderated by a fragile ceasefire, many governments are still bracing for reprisals (see: Israel-Iran Ceasefire Holding Despite Fears of Cyberattacks). What LulzSec Black may actually possess is identity and contact information for nuclear specialists, likely stolen from third-party HR firms and recruitment websites such as the CATS Software applicant tracking system and recruitment software, Resecurity said. This can be seen in the long list of various job titles - "security auditor, heavy water unit," "nuclear engineer, analysis lab, tritium gas," and "radiation officer, fuel fabrication, uranium dioxide" - in a sample of dumped data. In that data, tags such as "Top Secret," appear, which Resecurity said likely either reflect clearances held by job candidates, or were added by the hackers themselves "so it will look like it is from some nuclear energy facility."
·databreachtoday.com·
Hacktivists' Claimed Breach of Nuclear Secrets Debunked