U.S. Treasury Sanctions Iranians Over Alleged Cyberattacks, Expands Iran Measures
Summary
The U.S. Treasury sanctioned Iranian individuals over alleged hacks and data theft from U.S. companies, and expanded potential secondary sanctions across five sectors. The article says links between the designees and water-facility attacks remain unclear.
Key points
- The Treasury said Iranian individuals linked to the Tehran-based Mabna Institute and MOIS-directed activity allegedly compromised and exfiltrated data from U.S. companies since at least late 2023.
- The alleged targets included energy, defense, healthcare, IT and financial organizations.
- Treasury also designated Arman Kahzadian over an alleged role in receiving or using stolen business information.
- The department expanded categories of Iran-related conduct that could trigger secondary sanctions and identified digital assets, technology, gold, aviation and shipping as targeted sectors.
- The article says the Treasury did not clarify whether the sanctioned individuals were involved in attacks on U.S. water facilities; Iranian culpability for those attacks was disputed.
Article Details
- Event Type
- U.S. Treasury sanctions against four Iranians accused of cyberattacks, plus a separate designation related to receiving or using stolen business information.
- Impact
- The Treasury Department said the four individuals had compromised and exfiltrated data from U.S. companies in energy, defense, healthcare, information technology, and financial sectors. The sanctions also expanded potential secondary sanctions and targeted five Iranian economic sectors. The article does not report a measured effect of the sanctions.
People
Arman KahzadianDesignated by the Treasury Department for his alleged role in receiving or using business information stolen through cyber-enabled means.Behzad MesriIdentified as another leader of the group carrying out MOIS-directed attacks; the article says he first faced sanctions in 2018.Keyvan Fayyaz Ghareh BlaghNamed by the Treasury Department as allegedly conducting hacks and compromising and exfiltrating data from U.S. companies.Mohammad Reza Kadkhoda’iNamed by the Treasury Department as allegedly conducting hacks and compromising and exfiltrating data from U.S. companies.Mojtaba Ghal’eh-KuhiNamed by the Treasury Department as allegedly conducting hacks; also described as one of the leaders of the group carrying out MOIS-directed attacks.Saber Shahbazi BalujehNamed by the Treasury Department as allegedly conducting hacks and compromising and exfiltrating data from U.S. companies.Scott BessentTreasury Secretary who announced the expanded sanctions.
Threat Actors
Behzad MesriDescribed as a leader of the group carrying out MOIS-directed attacks and as having faced sanctions in 2018.Keyvan Fayyaz Ghareh BlaghAccused by the Treasury Department of conducting hacks and compromising and exfiltrating data from U.S. companies.Mabna InstituteThe article says the sanctioned individuals were linked to the Tehran-based institute and describes the group of alleged hackers as affiliated with it.Mohammad Reza Kadkhoda’iAccused by the Treasury Department of conducting hacks and compromising and exfiltrating data from U.S. companies.MOISThe article describes the attacks as MOIS-directed.Mojtaba Ghal’eh-KuhiAccused of conducting hacks and described as a leader of the group carrying out MOIS-directed attacks.Saber Shahbazi BalujehAccused by the Treasury Department of conducting hacks and compromising and exfiltrating data from U.S. companies.
Countries
IranThe action targets individuals linked to the Tehran-based Mabna Institute and MOIS-directed operations, while expanding pressure on Iran’s economic sectors and cyber-enabled activities.United Statesfrom their alleged role in hacking critical infrastructure targets and waging cybertheft against the United States.
Industries
Defensecritical infrastructure and stealing data from multiple companies across sectors including energy, defense, healthcare, IT, and finance.Energycritical infrastructure and stealing data from multiple companies across sectors including energy, defense, healthcare, IT, and finance.financecritical infrastructure and stealing data from multiple companies across sectors including energy, defense, healthcare, IT, and finance.Healthcarecritical infrastructure and stealing data from multiple companies across sectors including energy, defense, healthcare, IT, and finance.Information Technologycompanies in various critical infrastructure sectors, including energy companies, defense contractors, healthcare institutions, information technology companies, and financial institutions,” the release states.