U.S. imposes sanctions on Iran over cyber activities, cyberattack on Albania

In this Feb. 25, 2015 file photo, the Homeland Security Department headquarters in northwest Washington. An advisory issued by officials in the United States, United Kingdom and Australia warns that hackers linked to the Iranian government have been targeting a broad range of victims inside the U.S. with ransomware and other malicious cyber activity. (AP Photo/Manuel Balce Ceneta, File)

WASHINGTON — The United States imposed sanctions on Friday on Iran's Ministry of Intelligence and its minister, accusing them of being tied to a disruptive July cyberattack on Albania and engaging in other cyber activities against the United States and its allies.

The move comes after Albania severed diplomatic relations with Iran on Wednesday for the incident, ordering Iranian diplomats and embassy staff to leave within 24 hours.

The U.S. Treasury Department said in a statement that Iran's Ministry of Intelligence directs several networks of cyber threat actors, including those involved in cyber espionage and ransomware attacks in support of the Iranian government.

"We will not tolerate Iran’s increasingly aggressive cyber activities," Treasury undersecretary for Terrorism and Financial Intelligence Brian Nelson said in the statement.

The ministry was already designated under U.S. sanctions.

Iran has disregarded "norms of responsible peacetime state behaviour in cyberspace," U.S. Secretary of State Antony Blinken added in a statement.

Iran rejected the sanctions as ineffective and politically motivated.

"Like previous illegal U.S. sanctions against the Ministry of Intelligence, this new label will never be able to create the slightest hinder in the determination of the Iranian people's security servicemen in this proud institution," Iran's Foreign Ministry Spokesperson Nasser Kanaani said.

"The announcement of immediate U.S. support for the Albanian government's false accusation against Iran ... clearly shows that it is the U.S. government that has designed this scenario against Iran," Iranian state media quoted Kanaani as saying.

Microsoft, whose cybersecurity research team helped investigate the incident, said in a blog post https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government on Thursday that the Iranian cyber operation involved a combination of digital espionage techniques, data wiping malware and online information operations. The goal of the hackers, according to researchers, appeared to be to embarrass Albanian government officials.

The July attacks temporarily disrupted government websites and other public services. Analysts say the operation was intended to punish Albania for supporting an Iranian dissident group based in the country, known as the Mujahedin-e Khalq.

(Reporting by Daphne Psaledakis and Chris Bing in Washington; additional reporting by Michelle Nichols at the United Nations and Dubai newsroom; editing by Jonathan Oatis, Chizu Nomiyama and Raju Gopalakrishnan)