The U.S. on Monday, Aug. 24, sanctioned nearly 60 Iran-linked people, companies and vessels as part of a broader campaign targeting the country's oil revenues, cyber operations and other financial networks.
- Among them was a hacking group that the Treasury Department says was directed by Iran's Ministry of Intelligence and Security, or MOIS, and had compromised U.S. companies, government offices and critical infrastructure.
- The sanctions identified several crypto wallets belonging to members of the group, including Iranian hacker Keyvan Fayyaz Ghareh Blagh.
Those newly disclosed addresses gave blockchain analytics firm Chainalysis a closer look at how Blagh was allegedly using crypto outside the group's intelligence-linked operations.
And the trail appears to lead to ransomware.
Chainalysis said in a Tuesday blog post, Aug. 25, that one of the addresses sanctioned on Monday had directly received a ransomware payment, while its broader analysis indicated that Blagh had carried out ransomware attacks himself. Neither detail was disclosed in the Treasury announcement.
Ransom payment tied to sanctioned Iran-linked hacker crypto wallet. Source: Chainalysis
- The firm also found that one of Blagh's wallets received about $2,000 in bitcoin from a Russian-speaking initial access broker, a type of cybercriminal that sells access to already-compromised computer systems.
- Chainalysis said the transaction raises the possibility that Blagh may have "resold access from MOIS-directed intrusions to underground cybercriminals and pocketed the profits."
Crypto trail points beyond intelligence operations
Blagh also sent crypto to at least two bulletproof hosting providers, according to Chainalysis. Such services provide servers designed to remain online despite abuse complaints and are frequently used to host infrastructure for cybercrime.
The findings add a financially motivated element to activity that U.S. authorities have largely described as hacking carried out for or alongside the Iranian government.
Treasury itself said that while some of the group's intrusions were directed by MOIS, members also acted in their own interests and may have profited personally.
- The sanctions came less than a week after the Justice Department unsealed an updated indictment against 17 Iranian cyber actors, including Blagh, over hacking campaigns connected to the Iran-based Mabna Institute.
- Prosecutors allege the broader operation targeted universities, companies and government organizations, stealing credentials, research and other data.
- Blagh and several others were also accused of participating in attacks against private companies and government targets for financial gain. The charges remain allegations.