Iran’s support of Russia draws attention of pro-Ukraine hackers

Pro-Ukraine hacktivists were in a bad mood on New Year's Day.

The previous day, Ukrainian air defense forces shot down a total of 45 drones — many of them supplied by Iran — but missile explosions rocked Kyiv and other population centers as much of the world was ringing in the new year.

In response, pro-Ukraine hacktivists claimed to launch distributed denial-of-service attacks on several Iranian websites, including the website of Iran's supreme leader Ali Khamenei, and the National Iranian Oil Company (NIOC).

“Iranians, it is not your war, step down and fuck off,” one group of pro-Ukrainian hackers and cybersecurity specialists wrote on Telegram.

Usually, DDoS attacks carried out by hacktivists last minutes to hours and have no real impact on the targeted services. The attacks flood victim websites with fake traffic, making them temporarily unreachable. Neither NIOC nor Iran’s leadership have confirmed the alleged cyberattacks on their systems, though the country said it has stopped similar attacks in recent days.

This doesn't bother Ukrainian hacktivists — they said they will continue launching attacks until Iran stops supplying Russia with drones. “Each bombardment will be punished with a cyberattack on your critical infrastructure,” the pro-Ukraine hackers wrote. “We cooperate with the international community and know where your weaknesses are.”

On Jan. 6, Iran said it stopped a wave of DDoS attacks on its central bank and domestic messaging apps — Rubika and Bale.

"These days, the largest volume of foreign attacks is against banks and financial institutions, internet providers, and communications infrastructures, which have been repelled," Amir Mohammadzadeh Lajevardi, head of Iran’s Infrastructure Communications Company, told state-controlled news agency IRNA.

It is not yet clear who is behind these attacks and whether they are linked to the attacks on NIOC and Iran’s government websites. 

Iran has become a popular target for hacktivists following anti-government protests sparked by the death in police custody of 22-year-old Mahsa Amini, who was arrested for "improperly" wearing her hijab.

Anonymous and other hacking groups have claimed cyberattacks on Iranian government services and private companies that support the regime.

Iran Airlines online services have stopped working properly due to my attack.

This is a form of attack on the Iranian government and companies, which support the regime.#TangoDown #OpIran #MashaAmini #Anonymous #Iran #IranProtests2022

Fuck you Iran Goverment! pic.twitter.com/E7452S64HW

— rootkitsecurity (@rootkit_sec) December 30, 2022

Earlier in September, Anonymous took responsibility for cyberattacks on Iran’s central bank and the Ministry of Culture. The hackers also claimed to have hacked other Iranian state agencies but didn’t provide any evidence.