Holland recalls Iran ambassador after Tehran expels Dutch diplomats

March 6, 2019 by Leave a comment

Holland embassy IranHolland said on Monday that it had recalled its ambassador from Tehran after Iran expelled two Dutch diplomats, in a deepening dispute involving the assassination of two Dutch citizens by alleged Iranian agents. In July of last year, Holland announced its decision to expel two Iranian diplomats from The Hague, but did not explain the reason for the expulsions. In January of this year, the Dutch Foreign Ministry confirmed that the diplomatic expulsions were in retaliation to the assassination of two Dutch nationals of Iranian background. One of the victims, Mohammad-Reza Kolahi, was shot dead in the head at point-blank range by two assailants in December 2015 in Almere, a coastal town 25 miles east of Amsterdam. Nearly two years later, in November 2017, another man, Ahmad Mola Nissi, was shot in the head in broad daylight in The Hague. Both men were members of Iranian militant anti-government groups that the Iranian state accuses of terrorism and crimes against the state.

On Monday, the Dutch Minister of Foreign Affairs Stef Blok informed the Dutch House of Representatives in The Hague that Tehran had informed his Ministry on February 20 that two Dutch diplomats would be expelled from Holland’s embassy in the Iranian capital. The two diplomats, who have not been named, were ordered to leave the country by Monday, March 4. Later on Monday, Bahram Ghasemi, spokesman for the Iranian Ministry of Foreign Affairs, confirmed that “two of the diplomats of the Netherlands embassy in Tehran were considered undesirable elements in the framework of a retaliatory measure and were asked to leave the country”. The Iranian move was not made public until last Monday. Blok wrote to the House of Representatives that, in response to Tehran’s move, the Dutch government had decided to recall its ambassador to Iran “for consultations” on how to proceed. Blok noted in his letter that Iran’s decision to expel the Dutch diplomats was “unacceptable and damaging to the bilateral relations between the two countries”.

Late on Monday, the Dutch government also summoned the Iranian ambassador in order to protest the expulsions of its diplomats from Tehran. It was also reported in the Dutch media that a series of financial sanctions imposed on Iran by Holland and its European Union partners in June —presumably over the alleged assassinations that took place on Dutch soil— would remain in place. The sanctions are against two individuals associated with Iranian military intelligence.

► Author: Joseph Fitsanakis | Date: 06 March 2019 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , ,

FBI seeks arrest of US counterintelligence officer who defected to Iran

February 14, 2019 by 1 Comment

Monica WittAn American intelligence officer, who held the highest level of security clearance for over a decade, defected to Iran in 2012 and has been spying against the United States ever since, it was revealed yesterday. Monica Witt, 39, was a counterintelligence officer for the United States Air Force from 1997 until 2008, specializing in the Middle East. Throughout her career, she was deployed by the US military to the Middle East on several occasions, in order to carry out counterintelligence missions the details of which remain classified to this day.

According to the US government, one of these missions involved her attendance of an international conference organized by New Horizon Organization. The group is believed to operate as a public relations arm of the Quds Force —the intelligence and paramilitary wing of Iran’s Islamic Revolutionary Guards, whose mission is to spread the ideals of the Islamic Revolution around the world. Witt’s mission was allegedly to monitor the conference proceedings and collect information on attendees. It was while attending that conference that, according to US government documents, Witt started to become attracted to the Iranian government’s world view. She left the US Air Force in 2008 and moved to Central Asia, initially teaching English in Afghanistan and later in Tajikistan. A year later, she vanished. She allegedly reemerged in Iran in 2013, where she appeared on several television programs in which she renounced United States policy on the Middle East and publicly espoused Shi’a Islam. According to the Federal Bureau of Investigation, soon after she defected to Iran, Witt used social media to identify and then compile lists of the whereabouts of several of her colleagues in US Air Force counterintelligence. She then gave this information to the Iranian intelligence services, which used it to launch a series of operations targeting current and former US intelligence personnel.

At a press conference held yesterday in Washington, DC, officials from the FBI, the Department of State and the Department of Treasury announced criminal charges against Witt and New Horizon Organization, which they accused of conducting espionage against the US. They also announced charges against employees of the Iranian-registered Net Peygard Samavat Company, which they said used Witt’s information to launch targeted information operations against American government personnel. Witt remains at large and is believed to reside in Iran.

► Author: Joseph Fitsanakis | Date: 14 February 2019 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , ,

FBI releases new information on alleged Iranian deep-cover spies

January 15, 2019 by 1 Comment

MEK supporters CaliforniaThe United States Federal Bureau of Investigation has charged two men of Iranian descent, who were arrested in California, of operating as deep-cover spies for Iran. Documents filed in a federal court in Washington, DC, name the men as Majid Ghorbani, 59, and Ahmadreza Mohammadi Doostdar, 38. Both have American citizenship and were arrested by the FBI in August, following a year-long counterintelligence investigation. The Los Angeles Times reports that Ghorbani is believed to have immigrated to the US from Iran in 1995. For the past two decades he has worked as a waiter at an upscale Persian restaurant in Santa Ana. Doostdar was born in the southern Californian city of Long Beach, but eventually moved with his family to Canada, and later to Iran, where he grew up. But he kept his US citizenship and made regular trips to America. It is believed that he planned to eventually move with his family to California.

According to the FBI, the two men were tasked by Iranian intelligence with carrying out surveillance on Jewish religious, cultural and political facilities in the US. They were also tasked with conducting surveillance and compiling reports of diplomatic and other facilities connected to the state of Israel. Another part of their mission, said the FBI, was collecting information on the activities and individual members of Mujahideen-e Khalq (MEK), a militant group that has roots in radical Islam and Marxism. The MEK initially supported the Islamic Revolution of 1979, but later withdrew its support, accusing the government of Ayatollah Khomeini of “fascism”. It continued its operations in exile, mainly from Iraq, where its armed members were trained by the Palestine Liberation Organization and other Arab leftist groups. Until 2009, the European Union and the US officially considered the MEK a terrorist organization. But the group’s sworn hatred against the government in Iran brought it close to Washington after the 2003 US invasion of Iraq. By 2006, the US military was openly collaborating with MEK forces in Iraq, and in 2012 the group was dropped from the US Department of State’s list of foreign terrorist organizations. Today the group enjoys open protection from the EU and the US.

Documents filed in court by the FBI state that the two men were secretly recorded during a year-long counterintelligence operation, as they traveled throughout the US to observe MEK rallies and gather intelligence or Israeli diplomatic facilities. Locations visited by the two men allegedly include Chicago, New York and Washington, as well as several cities in the American West Coast. During those visits, they would compile reports that, according to the FBI, were meant to “enable an intelligence or military unit find [and] neutralize a threat”. The men also traveled back to Iran through third countries, bringing back written operational instructions from their Iranian intelligence handlers, according to the FBI documents. IntelNews wrote about the arrest of the two men in August. However, this is the first concrete information released by the FBI about their identities and activities. They are both accused of acting as unregistered agents of a foreign government —a technical term for deep-cover espionage.

► Author: Joseph Fitsanakis | Date: 15 January 2019 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , ,

Holland says Iranian spies assassinated two men on Dutch soil

January 9, 2019 by 2 Comments

Dutch Police HagueAuthorities in Holland have officially accused Iran of ordering the contract murders of two men on Dutch soil in 2015 and 2017, one of them just a block away from the Dutch foreign ministry’s headquarters. The announcement illuminates the reason behind the expulsion of two Iranian diplomats from Holland last year, which the authorities did not explain at the time.

The first of the two assassinations happened on December 15, 2015, in Almere, a coastal town located 25 miles east of Amsterdam. The victim was Mohammad-Reza Kolahi, a 56-year-old electrician who was wanted in Iran for allegedly planting a bomb in 1981. The bomb targeted the headquarters of the ruling Islamic Republican Party, killing more than 70, and is often referred to as the deadliest domestic terrorist attack in Iran’s history. Kolahi, a member of a Marxist-Islamist group calling itself the People’s Mujahedin Organization of Iran (MEK), fled the country and was sentenced to death in absentia. He eventually married a Dutch national and acquired Dutch citizenship, changing his name to Ali Motamed. He was reportedly shot in the head at point-blank range by two assailants dressed in all black. Nearly two years later, on November 9, 2017, Ahmad Mola Nissi was also shot in the head in broad daylight by two assailants. The murder took place in the middle of the street in downtown Hague, site of Holland’s parliament and a host of international institutions. Nissi, 52, was a co-founder of the Arab Struggle Movement for the Liberation of Ahwaz (ASMLA), a secessionist group that seeks an independent Arab homeland in the oil-rich southwestern regions of Iran. Tehran has claimed for decades that both groups, MEK and ASMLA, have been supported by Iraq, Israel, the United States and the European Union.

On Tuesday, Holland’s Minister of Foreign Affairs, Stef Blok, informed the Dutch parliament that the country’s intelligence services had provided “strong evidence” that the Islamic Republic was involved in the assassinations of Kolahi and Nissi. He added that both men were Dutch citizens and that their murders on Dutch soil were “hostile actions” that directly violated Dutch sovereignty. He also revealed that the expulsions of two Iranian diplomats from Holland in June of last year were in direct response to the evidence unearthed by the Dutch intelligence services about the two murders. IntelNews readers will recall that the Dutch Foreign Ministry did not explain the reason for the expulsions when these were announced last summer. Also on Tuesday, the European Union announced the imposition of financial sanctions against two individuals associated with Iranian military intelligence, reportedly in response to Holland’s announcement.

► Author: Joseph Fitsanakis | Date: 09 January 2019 | Research credit: M.K. | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , , ,

CIA suffered ‘catastrophic’ compromise of its spy communication system

November 5, 2018 by 4 Comments

CIAThe United States Central Intelligence Agency suffered a “catastrophic” compromise of the system it uses to communicate with spies, which caused the death of “dozens of people around the world” according to sources. This is alleged in a major report published on Friday by Yahoo News, which cites “conversations with eleven former US intelligence and government officials directly familiar with the matter”. The report by the online news service describes the compromise of an Internet-based covert platform used by the CIA to facilitate the clandestine communication between CIA officers and their sources —known as agents or spies— around the world.

According to Yahoo News, the online communication system had been developed in the years after 9/11 by the US Intelligence Community for use in warzones in the Middle East and Central Asia. It was eventually adopted for extensive use by the CIA, which saw it as a practical method for exchanging sensitive information between CIA case officers and their assets in so-called ‘denied areas’. The term refers to regions of the world where face-to-face communication between CIA case officers and their assets is difficult and dangerous due to the presence of ultra-hostile intelligence services or non-state adversaries like the Taliban or al-Qaeda. However, it appears that the system was flawed: it was too elementary to withstand sustained scrutiny by Internet-savvy counterintelligence experts working for state actors like Iran, China or Russia.

In September of 2009, Washington made a series of impressively detailed revelations about the advanced status of Iran’s nuclear program. These angered Tehran, which redoubled its efforts to stop the US and others from acquiring intelligence information about the status of its nuclear program. Some sources told Yahoo News that one of the CIA assets inside Iran’s nuclear program was convinced by the Iranians to become a double spy. He proceeded to give Tehran crucial information about the CIA’s online communication system. Based on these initial clues, the Iranians allegedly used Google-based techniques “that one official described as rudimentary” to identify an entire network of CIA-maintained websites that were used to communicate with assets in Iran and elsewhere. The Iranians then kept tabs on these websites and located their users in order to gradually unravel an entire network of CIA agents inside their country. Around that time, Iranian media announced that the Islamic Republic’s counterintelligence agencies had broken up an extensive CIA spy ring consisting of more than 30 informants.

The Yahoo News report says that the CIA was able to successfully exfiltrate some of its assets from Iran before the authorities were able to apprehend them. The agency also had to recall a number of undercover officers, after they were identified by the Iranians. The effects of the compromise, however, persisted on a global scale, according to former US intelligence officials. In 2011 and 2012, another network of CIA spies was busted in China, leading to the arrest and execution of as many as three dozen assets working for the US. Many, says Yahoo News, believe that the Iranians coached the Chinese on how to use the CIA’s online communication system to identify clandestine methods and sources used by the agency.

Along with other specialist websites, IntelNews monitored these developments as they took place separately in Iran and China. However, the Yahoo News report is the first to piece together these seemingly disparate developments and suggest that they were likely triggered by the same root cause. What is more, the report suggests that the CIA had been warned about the potential shortcomings of its online communication system before 2009, when the first penetrations began to occur. In response to the compromise, the CIA has reportedly modified, and at times completely abandoned, its online communication system. However, the implications of the system’s compromise continue to “unwind worldwide” and the CIA is “still dealing with the fallout”, according to sources. The effects on the agency’s operational work are likely to persist for years, said Yahoo News.

► Author: Joseph Fitsanakis | Date: 05 November 2018 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , ,

Denmark recalls its envoy from Tehran, accuses Iran of assassination plot

October 30, 2018 by Leave a comment

Finn Borch AndersenThe Danish government has recalled its ambassador from Iran and has accused the intelligence services of the Islamic Republic of plotting an assassination operation on Danish soil. Danish government officials also said that Copenhagen would seek to impose further economic and diplomatic sanctions on Tehran, in coordination with the European Union. The accusations against Iran were leveled during an emergency news conference in the Danish capital on Tuesday, led by Anders Samuelsen, Denmark’s Minister of Foreign Affairs, and Finn Borch Andersen (pictured), Director of the Danish Security and Intelligence Service, known as PET.

The two men said that “an Iranian intelligence agency” had planned “an attack on Danish soil”, which  Defense Minister Samuelsen condemned as “completely unacceptable”. PET Director Andersen said that a Norwegian national of Iranian background had been arrested in Sweden on October 21, and was now in custody awaiting extradition to Denmark. The arrestee is an employee of Iranian intelligence, said Andersen, and had been observed conducting surveillance against a Danish-based leading member of an Iranian separatist group. The alleged target is a member of the Arab Struggle Movement for the Liberation of Ahvaz (ASMLA), a hardline separatist group campaigning for a separate homeland for Iran’s Arab minority. Approximately 2 percent of Iranians (around 1.5 million people) belong to the country’s ethnic Arab population. Most of them are concentrated in Khuzestan, a region in Iran’s oil-rich southwest, which borders neighboring Iraq. Some of these ethnic Arabs seek autonomy from Tehran, which they see as an alien regime. ASMLA represents the militant wing of Iran’s separatist Arab community and has a history of staging terrorist attacks inside Iran. Last September, the group claimed it was behind an armed attack on a military parade in the city of Ahvaz —a major urban center in Iran’s Arab-speaking region— which killed 24 people, including some women and children. Later, however, a representative of the group retracted the claim.

On Tuesday, several Iranian officials issued strong denials of the Danish government’s allegations. Speaking in Tehran, Iranian Foreign Ministry Spokesman Bahram Qassemi dismissed Denmark’s claims as “spiteful”. He added that the timing of reports linking Iran to assassination operations on European soil were suspect and described them as “a plot by [Iran’s] enemies to damage Tehran’s growing relations with European countries”. Earlier this month, France seized the financial assets of individuals whom it described as Iranian spies, after blaming Tehran for a foiled bomb attack in Paris. The move followed the arrest of six people in France, Germany and Belgium, who allegedly planned to bomb the annual conference of the National Council of Resistance of Iran (NCRI) last June. The NCRI is led by Mujahedin-e Khalq (MEK), a militant group with roots in radical Islam and Marxism, which Iran sees as a terrorist organization.

► Author: Joseph Fitsanakis | Date: 31 October 2018 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , ,

Iran has clandestine missile factories in Lebanon, claims Israel’s ex-spy chief

October 22, 2018 by Leave a comment

Amos YadlinThe government of Iran is smuggling parts for ballistic missiles to Lebanon, where they are secretly assembled in clandestine factories operated by the Shiite militant group Hezbollah, according to Israel’s former spy chief. For several months now, the international news agency Reuters has been claiming that Tehran has transported short-range ballistic missiles to secret bases controlled by pro-Iranian militias in Iraq. Iran’s move was aimed at “deterring attacks on [Iran’s] interests in the Middle East and to give it the means to it reginal foes”, said Reuters, citing “Iranian, Iraqi and Western sources”. Both Iran and Iraq denied the Reuters report.

In September, another report, citing “Western intelligence sources”, said that Iran had begun smuggling parts of short-range ballistic missiles to Hezbollah-controlled areas of Lebanon, using commercial flights. The report pointed to at least two flights that are suspected by Western intelligence agencies of having illegally transported precision weapon parts to Lebanon. Both flights were operated by Qeshm Fars Air, a company believed to be used by Iran’s Islamic Revolutionary Guard Corps (IRGC). Members of the IRGC, arguably the most loyal branch of the Iranian military, are selected on the basis of their ideological commitment to the defense of the 1979 Islamic Revolution. The two flights identified in the report departed from commercial and military airports in Tehran and landed in Lebanon after taking “uncharacteristic flight paths” through Syria, said Western intelligence sources.

On Sunday, Israel’s highest-circulation newspaper, Yedioth Ahronoth, carried an interview with the former director of the Jewish state’s Military Intelligence Directorate, Major General (ret.) Amos Yadlin. Yadlin, who also served as Israel’s military attaché in Washington, said that Iran used to hide ballistic missile parts in Syria, hoping to establish de facto missile bases there. However, Tehran’s plan suffered a major setback last May, said Yadlin, when Israel’s air force destroyed approximately 50 targets inside Syria, including —according to Yadlin— Iranian missile factories. Since then, he said, Tehran has been relocating its missile factories to Lebanon, believing that Israel will not attack its neighbor to the north. But Yadlin, who is a known supporter of left-of-center parties in Israel, and a proponent of the two-state solution to the Palestinian problem, argued that Israel should consider attacking Iran’s military factories in Lebanon. The Jewish state faces two choices, said Yadlin: “to strike [Lebanon], not necessarily by air”, or to allow Hezbollah to acquire precision missiles. “Israel will not accept this change”, he added.

► Author: Joseph Fitsanakis | Date: 22 October 2018 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

Suicide bomb threat reportedly leads to evacuation of Iranian envoy to Turkey

October 16, 2018 by Leave a comment

Iran embassy in AnkaraThere were conflicting reports yesterday in Ankara of an alleged evacuation of Iran’s ambassador to Turkey, following credible reports of a suicide bomb attack, possibly by the Islamic State. Several Turkish media outlets reported on Monday afternoon that authorities in Ankara had communicated an urgent intelligence warning to the Iranian embassy there of a possible suicide bomb attack. According to the reports, members of the Sunni militant group Islamic State of Iraq and Syria (ISIS) were behind the planned attack.

At 2 pm local time, reports stated that Iran’s ambassador to Turkey, Mohammad Ebrahim Taherian Fard, had been hurriedly evacuated from the Iranian embassy by Turkish security forces. By that time, all roads leading to the Iranian embassy, located next to the Ankara Hilton in one of the Turkish capital’s leafiest areas, had been cordoned off. Reporters from the Reuters news agency and Agence France Presse said that Turkish police and special forces had shut down Tahran Road, where the Iranian embassy is located, and were searching cars. Armed security forces had also surrounded the Iranian embassy, according to Reuters.

Strangely, however, reports of a possible bomb attack and of the ambassador’s evacuation were strongly refuted by the Iranian government, which denounced them as “sheer lies” and “complete fabrications”. In a statement published online on Monday afternoon, Iran’s Ministry of Foreign Affairs said that its diplomats in Ankara had noticed “an increased Turkish security presence” around the Iranian embassy. However, they continued working normally, as they were unaware of the reasons for the heightened security. They assumed that Turkish President Recep Tayyip Erdoğan was appearing nearby, said the statement. A statement by the Iranian embassy in Ankara said that consular employees were present at the embassy and that all scheduled services were being offered without interruption.

In the past month, the embassies of Iran in Paris and Athens have come under attack by Kurdish separatists and leftwing groups protesting against Tehran’s alleged oppression of ethnic minorities in the country. In the past, the Islamic Republic has been rarely targeted by ISIS, whose members dismiss Shiite Islam as a heresy. In June 2017, two attacks were carried out simultaneously in Tehran, targeting the Iranian parliament and the Mausoleum of Ruhollah Khomeini, founder of post-1979 Iran. In September of this year, ISIS claimed responsibility for an attack in Iran’s southwestern city of Ahvaz, which killed 25 soldiers and civilians during a military parade.

► Author: Joseph Fitsanakis | Date: 16 October 2018 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

France freezes assets of Iranian spies in response to foiled terror attack in Paris

October 4, 2018 by 2 Comments

French Ministry for the EconomyFrance has seized the financial assets of two Iranian spies and frozen all assets belonging to the Iranian Ministry of Intelligence, in response to a foiled bomb attack in Paris, which the French government has blamed on Tehran. The alleged bomb attack was uncovered on June 30 of this year, when members of Belgium’s Special Forces Group arrested a married Belgian couple of Iranian descent in Brussels. The couple were found to be carrying explosives and a detonator. On the following day, German police arrested an Iranian diplomat stationed in Iran’s embassy in Vienna, Austria, while another Iranian man was arrested by authorities in France, reportedly in connection with the three other arrests.

All four individuals were charged with a foiled plot to bomb the annual conference of the National Council of Resistance of Iran (NCRI) that took place on June 30 in Paris. The NCRI is led by Mujahedin-e Khalq (MEK), a militant group with roots in radical Islam and Marxism. The MEK was designated as a terrorist group by the European Union and the United States until 2009 and 2012 respectively. But it has since been reinstated in both Brussels and Washington, reportedly because it provides the West with a vehicle to subvert the Iranian government. France, Germany and Belgium allege that the aborted bombing plot was an attempt by Iran to disrupt the close relations between the MEK and Western governments.

On Tuesday, Paris announced the seizure of assets of two of the men who were arrested in June and July. One is an accredited Iranian diplomat identified as Assadollah Asadi, who is believed to be an official-cover intelligence officer. The other man is Saeid Hashemi Moghadam, who was arrested by French authorities. He is believed to be an Iranian sleeper agent. All assets belonging to the Islamic Republic’s Ministry of Intelligence were also been frozen, effective immediately, it was announced. In a joint statement, the French ministers of foreign affairs, economics and the interior said that the move reflected the France’s “commitment to fight terrorism, in all its manifestations […], especially on its territory”. The statement added that “the extremely heinous act envisaged on our territory could not go without a response”.

The Iranian government has denied all connection to the alleged plot in Paris and has dismissed the incident a “false flag” operation staged by MEK in cooperation with Tehran’s “enemies at home and abroad”.

► Author: Joseph Fitsanakis | Date: 04 October 2018 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , ,

Iran spied on ISIS supporters through fake phone wallpaper app, say researchers

September 14, 2018 by 1 Comment

Cell Phone - IASupporters of the Islamic State, most of them Persian speakers, were spied on by the government of Iran after they downloaded a fake smartphone application with wallpaper images, according to an online security firm. Iran is a major adversary of the radical Sunni group Islamic State. The latter considers Shiism (Iran’s state religion) as an abomination. Not surprisingly, therefore, the Islamic State, which is also known as the Islamic State of Iraq and Syria (ISIS), relies largely on supporters from the Arabic-speaking regions of the Levant. But according to estimates, Sunnis constitute about 10 percent of Iran’s population, and ISIS has found some fertile ground among Iran’s 8 million-strong Sunni minority. As a result, the government in Tehran is highly mistrustful of Iranian Sunnis, many of whom are ethnic Kurds, Baluchis, Azeris or Turkomans, and systematically spies on them.

According to the Israeli online security firm Check Point Software Technologies, one way in which Tehran has spied on Persian-speaking ISIS supporters is through fake smartphone applications. In an article published last week, the company said it had uncovered a state-sponsored surveillance operation that it had codenamed “Domestic Kitten”. The Check Point article said that the operation had gone on for more than two years, but had remained undetected “due to the artful deception of its attackers towards their targets”. The surveillance of targeted phones was carried out with the help of an application that featured pro-ISIS-themed wallpapers, which users could download on their devices. Yet another program linked to the same vendor was a fake version of the Firat News Agency mobile phone application. The Firat News Agency is a legitimate Iranian information service featuring news about Iran’s Kurdish minority. But both applications were in fact malware that gave a remote party full access to all text messages sent or received on the compromised phones. They also gave a remote party access to records of phone calls, Internet browser activity and bookmarks, and all files stored on the compromised phones. Additionally, the fake applications gave away the geo-location of compromised devices, and used their built-in cameras and microphones as surveillance devices.

Check Point said that the majority of compromised phones belonged to Persian-speaking members of Iran’s Kurdish and Turkoman minorities. The company stressed that it was not able to confirm the identity of the sponsoring party with absolute accuracy. However, the nature of the fake applications, the infrastructure of the surveillance operation, as well as the identities of those targeted, posed a strong possibility that “Domestic Kitten” was sponsored by the government of Iran, it concluded. Last July, the American cyber security firm Symantec said that it had uncovered a new cyber espionage group called “Leafminer”, which was allegedly sponsored by the Iranian state. The group had reportedly launched attacks on more than 800 agencies and organizations in in countries such as Israel, Egypt, Bahrain, Qatar, Kuwait, the United Arab Emirates, Afghanistan and Azerbaijan.

► Author: Ian Allen | Date: 14 September 2018 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , ,

US announces arrest of two men charged with spying for Iran

August 21, 2018 by 2 Comments

Mujahedin-e KhalqAuthorities in the United States have announced the arrests of two men who have been charged with spying on American soil on behalf of the Islamic Republic of Iran. The men were reportedly arrested on August 9, but information about them was only released on Monday by the US Department of Justice. In a press statement published online, John Demers, US Assistant Attorney General for National Security, said the men were arrested because of concerns that they “acted on behalf of Iran”. They were identified as Ahmadreza Mohammadi Doostdar, 38, and Majid Ghorbani, 59. Doostdar is reportedly a dual citizen of the US and Iran, while Ghorbani is an Iranian citizen who lives in the US state of California. The two men are not believed to be diplomats.

According to the US government, the men were observed “conducting surveillance of political opponents and engaging in other activities that could put Americans at risk”. The press statement alleges that Doostdar carried out surveillance of a Jewish center in Chicago, while Ghorbani attended meetings and rallies organized by Iranian opposition groups operating in the US. The press release identifies one such group as the Mujahideen-e Khalq (MEK), a militant faction that has roots in radical Islam and Marxism. Between 1970 and 1976, the group assassinated six American officials in Iran and in 1970 tried to kill the United States ambassador to the country. It initially supported the Islamic Revolution of 1979, but later withdrew its support, accusing the government of Ayatollah Khomeini of “fascism”. It continued its operations in exile, mainly from Iraq, where its armed members were trained by the Palestine Liberation Organization and other Arab leftist groups. Until 2009, the European Union and the US officially considered the MEK a terrorist organization. But the group’s sworn hatred against the government in Iran brought it close to Washington after the 2003 US invasion of Iraq. By 2006, the US military was openly collaborating with MEK forces in Iraq, and in 2012 the group was dropped from the US Department of State’s list of foreign terrorist organizations. Today the group enjoys open protection from the EU and the US.

On June 30 of this year, authorities in Belgium arrested a married Belgian couple of Iranian descent, who were found to be carrying explosives and a detonator. On the following day, July 1, German police arrested an Iranian diplomat stationed in Iran’s embassy in Vienna, Austria, while a fourth person was arrested by authorities in France, reportedly in connection with the three other arrests. All four individuals were charged with having planned a foiled plot to bomb the annual conference of the MEK-affiliated National Council of Resistance of Iran (NCRI) that took place on June 30 in Paris, France. It is not known whether the arrests in Europe are in any way connected with the cases of the two men held in the US.

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

Researchers uncover ‘ambitious’ Iranian hacker group that targets the Middle East

July 26, 2018 by 1 Comment

Computer hackingAn American cyber security firm has reported the discovery of a previously undetected, “highly active” Iranian cyber espionage group, whose extensive target list consists mainly of large organizations and companies in the Middle East. The cyber security firm Symantec, makers of Norton antivirus software, which uncovered the cyber espionage group’s existence, has dubbed it “Leafminer”. It said the group has been active since the beginning of 2017, but has “significantly ramped up its activities” in 2018 and is currently involved in dozens of ongoing attacks.

In a report published on Wednesday, Symantec said that its security experts managed to obtain what appears to be Leafminer’s master list of targets. The list is written in the Farsi language and contains just over 800 organizations, which according to Symantec researchers is “an ambitious goal” for any cyber espionage group. The organizations listed on the target sheet come from a variety of sectors, including government, transportation, the financial sector, energy and telecommunications. But the majority of the group’s targets appear to be in the petrochemical and government sectors. Additionally, virtually all of Leafminer’s targets are located in the Middle East and North Africa, in countries such as Israel, Egypt, Bahrain, Qatar, Kuwait and the United Arab Emirates. Some of the group’s targets are located in Afghanistan and Azerbaijan.

Symantec said its researchers observed the Leafminer hackers execute attacks in real time on at least 40 targets in the Middle East, including on the website of an intelligence agency in Lebanon. According to the cyber security company, Leafminer uses a variety of hacking tools, including custom-designed malware and some publicly available software. The group’s operational sophistication is also varied, and ranges from complex, multilayered attacks to brute-force login attempts. Symantec said it concluded that the cyber espionage group originates from Iran because its master target list is written in Farsi and because Iran is virtually the only country in the Middle East that is missing from the target list. However, it said that it did not have sufficient evidence to link Leafminer to the Iranian government. In a separate development, Germany’s domestic intelligence agency, the Federal Office for the Protection of the Constitution (BfV), said this week in its annual report that the government of Iran has significantly expanded its cyber warfare capabilities and “poses a danger to German companies and research institutions”.

► Author: Joseph Fitsanakis | Date: 26 July 2018 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

Iran warns of repercussions as US intensifies campaign against Tehran

July 23, 2018 by 1 Comment

IRGC IranIranian military officials have warned of extracting “revenge from foreign intelligence services”, as Reuters reported that an aggressive campaign against Tehran has been launched by Washington. On Sunday, the Reuters news agency said that senior officials in the administration of US President Donald Trump had launched a concerted offensive “meant to foment unrest” in the Islamic Republic. Citing information from “more than half a dozen current and former officials”, Reuters said that the US offensive is directly supported by President Trump’s Secretary of State Mike Pompeo and his National Security Adviser John Bolton. Both officials are known for their aggressive stance against the Iranian government.

The campaign, said Reuters, is meant to “work in concert” with President Trump’s push to “economically throttle Iran”. The US leader announced a series of economic sanctions on the Islamic Republic and has intensified his critical statements against Tehran after May of this year, when Washington pulled out of the Iran nuclear agreement. Known as the Joint Comprehensive Plan of Action (JCPOA), the international agreement was reached in 2015 between Iran and a group of nations known as the P5+1, namely the five permanent members of the United Nations Security Council plus Germany. As part of the deal, Iran agreed to halt its nuclear weapons program in exchange for an end to economic sanctions by the West. But President Trump abandoned the agreement, saying it was a form of appeasing Tehran.

According to Reuters, Washington’s campaign involves the spreading of information that “paints Iranian leaders in a harsh light” and in some cases makes claims about Tehran that are “exaggerated”. For example, said Reuters, some social media posts by the US Department of State’s Farsi-language news service claim that Iran is close to al-Qaeda, despite the fact that Shiite Islam, which is Iran’s state religion, is viewed as a heresy by Sunni members of al-Qaeda. Other –perhaps more believable– accusations include claims that the leaders of Iran are wasting funds released by the JCPOA instead of using it for their people’s welfare, and that Tehran funds the Taliban in Afghanistan.

Meanwhile, a spokesman for the Islamic Revolutionary Guard Corps (IRGC), arguably the most powerful branch of the Iranian Armed Forces, issued a warning on Sunday against “foreign intelligence services”. The spokesman, Brigadier General Ramezan Sharif, said Iran would take revenge on foreign spy services “who try to disrupt the security of Iran’s borders”. He was referring to an armed attack that took place on Saturday in Iran’s northwestern Marivan region, near the Iran-Iraq border. The attack concentrated on an Iranian military compound in the village of Dari and culminated with the bombing of an IRGC arms depot. According to Iranian media reports, the explosion killed 11 Iranian border guards. Reuters said it contacted the White House and the Department of State about the alleged campaign against Iran, but that both declined to comment.

► Author: Joseph Fitsanakis | Date: 23 July 2018 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , ,

Israel says it foiled Iranian-sponsored bomb attack in France

July 20, 2018 by Leave a comment

MossadIsrael helped foil an alleged Iranian-sponsored bomb attack in Paris, which involved arrests of several Iranian agents and at least one diplomat in France, Belgium and Germany, according to media reports. As intelNews reported earlier this month, the arrests began on June 30, when members of Belgium’s Special Forces Group arrested a married Belgian couple of Iranian descent in Brussels. The couple were found to be carrying explosives and a detonator. On the following day, July 1, German police arrested an Iranian diplomat stationed in Iran’s embassy in Vienna, Austria. On the same day, a fourth person, who has not been named, was arrested by authorities in France, reportedly in connection with the three other arrests.

All four individuals appear to have been charged with a foiled plot to bomb the annual conference of the National Council of Resistance of Iran (NCRI) that took place on June 30 in Paris. The NCRI is led by Mujahedin-e Khalq (MEK), a militant group with roots in radical Islam and Marxism. The MEK was designated as a terrorist group by the European Union and the United States until 2009 and 2012 respectively. But it has since been reinstated in both Brussels and Washington, reportedly because it provides the West with a vehicle to subvert the Iranian government.

On Thursday, authorities in Israel announced the lifting of a blanket censorship decree that prevented local media from discussing the country’s role in helping the Europeans foil the alleged bomb attack in Paris. According to Israel’s Channel 2, a private television station based in Jerusalem, the Iranian attack was prevented after the Israeli agency Mossad detected the whereabouts of several suspects involved in it. The Mossad then supplied Germany, Belgium and France with intelligence that led to the arrests of some of those suspects. However, Channel 2 said that the Israeli government did not give a reason for the initial censorship imposed on the country’s media, nor did it explain why it had decided to lift it. On July 4, Israeli Prime Minister Benjamin Netanyahu appeared to hint that Israel had a role in the foiling of the alleged bomb attack in Paris. Speaking during a commemoration ceremony in Acre, Israel, Netanyahu said it was “no coincidence” that the attack in Paris had been stopped. But the Israeli leader did not expressly indicate that the Mossad had a role in the operation.

Following news of the arrests in Europe, the Iranian government said that it had no connection to the alleged plot in Paris and called the incident a “false flag” operation staged by Tehran’s enemies at home and abroad.

► Author: Joseph Fitsanakis | Date: 20 July 2018 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , ,

Spy chiefs from Russia, China, Iran and Pakistan hold high-level meeting

July 11, 2018 by Leave a comment

Sergei NaryshkinIntelligence directors from Russia, China, Iran and Pakistan met on Tuesday to discuss regional cooperation with particular reference to combating the Islamic State in Afghanistan. Information about the high-level meeting was revealed yesterday by Sergei Ivanov, media spokesman for the Russian Foreign Intelligence Service (SVR). Ivanov told Russia’s state-owned TASS news agency that the meeting was held in Pakistan and included the participation of SVR director Sergei Naryshkin. TASS reported that the meeting was held under the auspices of Pakistan’s powerful Inter-Services Intelligence (ISI) Directorate and was attended by “senior intelligence officials” from Pakistan, Russia, Iran and China.

Ivanov said that discussions during the meeting “focused on the dangers arising from a buildup of the Islamic State on the Afghan territory”. The Islamic State announced the formation of its Afghan province (wilayah in Arabic) in January 2015, using the term “Khorasan Province”. By July 2016, two of its most prominent leaders had been killed in coordinated drone strikes by the United States, but the group continues to launch operations to this day. Its core is thought to be made up of nearly 100 fighters from the Islamic State’s former strongholds in Syria and Iraq. According to Russian reports, security officials in China, Russia, Pakistan and Iran are concerned that the Islamic State’s Afghan command is becoming stronger as fighters from the group are leaving the Middle East and moving to Afghanistan.

Tuesday’s high-level meeting in Islamabad follows an announcement last month by the Beijing-led Shanghai Cooperation Organization (SCO) that it would adopt a more active stance on security issues in Afghanistan. Early in June, Afghan President Mohammad Ashraf Ghani described the SCO as “an important platform for anti-terrorist cooperation and enhancing regional connectivity” in Central and South Asia. President Ghani made these comments shortly before traveling to China to attend the annual summit of the SCO, of which Afghanistan is an observer country.

► Author: Ian Allen | Date: 11 July 2018 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , ,

← Older posts

Newer posts →