"Avenge Khamenei in Our Stead" – Pro-Iran Hackers Spread Threats, Boosting Expectations for Korean Cybersecurity in the Middle East

[Financial News] Tensions are rising in the Middle East as pro-Islamic Republic of Iran hackers repeatedly declare cyberattacks following recent military clashes between the United States of America (US), the State of Israel and the Islamic Republic of Iran. These so-called "hacktivists," who target security systems for political purposes, have been posting on the dark web that they attacked government agencies, financial institutions and industrial targets in the region. The Middle East is undergoing rapid digital transformation and is densely packed with military and energy infrastructure, so demand for cybersecurity is already growing. With the current standoff expected to continue, observers say demand for Korean security companies operating in the Middle East is also likely to increase.
On the 4th, the AhnLab Security Intelligence Center (ASEC) reported, based on its monitoring of the dark web and Telegram Messenger, that activity by pro-Islamic Republic of Iran hacking groups has surged since the US airstrike on Tehran. Their targets include government agencies in the Middle East, the financial sector, airports, industrial control systems (ICS) and payment platforms.
A group calling itself "FAD Team" announced on its Telegram Messenger channel that the six member states of the Gulf Cooperation Council (GCC), including the State of Qatar, the Kingdom of Saudi Arabia (KSA) and Jordan, are on its target list. The group also claimed it had infiltrated the control systems of wind power generation facilities in the State of Israel and several Middle Eastern countries, securing access rights as an act of revenge for the death of Iran’s Supreme Leader Ali Hosseini Khamenei. Another group, "313 Team," declared that the State of Israel, Jordan, the United States of America (US) and the Kingdom of Saudi Arabia (KSA) are among its targets, asserting that it temporarily disabled the Jordan Government Official Portal. Such hacktivist attack claims are flooding online channels.
Hacktivists have previously carried out attacks on key infrastructure in Middle Eastern countries. According to the report "Iran Advanced Persistent Threat (APT) Groups and Hacktivist Trends" provided by AhnLab TIP (Threat Intelligence Platform), an Advanced Persistent Threat (APT) group conducted a large-scale Distributed Denial-of-Service (DDoS) attack against 46 US banks between 2011 and 2013. In 2020, they attempted to seize control of the Programmable Logic Controller (PLC) systems of the State of Israel’s water supply network. After the Gaza War broke out in 2023, they have continued combined operations against Israeli government agencies and companies, mixing hacking, ransomware and propaganda campaigns.
For Korean security companies that have entered the Middle East, this situation could present an opportunity. In 2024, AhnLab partnered with a Saudi Arabian security company called Site to establish a joint venture named Rakeen. AhnLab is supplying endpoint and network security product lines through this venture and plans to expand its business into other parts of the Middle East. Genians, which opened a local office in Dubai the same year, secured a Saudi public institution as the first customer for its Endpoint Detection and Response (EDR) solution. In terms of customer numbers, the Middle East now accounts for the largest share of its business. RaonSecure is in talks to supply solutions such as Decentralized Identity (DID) to clients in the region.
AhnLab Security Intelligence Center (ASEC) analyzed, "There is a possibility that 'hybrid warfare,' in which cyber disruption is used to confuse communications and command systems before launching military attacks, will become the norm," adding, "Cyber activities such as hacking and the spread of deepfake videos are also expected to continue increasing." Another security industry official noted, "If the current war further heightens tensions, demand for security solutions could expand even more over the mid to long term."
kaya@fnnews.com Reporter Choi Hye-rim Reporter