Cyber-Attack by Hackers Disrupt Iranian Railway System

On Saturday 10th of July, just after a cyber interruption in IRNA’s computing devices, the official IRNA media outlet announced that Iran’s Transport and Urbanization Ministry websites were out of operation. 

A day earlier, on Friday 9th of July, Iranian railways seemed to have been cyber-attacked, involving posts on notice boards at stations around the country concerning supposed train delays and cancellations. Tracking trains electronically throughout Iran is claimed to have been unsuccessful. 

The attackers published “long-delayed because of cyberattack” and “canceled” remarks on the display boards. They further appealed to the passengers to request information and also listed the telephone number of – Ayatollah Ali Khamenei, the country’s supreme leader. 

The Fars media outlet claimed that the intrusion resulted in “unprecedented chaos” at railway stations. Although Iran’s national railway company denied the claims of being hit by a cyberattack, on Saturday 10th of July.

It seems that at least a month earlier, the intruders had accessed the system. In the first report, hundreds of railroad activities were retarded or canceled, with thousands of passengers being stuck. 

The Iranian national railroad website was not operational, although whether the administration or the hackers took it down is still unclear. 

Likewise, attackers had previously controlled announcements at two airports and placed anti-government advertisements, further it was also not evident whether a message posted on the station notification board was from officials or was put by hackers. 

According to Iran International, “The number might belong either to the office of President Hassan Rouhani or Supreme Leader Ali Khamenei. It is not clear if hackers have posted the information or the authorities.” 

Additionally, the newspaper comments that Iran “periodically becomes a target of hackers from other countries, particularly Israel.” 

Israel is primarily responsible for a blackout at Iran’s Natanz atomic plant in April 2021– particularly in the Israeli media. Nothing has been done by Israel or Iran to combat such vital Middle East infrastructure attacks. 

The potential of state participation is established by the absence of any evident financial motive – indicating either a state or an activist’s objective. 

Iran International revealed additional information on the rail attack on Sunday 16th of July 2021 from “an information security officer at the presidential administration.” The attackers entered the system at the beginning of June and had prepared the payload from late June itself. 

After access had been acquired by the attackers, the loading protocols and user passwords start to be altered. Perhaps it barred administrators from remotely accessing the system and deactivated retrieval systems. 

In recent times, Iran has indeed been the source and objective of cyber-attacks – some of which are probably state-sponsored, impeding its efforts to produce nuclear fuel.