Albania on Saturday accused Iran of launching a second cyberattack a day after the United States (US) Treasury Department sanctioned Iran’s intelligence ministry for a similar attack on Albania’s digital infrastructure back in July.
The Albanian Interior Ministry said one of its border systems, knowns as TIMS, was targeted by a cyberattack. “Preliminary results show the attack was committed by the same hand,” the ministry said, referring to the attack on Albanian government servers in July.
TIMS, or Total Information Management System, is a border system installed by Albania to automatically record details of entries and exits made at the border crossing.
“Another cyberattack by the same aggressors was recorded last night on the TIMS system,” Prime Minister Edi Rama tweeted. Rama said the attack, which aimed to disrupt TIMS, failed in its objective as the system incurred no damage. “We continue to work around the clock with our allies to make our digital systems impenetrable,” he noted.
We strongly condemn the September 9 cyberattack against our @NATO Ally Albania, which follows Iran's July 15 cyberattack. We will continue to work alongside Albania and with other Allies and partners to strengthen cyber defenses and hold malicious actors accountable.
— Ned Price (@StateDeptSpox) September 11, 2022
The attack on TIMS was launched a day after the US Treasury Department imposed sanctions on the Iranian Ministry of Intelligence and Security (MOIS) and Intelligence Minister Esmail Khatib for directing. The Department said the MOIS, under the leadership of Khatib, “directs several networks of cyber threat actors involved in cyber espionage and ransomware attacks in support of Iran’s political goals.”
It accused “cyber threat actors” sponsored by the MOIS of launching the July cyberattacks against Albanian government computer systems, which forced the government to shut down online public services. “We will not tolerate Iran’s increasingly aggressive cyber activities targeting the United States or our allies and partners,” the Treasury underscored.
Last Wednesday, Albania severed all diplomatic ties with Iran after an investigative report blamed “cyber terrorists” backed by Iran for launching the July attack. PM Rama asked all Iranian diplomats and embassy staff to leave the country within 24 hours. “This extreme response, one that is unwanted but totally forced on us, is fully proportionate to the gravity and risk of the cyberattack” that threatened to “stir chaos and insecurity,” he said.
Albania’s move is the first instance of a country cutting diplomatic relations over a cyberattack. A day after Iranian diplomats vacated the premises, Albanian security forces forcibly entered the embassy and cordoned off the compound.
2/2 Iran continues to pose a clear and present threat to peace and stability of the ME region and the entire world.
— Israel Foreign Ministry (@IsraelMFA) September 8, 2022
The Iranian Foreign Ministry has denied that Tehran was behind either of the cyberattacks. On Sunday, foreign ministry spokesperson Nasser Kanaani condemned the US’ decision to impose sanctions on Iran, saying it “clearly indicate that the mastermind of this scenario is not the Albanian government but the US administration.”
It added that the sanctions were based on “hollow and unproven” allegations and said “Tirana has fallen victim to the scenario devised by Washington” against Tehran. “For years, America has imposed the hosting of a marked terrorist cult on the Albanian government and nation and provided it with all-out support besides training and arming it in the field of cyberspace,” Kanaani said. He was referring to the Mujaheddin-e-Khalq (MEK), a dissident political-military organisation that claims to fight for a “free and democratic” Iran by overthrowing the Islamic regime.
The cyberattack occurred on July 15 after Albanian authorities allowed the Iranian opposition group MEK to conduct an event in Tirana. Authorities cancelled the programme after MEK organisers received multiple threats from unidentified sources.
Iran and Albania have had tense relations since 2014 when Tirana provided refuge to over 3,000 MEK members. Albania has previously accused Iran of launching cyberattacks targeting MEK events. It also expelled four Iranian diplomats in two separate incidents in 2018 and 2020 for threatening national security.