Albania cuts diplomatic ties with Iran over July cyberattack

Albania cuts diplomatic ties with Iran over July cyberattack

AP NEWS- Sept 7th 2022

By :LLAZAR SEMINI

TIRANA, Albania (AP) — Albania cut diplomatic ties with Iran and expelled the country’s embassy staff over a major cyberattack nearly two months ago that was allegedly carried out by Tehran on Albanian government websites, the prime minister said Wednesday.

The move by Albania, a NATO country, was the first known case of a country cutting diplomatic relations over a cyberattack.

The White House vowed unspecified retaliation Wednesday against Iran for what it called “a troubling precedent for cyberspace.”

In a statement, the White House said it has had experts on the ground for weeks helping Albania and had concluded Iran was behind the “reckless and irresponsible” attack and subsequent hack-and-leak operation.

The government’s decision was formally delivered to the Iranian Embassy in Tirana, the capital, in an official note, Prime Minister Edi Rama said. All embassy staff, including diplomatic and security personnel, were ordered to leave Albania within 24 hours.

On July 15, a cyberattack temporarily shut down numerous Albanian government digital services and websites.

Rama said an investigation determined that the cyberattack wasn’t carried out by individuals or independent groups, calling it “state aggression.”

“The deep investigation put at our disposal undeniable evidence that the cyberattack against our country was orchestrated and sponsored by the Islamic Republic of Iran which had involved four groups for the attack on Albania,” Rama said in a video statement.

Tirana said it was working with Microsoft and the FBI in an investigation into the cyberattack.

Mandiant, a leading U.S. cybersecurity firm, expressed “moderate confidence” last month that the attackers were acting in support of Tehran’s anti-dissident efforts.

A group calling itself “HomeLand Justice” claimed credit for the cyberattack that used ransomware to scramble data. Ransomware is best known for its use in for-profit criminal extortion, but is being increasingly wielded for political ends, particularly by Iran.

The claim by “HomeLand Justice” came on a Telegram channel in which documents purported to be Albanian residence permits of members of the Iranian opposition group Mujahedeen-e-Khalq group — best known as MEK — were posted, along with video of the ransomware being activated. The channel alleged corruption in the Albanian government and used hashtags including #Manez.