October 28, 2022 | CEEW Monograph The Dangers of Iran’s Cyber Ambitions October 28, 2022 | CEEW Monograph The Dangers of Iran’s Cyber Ambitions Introduction Tehran has not engaged in spectacular cyberattacks against the United States over the past four years — even after the Trump administration imposed devastating sanctions on Iran and launched a drone strike that killed Major General Qassem Soleimani, commander of the Islamic Revolutionary Guard Corps (IRGC) Quds Force.1 This is a puzzling departure from precedent and obscures the broader trend of Tehran’s improving cyber capabilities.In late 2019, for example, Microsoft warned that Iranian hackers were trying to breach industrial control systems (ICS) — that is, computer systems that control critical infrastructure — to conduct physically disruptive attacks in the United States.4 Other private security researchers cautioned that reconnaissance and espionage were equally likely motivations.5 Given the uncertainty, the United States cannot afford to dismiss the Iranian cyber threat.For example, in 2018, the Department of Justice charged the Iranian government with sponsoring a multi-year campaign to pilfer data from hundreds of universities, companies, and government entities in the United States and around the world.6 The following year, researchers discovered the same hackers using the same tactics and network infrastructure to target more than 60 universities in the United States.7 Iranian hackers have repeatedly caused damage despite their less sophisticated capabilities compared to America’s other cyber adversaries.For example, the Department of Justice indicted two Iranian hackers in September 2020 for a “coordinated cyber intrusion campaign — sometimes at the behest of the government of the Islamic Republic of Iran.” These hackers “brazenly infiltrated computer systems” around the world, explained then-U.S. Attorney for the District of New Jersey Craig Carpenito.For example, to prevent activists from organizing and sharing information, the regime has repeatedly throttled internet connectivity during protests.16 In November 2019, Tehran ordered internet service providers to disrupt internet access across the country as demonstrations against fuel price spikes spiraled into political protests against the regime.17 Similarly, Iran’s Khuzestan Province experienced internet disruptions in July 2021 during protests sparked by water shortages.18 In both cases, Tehran aimed to limit the ability of"