Iran hit by global cyber attack that left US flag on screens

Hackers have attacked networks in a number of countries including data centres in Iran where they left the image of a USflag on screens along with a warning: "Don't mess with our elections", the Iranian IT ministry said on Saturday.

A number of Iranian websites were reportedly “down” for several hours following the Friday night attack.

"The attack apparently affected 200,000 router switches across the world in a widespread attack, including 3,500 switches in our country," the Communication and Information Technology Ministry said in a statement carried by Iran's official news agency IRNA.

Add WION as a Preferred Source

The statement said the attack, which hit internet service providers and cut off web access for subscribers, was made possible by a vulnerability in routers from Cisco which had earlier issued a warning and provided a patch that some firms had failed to install over the Iranian new year holiday.

A blog published on Thursday by Nick Biasini, a threat researcher at Cisco's Talos Security Intelligence and Research Group, said: "Several incidents in multiple countries, including some specifically targeting critical infrastructure, have involved the misuse of the Smart Install protocol...

"As a result, we are taking an active stance, and are urging customers, again, of the elevated risk and available remediation paths."

On Saturday evening, Cisco said those postings were a tool to help clients identify weaknesses and repel a cyber attack.

Iran's IT Minister Mohammad Javad Azari-Jahromi posted a picture of a computer screen on Twitter with the image of the USflag and the hackers' message. He said it was not yet clear who had carried out the attack.

“Several Iranian data centers came under cyber attacks tonight. Some of the smaller routers have been changed to factory setting,” he wrote.

Azari-Jahromi said the attack mainly affected Europe, India and the United States, state television reported.

"Some 55,000 devices were affected in the United States and 14,000 in China, and Iran's share of affected devices was 2 percent," Azari-Jahromi was quoted as saying.

Later, in another tweet, Jahromi claimed that MAHER, Persian acronym for the Computer-related Events Operation and Coordination Center, “Has monitored and controlled the attack and the data centers’ settings have been brought back to normal.”

One day after the cyber-attack, Jahromi said that MAHER should have issued a “special warning.” He promised that his ministry would investigate and deal with the failure.

MAHER announced on Saturday, “Major companies and data centers including Afra Net, Asia Tech, Shuttle, Pars Online and Respina have resumed their normal operations.”

Hadi Sajadi, deputy head of the state-run Information Technology Organisation of Iran, said the attack was neutralised within hours and no data was lost.