Treasury sanctions Iran’s intelligence ministry for alleged cyberattack on Albania

The Treasury Department sanctioned Iran’s intelligence ministry and its top intelligence official on Friday in response to a cyberattack the country allegedly launched on Albania in July. 

The Treasury’s Office of Foreign Assets Control designated Iran’s Ministry of Intelligence and Security (MOIS) and its minister of intelligence as engaging in cyber-enabled activities against the United States and its allies. 

The announcement comes two days after the White House National Security Council condemned Iran for conducting an “unprecedented” cyberattack that targeted Albanian government digital services and websites on July 15. 

Albanian Prime Minister Edi Rama said in a statement on Wednesday that an investigation concluded Iran was responsible for recruiting four groups that conducted the attack. He said Albania immediately cut diplomatic relations with Iran and ordered staff at the Iranian Embassy in Albania to leave the country. 

Albania is a U.S. ally as a member of NATO. 

“We will not tolerate Iran’s increasingly aggressive cyber activities targeting the United States or our allies and partners,” Brian Nelson, the under secretary of Treasury for terrorism and financial intelligence, said in the release. 

Nelson said the cyberattack disregards norms of “responsible” peacetime behavior of not damaging “critical infrastructure” that provides services to the public. 

Iran’s foreign ministry has denied responsibility for the cyberattack. 

The release states that the Iranian MOIS and its leader, Esmail Khatib, directed several networks of actors that pose threats in cyber espionage and ransomware attacks to advance Iran’s political goals. 

The sanctions mean that all property belonging to the MOIS and Khatib that are under U.S. jurisdiction are blocked and people in the U.S. are generally prevented from engaging in transactions with them. Any entities that are more than 50 percent owned by the MOIS are also blocked.