AP Exclusive: Iran hackers hunt nuclear workers, US targets

4 hrs ago Main suspect in Strasbourg attack killed in gun battle with police US military sends $331M bill to Saudis, UAE after 'accounting error'

© The Associated Press Certfa researchers Nariman Gharib, left, and Amin Sabeti look at a computer at a cafe in London on Friday, Dec. 7, 2018. The Associated Press drew on data gathered by the London-based cybersecurity group Certfa to track how a hacking group often nicknamed Charming Kitten spent the past month trying to break into the private emails of more than a dozen U.S. Treasury officials. Also on the hackers’ hit list: high-profile defenders, detractors and enforcers of the nuclear deal struck between Washington and Tehran, as well as Arab atomic scientists, Iranian civil society figures and D.C. think tank employees. (AP Photo/Raphael Satter)

LONDON — As U.S. President Donald Trump re-imposed harsh economic sanctions on Iran last month, hackers scrambled to break into personal emails of American officials tasked with enforcing them, The Associated Press has found — another sign of how deeply cyberespionage is embedded into the fabric of US-Iranian relations.

The AP drew on data gathered by the London-based cybersecurity group Certfa to track how a hacking group often nicknamed Charming Kitten spent the past month trying to break into the private emails of more than a dozen U.S. Treasury officials. Also on the hackers' hit list: high-profile defenders, detractors and enforcers of the nuclear deal struck between Washington and Tehran, as well as Arab atomic scientists, Iranian civil society figures and D.C. think tank employees.

"Presumably, some of this is about figuring out what is going on with sanctions," said Frederick Kagan, a scholar at the American Enterprise Institute who has written about Iranian cyberespionage and was among those targeted.

Kagan said he was alarmed by the targeting of foreign nuclear experts.

"This is a little more worrisome than I would have expected," he said.

The hit list surfaced after Charming Kitten mistakenly left one of its servers open to the internet last month. Researchers at Certfa found the server and extracted a list of 77 Gmail and Yahoo addresses targeted by the hackers that they handed to the AP for further analysis. Although those addresses likely represent only a fraction of the hackers' overall effort — and it's not clear how many of the accounts were successfully compromised — they still provide considerable insight into Tehran's espionage priorities.

"The targets are very specific," Certfa researcher Nariman Gharib said.

In a report published Thursday , Cerfta tied the hackers to the Iranian government, a judgment drawn in part on operational blunders, including a couple of cases where the hackers appeared to have accidentally revealed that they were operating from computers inside Iran. The assessment was backed by others who have tracked Charming Kitten. Allison Wikoff, a researcher with Atlanta-based Secureworks, recognized some of the digital infrastructure in Certfa's report and said the hackers' past operations left little doubt they were government-backed.

"It's fairly clear-cut," she said.