Port of Bandar Abbas

Summary

A cyber attack targeted private operating systems at the Port of Bandar Abbas, causing limited damage to computers but failing to breach the main port authority's infrastructure. Iranian officials initially denied the incident amid operational disruptions but later acknowledged it as foreign-originated, without attributing blame to specific actors. The disclosure followed media scrutiny linked to an unrelated naval friendly fire tragedy that fueled conspiracy theories, compelling authorities to clarify the cyber incident's scope and separation from the military mishap.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early May 2020, Iranian officials disclosed a cyber-attack targeting the Port of Shahid Rajaei in Bandar Abbas, a strategic facility located near the Strait of Hormuz. The incident occurred on or around May 8, coinciding with reports of disrupted port operations on Friday, though local Ports and Maritime Organization (PMO) officials in Hormozgan province initially denied any operational irregularities. By Sunday, May 10, central government authorities acknowledged the cyber-attack amid mounting media scrutiny, partly driven by an unrelated military accident in the same region. That weekend, an Iranian navy support vessel, Konarak, had been struck by friendly fire during an exercise, resulting in 19 fatalities and 15 injuries. Speculation linking the cyber-attack to the naval incident compelled Tehran to issue an official statement to dispel conspiracy theories.

According to Mohammad Rastad, Iran’s Deputy Minister of Roads and Urban Development, the cyber-attack failed to compromise core PMO infrastructure but infiltrated and damaged a limited number of privately operated computer systems at the port. Rastad attributed the attack to foreign actors but did not identify specific perpetrators or distinguish between state-sponsored and criminal groups. The disclosure marked Iran’s second public claim of thwarting a foreign cyber-attack, following June 2019 reports of unsuccessful U.S. cyber operations against Iranian missile systems after a U.S. drone was shot down. No technical details about the attack vector, malware, or remediation efforts were provided by Iranian authorities. The incident highlighted ongoing tensions in the region but caused no confirmed physical disruptions to port operations beyond localized IT damage.

Sources

Sources available to members: 2 sources.