A Russian-based group Turla has reportedly hacked an Iranian hacking group codenamed OilRig with the aim to spy on a good number of countries, according to UK and US intelligence.
The Russians piggybacked on the Iranian group to target other victims.
A National Cyber Security Centre (NCSC) investigation, begun in 2017 into an attack on a UK academic institution, uncovered the double-dealing.
According to the BBC, the NCSC discovered that the attack on the institution had been carried out by the Russian Turla group, which it realized was scanning for capabilities and tools used by Iran-based OilRig.
In an investigation that lasted months, it became clear the Russian group had targeted the Iranian-based group and then used its tools and access to collect data and compromise further systems.
More than 35 countries with a majority in the Middle East were attacked. The aim was to steal secrets, and documents were taken from a number of targets, including governments.
Intelligence agencies said Turla was both getting hold of information the Iranians were stealing but also running their own operations using Iranian access and then hoping it would hide their tracks.
Victims might have assumed they had been compromised by the Iranian-based group when in fact the real culprit was based in Russia.
There is no evidence that Iran was complicit or aware of the Russians’ use of their access or that the activity was done to foment trouble between countries but is a sign of the increasingly complex world of cyber-operations.
Paul Chichester, director of operations for the NCSC, the protective arm of the intelligence agency GCHQ explained, “This is getting to be a very crowded space.”
Adding he said he had not previously seen such a sophisticated attack carried out. Separately it has been reported in leaks that the US and UK also have similar capabilities.
Mr. Chichester said he would not describe the Russian hack attacks as a “false flag” since it was not an attempt to deliberately frame someone else.
The NCSC would also not directly attribute the attacks to the Russian and Iranian states but Turla has previously been linked by others to Russia’s Security Service, the FSB, and OilRig to the Iranian state.
The investigation was primarily a UK one but the details are being revealed jointly by the NCSC and America’s NSA. A report of Turla compromising another espionage group was made by the private security company Symantec in June.
Mr. Chichester said the purpose of revealing the details was to help others detect this activity and defend themselves.
“We want to send a clear message that even when cyber-actors seek to mask their identity, our capabilities are a match for them and we can identify them,” he said.
How the two groups will react to the exposure is not something officials said they could predict.
