Iranian dissidents’ claim of presidential hack likely legitimate, experts say | CyberScoop<\/title> <meta name=\"description\" content=\"The hack and leak operation revealed Monday includes a trove of files related to Iranian President Ebrahim Raisi.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/iranian-dissidents-presidential-hack\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Iranian dissidents' claim of presidential hack likely legitimate, experts say\"> <meta property=\"og:description\" content=\"The hack and leak operation revealed Monday includes a trove of files related to Iranian President Ebrahim Raisi.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/iranian-dissidents-presidential-hack\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2023-05-31T20:36:49+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1280\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/cdn.parsely.com\">\n<link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-0\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1684764845g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress-next\/dist\/css\/related-posts-block-styles.min.css?m=1685722702g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-4\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1685981853g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=172264176d4de0f97962\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/74428\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<link rel=\"wlwmanifest\" type=\"application\/wlwmanifest+xml\" href=\"https:\/\/cyberscoop.com\/wp-includes\/wlwmanifest.xml\">\n<meta name=\"generator\" content=\"WordPress 6.2.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=74428\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Firanian-dissidents-presidential-hack%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Firanian-dissidents-presidential-hack%2F&format=xml\">\n<meta name=\"parsely-title\" content=\"Iranian dissidents\u2019 claim of presidential hack likely legitimate, experts say\"><br \/>\n<meta name=\"parsely-link\" content=\"http:\/\/cyberscoop.com\/iranian-dissidents-presidential-hack\/\"><br \/>\n<meta name=\"parsely-type\" content=\"post\"><br \/>\n<meta name=\"parsely-image-url\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg?w=150&h=150&crop=1\"><br \/>\n<meta name=\"parsely-pub-date\" content=\"2023-05-31T20:36:49Z\"><br \/>\n<meta name=\"parsely-section\" content=\"Geopolitics\"><br \/>\n<meta name=\"parsely-author\" content=\"AJ Vicens\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-74428 single-format-standard\" id=\"readabilityBody\"> <svg viewBox=\"0 0 0 0\" width=\"0\" height=\"0\" focusable=\"false\" role=\"none\"><defs><filter id=\"wp-duotone-dark-grayscale\"><feColorMatrix color-interpolation-filters=\"sRGB\" type=\"matrix\" values=\" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 \" \/><feComponentTransfer color-interpolation-filters=\"sRGB\"><feFuncR type=\"table\" tableValues=\"0 0.49803921568627\" \/><feFuncG type=\"table\" tableValues=\"0 0.49803921568627\" \/><feFuncB type=\"table\" tableValues=\"0 0.49803921568627\" \/><feFuncA type=\"table\" tableValues=\"1 1\" \/><\/feComponentTransfer><feComposite in2=\"SourceGraphic\" operator=\"in\" \/><\/filter><\/defs><\/svg><svg viewBox=\"0 0 0 0\" width=\"0\" height=\"0\" focusable=\"false\" role=\"none\"><defs><filter id=\"wp-duotone-grayscale\"><feColorMatrix color-interpolation-filters=\"sRGB\" type=\"matrix\" values=\" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 \" \/><feComponentTransfer color-interpolation-filters=\"sRGB\"><feFuncR type=\"table\" tableValues=\"0 1\" \/><feFuncG type=\"table\" tableValues=\"0 1\" \/><feFuncB type=\"table\" tableValues=\"0 1\" \/><feFuncA type=\"table\" tableValues=\"1 1\" \/><\/feComponentTransfer><feComposite in2=\"SourceGraphic\" operator=\"in\" \/><\/filter><\/defs><\/svg><svg viewBox=\"0 0 0 0\" width=\"0\" height=\"0\" focusable=\"false\" role=\"none\"><defs><filter id=\"wp-duotone-purple-yellow\"><feColorMatrix color-interpolation-filters=\"sRGB\" type=\"matrix\" values=\" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 \" \/><feComponentTransfer color-interpolation-filters=\"sRGB\"><feFuncR type=\"table\" tableValues=\"0.54901960784314 0.98823529411765\" \/><feFuncG type=\"table\" tableValues=\"0 1\" \/><feFuncB type=\"table\" tableValues=\"0.71764705882353 0.25490196078431\" \/><feFuncA type=\"table\" tableValues=\"1 1\" \/><\/feComponentTransfer><feComposite in2=\"SourceGraphic\" operator=\"in\" \/><\/filter><\/defs><\/svg><svg viewBox=\"0 0 0 0\" width=\"0\" height=\"0\" focusable=\"false\" role=\"none\"><defs><filter id=\"wp-duotone-blue-red\"><feColorMatrix color-interpolation-filters=\"sRGB\" type=\"matrix\" values=\" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 \" \/><feComponentTransfer color-interpolation-filters=\"sRGB\"><feFuncR type=\"table\" tableValues=\"0 1\" \/><feFuncG type=\"table\" tableValues=\"0 0.27843137254902\" \/><feFuncB type=\"table\" tableValues=\"0.5921568627451 0.27843137254902\" \/><feFuncA type=\"table\" tableValues=\"1 1\" \/><\/feComponentTransfer><feComposite in2=\"SourceGraphic\" operator=\"in\" \/><\/filter><\/defs><\/svg><svg viewBox=\"0 0 0 0\" width=\"0\" height=\"0\" focusable=\"false\" role=\"none\"><defs><filter id=\"wp-duotone-midnight\"><feColorMatrix color-interpolation-filters=\"sRGB\" type=\"matrix\" values=\" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 \" \/><feComponentTransfer color-interpolation-filters=\"sRGB\"><feFuncR type=\"table\" tableValues=\"0 0\" \/><feFuncG type=\"table\" tableValues=\"0 0.64705882352941\" \/><feFuncB type=\"table\" tableValues=\"0 1\" \/><feFuncA type=\"table\" tableValues=\"1 1\" \/><\/feComponentTransfer><feComposite in2=\"SourceGraphic\" operator=\"in\" \/><\/filter><\/defs><\/svg><svg viewBox=\"0 0 0 0\" width=\"0\" height=\"0\" focusable=\"false\" role=\"none\"><defs><filter id=\"wp-duotone-magenta-yellow\"><feColorMatrix color-interpolation-filters=\"sRGB\" type=\"matrix\" values=\" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 \" \/><feComponentTransfer color-interpolation-filters=\"sRGB\"><feFuncR type=\"table\" tableValues=\"0.78039215686275 1\" \/><feFuncG type=\"table\" tableValues=\"0 0.94901960784314\" \/><feFuncB type=\"table\" tableValues=\"0.35294117647059 0.47058823529412\" \/><feFuncA type=\"table\" tableValues=\"1 1\" \/><\/feComponentTransfer><feComposite in2=\"SourceGraphic\" operator=\"in\" \/><\/filter><\/defs><\/svg><svg viewBox=\"0 0 0 0\" width=\"0\" height=\"0\" focusable=\"false\" role=\"none\"><defs><filter id=\"wp-duotone-purple-green\"><feColorMatrix color-interpolation-filters=\"sRGB\" type=\"matrix\" values=\" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 \" \/><feComponentTransfer color-interpolation-filters=\"sRGB\"><feFuncR type=\"table\" tableValues=\"0.65098039215686 0.40392156862745\" \/><feFuncG type=\"table\" tableValues=\"0 1\" \/><feFuncB type=\"table\" tableValues=\"0.44705882352941 0.4\" \/><feFuncA type=\"table\" tableValues=\"1 1\" \/><\/feComponentTransfer><feComposite in2=\"SourceGraphic\" operator=\"in\" \/><\/filter><\/defs><\/svg><svg viewBox=\"0 0 0 0\" width=\"0\" height=\"0\" focusable=\"false\" role=\"none\"><defs><filter id=\"wp-duotone-blue-orange\"><feColorMatrix color-interpolation-filters=\"sRGB\" type=\"matrix\" values=\" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 \" \/><feComponentTransfer color-interpolation-filters=\"sRGB\"><feFuncR type=\"table\" tableValues=\"0.098039215686275 1\" \/><feFuncG type=\"table\" tableValues=\"0 0.66274509803922\" \/><feFuncB type=\"table\" tableValues=\"0.84705882352941 0.41960784313725\" \/><feFuncA type=\"table\" tableValues=\"1 1\" \/><\/feComponentTransfer><feComposite in2=\"SourceGraphic\" operator=\"in\" \/><\/filter><\/defs><\/svg> <a href=\"https:\/\/cyberscoop.com\/iranian-dissidents-presidential-hack\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.327433628319\">\n<div class=\"single-article__header-content\" readability=\"30.142857142857\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/geopolitics\/\"> <span>Geopolitics<\/span> <\/a> <\/li>\n<\/ul>\n<p> The hack and leak operation revealed Monday includes a trove of files related to Iranian President Ebrahim Raisi. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-4.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> Iranian President Ebrahim Raisi during the signing of the comprehensive program of strategic and long-term cooperation between Iran and Syria on May 03 in Damascus. (Photo by Borna News\/Matin Ghasemi\/Aksonline\/ATPImages) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"62.910448993067\"><body readability=\"125.82089798613\"><\/p>\n<p>A trove of documents, images and videos from the offices of Iranian President Ebrahim Raisi posted online Monday appear to be authentic, cybersecurity experts familiar with the matter told CyberScoop on Wednesday.<\/p>\n<p>The materials posted to a Telegram channel Monday by a group called \u201cGhyamSarnegouni\u201d (\u201cRise to Overthrow\u201d) include alleged diplomatic correspondence, floor plans for the offices and sleeping quarters of the Iranian president and other top government offices, detailed network topologies for sensitive Iranian government networks and more.<\/p>\n<p>\u201cThe hack is legit,\u201d said Amin Sabeti, the founder of the <a href=\"https:\/\/blog.certfa.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">Computer Emergency Response Team in Farsi<\/a>, which focuses on Iranian cybersecurity issues. Amir Rashidi, the director of internet security and digital rights at the <a href=\"https:\/\/www.miaan.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">Miaan Group<\/a>, an Iranian digital and human rights organization, also told CyberScoop that the files \u201cseem legitimate,\u201d perhaps obtained by someone with insider access.<\/p>\n<p>While the documents could reveal previously non-public details, Rashidi said many of the Iranian government\u2019s activities exposed in the documents are already well known and discussed.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cNone of this information is really crazy critical,\u201d Rashidi said, other than perhaps the floor plans and some of the other more technical details. It\u2019s more that it\u2019s \u201cembarrassing,\u201d he added, noting that the information seems to confirm what was largely known about how the Iranian government operates. The material also reportedly includes internal information about nuclear expansion within the country, <a href=\"https:\/\/www.iranintl.com\/en\/202305297412\" target=\"_blank\" rel=\"noreferrer noopener\">according to Iran International news.<\/a><\/p>\n<p>The embarrassing hack landed days before news emerged that Iran had resolved two outstanding issues with the International Atomic Energy Agency related to enriched uranium, which the <a href=\"https:\/\/apnews.com\/article\/iran-nuclear-program-iaea-uranium-enrichment-dded37dd0509ff0f469478b5db771027\" target=\"_blank\" rel=\"noreferrer noopener\">Associated Press characterized<\/a> as \u201c[easing] pressure slightly on Tehran.\u201d Rashidi said that although there\u2019s no firm connection to this specific hack, it\u2019s curious how often major leaks occur in conjunction with any progress on nuclear issues.<\/p>\n<p>\u201cAny time we are at the middle of the conversation that this nuclear negotiation might lead somewhere, might end somewhere, you will see somehow, either by Israeli or by some hacking group or something like that, some kind of information being publicized regarding Iran nuclear program,\u201d Rashidi said.<\/p>\n<p>Iran\u2019s permanent mission to the United Nations did not return a request for comment from CyberScoop sent Wednesday. <\/p>\n<p>A government spokesperson told an Iranian news outlet Monday that several presidential sites were temporarily down due to technical issues related to a new version of the website, and denied \u201crumors\u201d about the hacking, the state-backed <a href=\"https:\/\/www.isna.ir\/news\/1402030805644\/%D9%87%DA%A9-%D8%B4%D8%AF%D9%86-%D8%B3%D8%A7%DB%8C%D8%AA-%D8%B1%DB%8C%D8%A7%D8%B3%D8%AA-%D8%AC%D9%85%D9%87%D9%88%D8%B1%DB%8C-%D8%AA%DA%A9%D8%B0%DB%8C%D8%A8-%D8%B4%D8%AF\" target=\"_blank\" rel=\"noreferrer noopener\">Iranian Students\u2019 News Agency reported<\/a>. The <a href=\"https:\/\/en.irna.ir\/news\/85126097\/Iran-s-Presidency-dismisses-alleged-leaks-as-inauthentic\" target=\"_blank\" rel=\"noreferrer noopener\">Islamic Republic News Agency reported<\/a> that the president\u2019s office called the documents \u201cfake.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>GhyamSarnegouni emerged on Telegram on Jan. 26, 2022, and is one of many anti-Iranian government groups online purporting to hack Iranian government systems as a form of protest. From its early days, its messaging has echoed the prominent Iranian opposition group <a href=\"https:\/\/english.mojahedin.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">Mojahedin-e Khalq<\/a> (MEK), Rashidi said, suggesting an affiliation of some kind.<\/p>\n<p>On May 29, GhyamSarnegouni posted a simple message: \u201cThe entire highly protected internal network of the executioner president\u2019s institution in Tehran was captured and out of reach,\u201d according to a Google translation.<\/p>\n<p>Over the next three hours the group posted new files, images and videos every few minutes. Around the same time, a <a href=\"https:\/\/english.mojahedin.org\/news\/iranian-dissidents-take-over-high-security-servers-of-regime-presidency\/\" target=\"_blank\" rel=\"noreferrer noopener\">post appeared<\/a> on the MEK website titled \u201cIranian dissidents take over high-security servers of regime presidency.\u201d The post attributed the hack to GhyamSarnegouni and said that multiple websites linked to President Raisi were defaced along with the exfiltration of what would be highly sensitive documents and materials, according to the MEK\u2019s post.<\/p>\n<p>Multiple websites were altered to include the image of two MEK leaders \u2014 Massoud Rajavi and his wife Maryam \u2014 the <a href=\"https:\/\/www.timesofisrael.com\/hackers-post-photos-of-iranian-opposition-leaders-on-government-websites\/\" target=\"_blank\" rel=\"noreferrer noopener\">Times of Israel reported Monday<\/a>.<\/p>\n<p>The group responsible for the attack claimed it gained control of 120 servers connected to the president\u2019s internal network and central databases, access to and control of more than 1,300 computers on the network, security footage of the network\u2019s communication hardware and \u201caccess to systems of the classified internal communications to the presidency and the government,\u201d according to the post on the MEK website.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" loading=\"lazy\" width=\"640\" height=\"359\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say.png?resize=640%2C359&ssl=1\" alt class=\"wp-image-74445\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say.webp 1080w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say.webp?resize=300,168 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say.webp?resize=768,430 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say.webp?resize=1024,574 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say.webp?resize=600,337 600w\" sizes=\"auto, (max-width: 1080px) 100vw, 1080px\"><figcaption class=\"wp-element-caption\">Screenshot from a video posted to the GhyamSarnegouni Telegram channel May 29 purporting to show images from closed circuit television footage monitoring Iranian government server equipment. <\/figcaption><\/figure>\n<p>Additional materials allegedly obtained by the hackers, according to the MEK, included: Classified and encrypted internal messages, \u201ctens of thousands of classified, top secret, and secret documents,\u201d floor plans and building designs of the president\u2019s office and sleeping quarters and detailed information on the internet network diagrams and equipment, including IP addresses, for facilities associated with the president as well as other top government leaders and institutions, including the interior and intelligence ministries and the <a href=\"https:\/\/iranprimer.usip.org\/resource\/basij-resistance-force\" target=\"_blank\" rel=\"noreferrer noopener\">Basij<\/a>, a militia under the Iranian Revolutionary Guard.<\/p>\n<p>Earlier in May, GhyamSarnegouni claimed to have hacked the Iranian foreign ministry servers and defaced multiple websites. In that case as well, websites were defaced and pictures posted of MEK leaders, and <a href=\"https:\/\/english.mojahedin.org\/news\/iranian-dissidents-disrupt-over-210-regime-foreign-ministry-websites-and-servers\/\" target=\"_blank\" rel=\"noreferrer noopener\">a news story about the hack<\/a> appeared on the MEK website. In October, a separate group called <a href=\"https:\/\/cyberscoop.com\/iran-nuclear-emails-hack-leak-black-reward\/\" target=\"_blank\" rel=\"noreferrer noopener\">Black Reward claimed credit<\/a> for the hack-and-leak of emails related to the country\u2019s nuclear program, which the group said was in response to the Iranian government\u2019s murder of <a href=\"https:\/\/www.forbes.com\/sites\/maggiemcgrath\/2022\/12\/06\/mahsa-amini-the-spark-that-ignited-a-women-led-revolution\/?sh=5332013a5c3d\" target=\"_blank\" rel=\"noreferrer noopener\">Mahsa Amini<\/a> and the subsequent crackdown on protesters there.<\/p>\n<p>\u201cThe islamic republic has become the first dictatorship to become open source,\u201d said Sabeti, the Computer Emergency Response Team founder. \u201cThe amount of leaked data literally has opened source the regime.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\"> <\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<div class=\"popular-stories__stories\">\n<div class=\"popular-stories__cards\">\n<article class=\"post-item post-item--popular-stories-cards \" readability=\"22.2287694974\">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/iranian-information-operations-hacking-microsoft-report\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"506\" height=\"337\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-1.jpg?resize=506%2C337&ssl=1\" class=\"attachment-ratio-16-9-md size-ratio-16-9-md wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-5.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-5.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-5.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-5.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-5.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-5.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-5.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-5.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-5.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-5.jpg?resize=1265,843 1265w\" sizes=\"auto, (max-width: 506px) 100vw, 506px\"> <\/a><figcaption class=\"screen-reader-text\"> People march with Iranian flags and with signs during a rally marking Al-Quds Day (Jerusalem), a commemorative day held annually on the last Friday of the Muslim fasting month of Ramadan by an initiative started by late Iranian revolutionary leader Ayatollah Ruhollah Khomeini, in Tehran on April 14, 2023. (Photo by AFP \/ Getty Images) <\/figcaption><\/figure>\n<header class=\"post-item__meta\" readability=\"1.8375\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/iranian-information-operations-hacking-microsoft-report\/\"> Microsoft says Iranian hackers combine influence ops with hacking for maximum impact <\/a> <\/h3>\n<p> Many of the 24 cyber-enabled Iranian influence operations Microsoft detected in 2022 were intended to further Iran’s Mideast political agenda. <\/p>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/aj-vicens\/\"> AJ Vicens <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<article class=\"post-item post-item--popular-stories-cards \">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/israel-technion-hack-muddy-water-iran-mois\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"252\" height=\"168\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-2.jpg?resize=252%2C168&ssl=1\" class=\"attachment-ratio-16-9-sm size-ratio-16-9-sm wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-6.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-6.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-6.jpg?resize=768,513 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-6.jpg?resize=1024,684 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-6.jpg?resize=1536,1026 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-6.jpg?resize=600,401 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-6.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-6.jpg?resize=505,337 505w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-6.jpg?resize=1011,675 1011w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-6.jpg?resize=1263,843 1263w\" sizes=\"auto, (max-width: 252px) 100vw, 252px\"> <\/a><figcaption class=\"screen-reader-text\"> An Israeli flag flies in a street in front of the Ibrahimi Mosque or the Tomb of the patriarches, in the occupied West Bank town of Hebron, on May 26, 2022. (Photo by HAZEM BADER\/AFP via Getty Images) <\/figcaption><\/figure>\n<header class=\"post-item__meta\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/israel-technion-hack-muddy-water-iran-mois\/\"> Israel blames prolific Iranian-linked hacking group for February university hack <\/a> <\/h3>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/aj-vicens\/\"> AJ Vicens <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<article class=\"post-item post-item--popular-stories-cards \">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/iran-charlie-hebdo-hack\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"267\" height=\"168\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-3.jpg?resize=267%2C168&ssl=1\" class=\"attachment-ratio-16-9-sm size-ratio-16-9-sm wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-7.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-7.jpg?resize=300,189 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-7.jpg?resize=768,483 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-7.jpg?resize=1024,644 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-7.jpg?resize=1536,966 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-7.jpg?resize=600,378 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-7.jpg?resize=267,168 267w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-7.jpg?resize=536,337 536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-7.jpg?resize=1073,675 1073w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say-7.jpg?resize=1340,843 1340w\" sizes=\"auto, (max-width: 267px) 100vw, 267px\"> <\/a><figcaption class=\"screen-reader-text\"> Iranians lift pictures of Iran\u2019s Supreme Leader Ayatollah Ali Khamenei during an anti-France rally, in reaction to cartoons depicting Khamenei published by French satirical weekly Charlie Hebdo, after the Friday prayer ceremony in the capital Tehran on January 13, 2023. (Photo by -\/AFP via Getty Images) <\/figcaption><\/figure>\n<header class=\"post-item__meta\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/iran-charlie-hebdo-hack\/\"> Sanctioned Iranian hackers behind Charlie Hebdo breach, Microsoft says <\/a> <\/h3>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/aj-vicens\/\"> AJ Vicens <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/iranian-dissidents-presidential-hack\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Iranian dissidents’ claim of presidential hack likely legitimate, experts say<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[302],"tags":[306],"class_list":["post-1400","post","type-post","status-publish","format-standard","hentry","category-geopolitics","tag-geopolitics"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/geopolitics\/\" rel=\"category tag\">Geopolitics<\/a>","tag_info":"Geopolitics","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/1400","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=1400"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/1400\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=1400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=1400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=1400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1400,"date":"2023-05-31T20:36:49","date_gmt":"2023-05-31T20:36:49","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=74428"},"modified":"2023-05-31T20:36:49","modified_gmt":"2023-05-31T20:36:49","slug":"iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2023\/05\/31\/iranian-dissidents-claim-of-presidential-hack-likely-legitimate-experts-say\/","title":{"rendered":"Iranian dissidents\u2019 claim of presidential hack likely legitimate, experts say"},"content":{"rendered":"