After a four-year hiatus, Iran recently resumed destructive cyber attacks against Saudi Arabia in what U.S. officials say is part of a long-term strategy by Tehran to take over the oil-rich kingdom and regional U.S. ally.
Late last month, the Saudi government warned in a notice to telecommunications companies that an Iranian-origin malicious software called Shamoon had resurfaced in cyber attacks against some 15 Saudi organizations, including government networks.
The Shamoon malware was last detected in the 2012 cyber attack against the major Saudi state oil producer Aramco. That cyber attack damaged or destroyed some 30,000 computers and was considered one of the more destructive state-linked cyber attacks to date.
A State Department security report issued Feb. 10 stated that the 2012 attack destroyed over three-fourths of Aramco's computers, and that the damage took five months to mitigate at "an extreme cost."
Shamoon also was used in Iranian cyber attacks against RasGas, a liquified natural gas company located in neighboring Qatar.
A new version of the malware, Shamoon 2, was linked to the recent cyber attack, which took place in November. Security officials linked that attack to a Middle East hacker group known as Greenbug that used fraudulent emails in phishing scams to acquire login credentials for Saudi networks.
The new Shamoon 2 "is meant to do damage," the expert said, noting that the recent cyber attack was not as effective as the earlier one in 2012.
Once inside compromised computer networks, the Iranian hackers were able to steal large amounts of data. They then destroyed the computers using a digital wiping tool that removes all data from the system. The hacked computers were left with a screen image.
In the 2012 Saudi Aramco attack, the Iranians left an image of a burning American flag image. After the November cyber attack, the hackers left a screen image of a dead Syrian refugee boy.
The Saudis received U.S. government cyber security and technology training after the 2012 attack. No Shamoon malware was detected until the new variant, Shamoon 2, appeared in November. The U.S. government believes the same Iranian hackers carried out both attacks.
A National Security Agency document from 2013 warned that Iranian government cyber attacks are part of an expansion of Iranian influence in the Middle East. "NSA has seen Iran further extending its influence across the Middle East over the last year," states the top secret memo, which was disclosed by renegade contractor Edward Snowden.
NSA believed Iran's 2012 cyber attack was carried out in retaliation for the earlier U.S. cyber attacks against Iranian nuclear facilities. Those attacks caused nuclear centrifuges to self-destruct using an industrial control software known as Stuxnet.
"NSA expects Iran will continue this series of attacks, which it views as successful, while striving for increased effectiveness by adapting its tactics and techniques to circumvent victim [computer network] mitigation attempts," the NSA said.
The Iranian cyber attacks are one element of a larger Iranian strategy to subvert and ultimately take over Saudi Arabia, the location of Islam's holy sites, according to U.S. officials.
Predominantly Shiite Iran and predominantly Sunni Saudi Arabia are bitter rivals that vie for influence over the world's Muslims.
The State Department report, "Devastating Cyber Attack Program Returns to Saudi Arabia," warned that U.S. companies operating in the kingdom could be the next targets of Iranian cyber attacks.
"The increased tensions and unpredictable future between Iran, Saudi Arabia, and the U.S. raises the potential for U.S. organizations in the region to be future targets for a cyberattack, either with Shamoon or similar malware tuned for destruction rather than corporate espionage or theft," the report said.
In addition to cyber attacks, Iran seeks to subvert Saudi Arabia through a proxy war in Yemen.
Tehran is backing Houthi rebels against the pro-Saudi government of Yemen. The Houthis took over the capital of Sanaa in 2014. One year later, a Saudi-led coalition of nine regional states intervened in the conflict.
Concerned by large numbers of civilian casualties in the conflict, the Obama administration last year delayed delivery to Saudi Arabia of an arms sale package for large numbers of precision-guided bomb kits. The kits turn gravity bombs into precision-guided weapons that can be directed to targets.
U.S. officials say the Trump administration is ready to lift the ban on the the bomb kits to the regional ally because it is no longer concerned by the Obama administration's goal of warmer relations with Tehran.
Under Obama, then-Secretary of State John Kerry tried to negotiate a settlement of the Yemen conflict in a deal with the Houthis. Critics said the deal would have been advantageous to Iran and harmful to the Saudis.
Iran has dispatched a large number of Islamic Revolutionary Guards Corps fighters to Yemen, along with pro-Iranian militia members from Iraq, in a bid to help the Houthis.
Additionally, U.S. officials say Iran is helping the Houthis plant sea mines off the coast of Yemen near the strategic Red Sea choke point known as the Bab-el-Mandeb—a strategic shipping lane between the Indian Ocean, Red Sea, and Suez Canal.
Controlling the Bab-el-Mandeb is said to be a key element of the Iranian strategy of targeting Saudi Arabia. Once in control of the Bab-el-Mandeb, the Iranians could use their control of the region's other strategic chokepoint, the Strait of Hormuz, to exert political leverage throughout the region.
A commercial maritime security notice was sent recently to shipping companies warning that vessels transiting the region should check with the U.S. Navy about the threat of sea mines.
A Saudi warship was recently attacked in waters near Yemen by what is now believed to have been a small, remotely piloted boat loaded with explosives.
The guided missile destroyer USS Cole was recently dispatched to the area following the rebel attack on the Saudi ship.