The claim by “HomeLand Justice" came on a Telegram channel in which documents purported to be Albanian residence permits of MEK members were posted, along with video of the ransomware being activated. The channel alleged corruption in the Albanian government and used hashtags including #Manez.
“This activity poses an active threat to public and private organizations in other NATO member states,” Mandiant said. “As negotiations surrounding the Iran nuclear deal continue to stall, this activity indicates Iran may feel less restraint in conducting cyber network attack operations going forward.”
At the time, the Tirana government said the hackers’ method was identical with attacks last year in other NATO states including Germany, Lithuania, the Netherlands and Belgium.
Iran’s mission to the United Nations did not immediately respond to a request for comment Thursday.
The MEK began as a Marxist group opposing the rule of Shah Mohammad Reza Pahlavi in Iran. It supported the 1979 Islamic Revolution, but soon had a falling out with Grand Ayatollah Ruhollah Khomeini and turned against his clerical government, carrying out a series of assassinations and bombings in the Islamic Republic.
The MEK later fled into neighboring Iraq, leading many in Iran to oppose the group. Although now largely based in Albania, the group claims to operate a network inside Iran.
Follow Llazar Semini at https://twitter.com/lsemini