Iranian Revolutionary Guard-affiliated actors have launched targeted cyber attacks on Australian organisations, with the aim of using the data obtained for extortion, a report tabled in parliament shows.
But the federal government won’t disclose information about whether it is considering listing the Iranian Islamic Revolutionary Guard Corps (IRGC) – the military arm of Iran’s government — as a terrorist organisation, or how much worth of assets and/or investments that people connected to the regime hold in Australia.
A federal parliamentary inquiry investigating recent human rights violations in Iran, which is due to hand down its report next week, heard evidence of reports of surveillance and abuse by the regime against Australian-Iranians who speak out against the Islamic Republic.
During the hearings, the inquiry heard evidence that the federal government could take action against Iranian diplomats connected with the recent executions of Iranian protesters, and cancel visas of any senior Islamic Republic officials or their families in Australia.
In response to questions on notice, the Department of Home Affairs said "no" when asked whether it had investigated — or were aware of any other branches of government investigating — if people connected to Iran's regime had set up social media pages or groups in order to track Australian-Iranians opposed to the regime.
But a spokeswoman for Foreign Minister Penny Wong told ABC News the Counter Foreign Interference Taskforce, led by the Australian Security Intelligence Organisation (ASIO), was responsible for investigating such allegations.
"Allegations of foreign interference will be investigated, and where possible, the Australian Federal Police will lay charges," she said.
Pressure is growing on the United States, EU, Britain and other countries to blacklist the IRGC over the brutal crackdown on protesters, which has seen more than 19,000 people arrested, and more than 500 killed, according to the Human Rights Activists News Agency.
The latest wave of protests were triggered by the death in custody of 22-year-old Mahsa Amini (Jina Amini) on September 16.
The Iranian uprising is seen as one of the most serious challenges to the Islamic Republic since the 1979 revolution.
‘Malicious’ cyber attacks launched by groups connected to the IRGC
Shadow Assistant Minister for Foreign Affairs Claire Chandler, who is also deputy chair of the inquiry, had at a separate Senate estimates hearing asked the Australian Signals Directorate (ASD) whether it believes the IRGC and its affiliates are or have been involved in ransomware attacks in Australia.
In response to that, the ASD, which has provided answers to questions on notice, said "yes", and referred to a report released in September by the joint Cybersecurity Advisory (CSA) – which includes several intelligence and cyber security agencies in United States, Australia, Canada and the United Kingdom.
The report highlights “continued malicious cyber activity by advanced persistent threat (APT) actors that the authoring agencies assess are affiliated with the Iranian government’s Islamic Revolutionary Guard Corps (IRGC)”.
“The IRGC-affiliated actors are actively targeting a broad range of entities, including entities across multiple US critical infrastructure sectors as well as Australian, Canadian, and United Kingdom organisations,” the report says.
It suggests that after gaining access to a network, “the IRGC-affiliated actors likely determine a course of action based on their perceived value of the data”.
“Depending on the perceived value, the actors may encrypt data for ransom and/or exfiltrate data,” the report says.
“The actors may sell the data or use the exfiltrated data in extortion operations, or ‘double extortion’ ransom operations, where a threat actor uses a combination of encryption and data theft to pressure targeted entities to pay ransom demands.”
The report suggests actors often operate under the auspices of Najee Technology Hooshmand Fater LLC, based in Karaj, Iran, and Afkar System Yazd Company, based in Yazd, Iran.
“The authoring agencies assess the actors are exploiting known vulnerabilities on unprotected networks rather than targeting specific targeted entities or sectors,” the report notes, calling on organisations to be vigilant and “mitigate risk of compromise from these IRGC- affiliated cyber actors”.
The IRGC was established by Ayatollah Ruhollah Khomeini following the 1979 Iranian Revolution, tasked with safeguarding the Islamic Republic.
The United States, under former US president Donald Trump, withdrew from the nuclear deal in 2018 and targeted the IRGC with sanctions.
In 2020, the US killed top Iranian Revolutionary Guards commander Qasem Soleimani, but the IRGC remains deeply entrenched in Iran’s political system.
For example, under the presidency of Mahmoud Ahmadinejad, dozens of former IRGC officers were placed in senior positions in Iran’s government.
Senior Iranian regime officials hold assets and investments in Australia
According to Home Affairs responses to questions on notice, while senior Iranian government officials may hold Australian investments or cash in Australian bank accounts, “the government cannot discuss specific foreign investment applications, or the application of foreign investment arrangements as they apply or could apply to particular cases”.
“This is because the Act (Foreign Acquisitions and Takeovers Act 1975) establishes that any information pertaining to an applicant’s case is protected and can only be discussed with the applicant, unless an exemption under the Act applies,” it said in its answer to questions on notice provided to inquiry.
It said that generally, “published data shows that foreign direct investment from Iran into Australia is negligible”.
It added that if a bank suspects a transaction involves funds linked to corruption or other criminal activity, it must submit a suspicious matter report to AUSTRAC.
The department did not say whether such reports had been made noting that: “AUSTRAC cannot disclose details of such intelligence holdings relating to specific account holders”.
It also said in its responses that as of December 23, 34 Iranian citizens hold a Diplomat (Subclass 995) visa to Australia. In total, there are 7,099 Iranian citizens offshore who hold an Australian Temporary visa which allows the person to travel to and enter Australia.
“The department is unable to report on their standing within the Iranian government without a manual interrogation of each visa holder’s individual record,” it said.
Wong 'deeply concerned' by reports of foreign interference
A spokeswoman for Foreign Minister Penny Wong told the ABC "the Australian government is deeply concerned by reports of foreign interference, including the harassment and intimidation of Australians online and in-person".
"We have raised our concerns about foreign interference directly to the Iranian regime in no uncertain terms," she said.
"Australia will continue to work domestically to keep Australians safe from foreign interference and with our like-minded partners to apply pressure on the Iranian regime over its egregious human rights abuses."
In December, Senator Wong imposed Magnitsky-style sanctions on Iran's "morality" police, Iran's Basij Resistance Force and six individuals connected with regime's "abhorrent, flagrant and continued human rights violations".
"Australia has been integral to building pressure internationally and was at the forefront of efforts to remove Iran from the Commission for the Status of Women," the spokeswoman said.
The federal government also co-sponsored and advocated for the UN Human Rights Council resolution to set up an independent fact-finding mission to investigate human rights violations in Iran, she said.
She noted that the IRGC as well as a number of IRGC-linked individuals and entities have been subject to Australian financial sanctions since 2012 that "prohibit making an asset available to a designated person or entity, or using or dealing with an asset that is owned or controlled by a designated person or entity".
But Senator Chandler said Iran's government and the IRGC "have long records of horrific behaviour around the world".
"There are legitimate fears in the community about threats and intimidation and it's perfectly reasonable to expect the government to know whether there are IRI and IRGC affiliated people in Australia, what their activities here are, and what risks that might pose for Australia and Australians," Senator Chandler said.
"Iranian-Australians have been raising these concerns for many months now and it's not surprising that there's frustration in the community that the government can't or won't address those concerns."
Calls to list IRGC as a terrorist organisation
In recent weeks, prominent human rights activists and opponents of the Islamic Republic have urged the international community to list the IRGC as a terror group, which they see as one of the crucial steps required to support the Iranian peoples' calls for a revolution.
A tweet published on January 16 by exiled Crown Prince Reza Pahlavi, Iranian soccer star Ali Karimi, journalist and activist Masih Alinejad, British-Iranian actress and human rights activist Nazanin Boniadi, and actress Golshifteh Farahani said, "our request for the international community is clear: put the IRGC on the terrorist list".
"For more than four decades, the IRGC has been terrorising and killing civilians inside and outside Iran," the opposition figures said in their joint tweet, and add that "security forces who join the Iranian people will be welcomed with open arms".
At the same time, about 12,000 of members of the Iranian diaspora met from all over Europe on January 16 in the EU Parliament host city of Strasbourg to urge the bloc to list the IRGC as a terror group.
According to responses provided by DFAT to the committee holding the inquiry: "It is the Australian government’s longstanding practice not to comment on the possible listings of terrorist organisations under the Criminal Code, including whether or not a particular entity is under consideration for listing."
Senator Wong's office gave the same response when contacted by ABC News.
As to whether Australia's government had been discussing, with international partners, the listing the IRGC as a terror group, DFAT responded: "It is standard practice to not disclose matters communicated in confidence by foreign governments."
Human rights advocates condemn 'killing spree'
At the same time as calling for IRGC to be added to the terrorist organisations list, human rights groups have condemned the Iranian government’s use of executions to stop protests.
Amnesty International has labelled the recent spate of state-sanctioned executions as a "killing spree".
It says the recent “arbitrary executions” of Mohammad Mehdi Karami and Seyed Mohammad Hosseini, just days after their death sentences were upheld, “reveal how the Iranian authorities continue to wield the death penalty as a weapon of repression and serve as a chilling reminder that scores of others remain at risk of execution”.
It follows earlier executions imposed against protesters following sham trials. On December 8, Mohsen Shekari was executed less than three months after his arrest and after being convicted of “enmity against God” in a grossly unfair trial. On December 12, Majidreza Rahanvard was publicly executed just two weeks after being convicted of “enmity against God” in a grossly unfair trial.
It says now Mohammad Ghobadlou and scores of others are “at grave risk of execution”.
In Ghobadlou’s case, he has received two death sentences after what Amnesty labelled as “grossly unfair sham trials, marred by torture-tainted ‘confessions’ and failure to order rigorous mental health assessments despite his mental disability”. A retrial has since been ordered.
A submission to the parliamentary inquiry by human rights advocate Sam Loni and others, suggests that “the Islamic Republic of Iran (IRI) has breached most major international human rights treaties over the past few months”.
The report suggests the Iranian governments crackdown, most likely constitutes crimes against humanity, and that if this can be established by a UN fact-finding mission that was recently set tup to investigate Iran’s human rights abuses that “Australia and the rest of the international community have a legal and moral obligation to refer the IRI to the International Criminal Court (ICC) for prosecution”.
The New York-based Center for Human Rights in Iran (CHRI) has called on the UN fact-finding mission to investigate the deaths of a number of recently released detained protesters, which Iranian authorities have labelled “suicides” but that the group suggests are suspicious.
“We are seeing a number of suspicious deaths of released detainees who were clearly tortured while in state custody, with families being forced to quickly bury their loved ones after being blocked from carrying out independent autopsies,” said CHRI executive director Hadi Ghaemi in a statement.
“Given the Islamic Republic’s documented history of killing or causing the death of detainees and trying to hide evidence, these deaths should be investigated by the Iran-focused UN Fact-Finding Mission.”
