Iran Cyber Outfit’s Recruiting Drive Sparks Hacking Concerns

A sanctioned Iranian cybersecurity training firm has announced its largest-ever recruitment class, deepening concerns about hacks from the country continuing to pummel the US.

The organization, Ravin Academy, said that it’s recruiting between 600 and 1200 Iranians ages 17 to 30 for a free, yearlong cybersecurity scholarship, TRM Labs, a blockchain and artificial intelligence investigation company, said Friday. Students can participate in technological competitions to analyze real or simulated industrial infrastructure and produce possible cyberattack scenarios. Earlier programs offered through the academy advertised job placements that could allow trainees to fulfill Iranian military service requirements.

The US placed sanctions on Ravin Academy in 2022, but its operations have grown since the academy was founded in 2020. The academy trains students in cybersecurity and hacking, and recruits its trainees for Iran’s Ministry of Intelligence, according to the US Treasury.

PricewaterhouseCoopers International Ltd. had previously determined it’s “highly likely” that alleged Iranian hackers are familiar with training materials from Ravin Academy and that former students participate in state-sponsored attack groups. Participants in the academy may become part of Iran’s cyberwarfare efforts, according to TRM Labs.

Ravin Academy didn’t immediately respond to a request for comment.

On July 30, the FBI warned that hackers had targeted water and wastewater companies in at least seven US states. The breaches had in in some cases degraded water operations, including by causing a loss of pressure and flooding, the bureau said in a statement. American officials didn’t publicly blame Iran for the attacks, but cybersecurity experts have said Iranian-affiliated hackers, including a group known as CyberAv3ngers, were likely behind the intrusions.

There’s no indication that Ravin Academy was tied to any of those incidents.

“This is an organization that was sanctioned in order to deter and slow its progress and ideally stop it from existing,” said Will Doran, the head of nation state threat intelligence at TRM Labs. “But what we found is, it’s an extremely adaptable program that has found a way to continue to not only exist, but thrive.”

The first five months of the training program draw on proprietary material from US cybersecurity firms and international certification bodies, including the Linux Professional Institute, Microsoft Corp. and the SANS Institute, analysts said. Researchers were unable to ascertain exactly how the private materials were obtained by Ravin.

Online materials promote syllabi that includes material lifted from those organizations, marketing the courses as substitutes for expensive English-language courses. Ravin Academy says the courses are offered for free through sponsorships from unnamed Iranian corporations.

The academy has publicly worked with Positive Technologies, one of Russia’s largest cybersecurity companies, which has been under US sanctions since 2021 over its alleged links to Russian intelligence services.