Server Breach Reveals: Iran-Russia Military Deal Valued at Nearly Two Billion Dollars
A cyber attack group called PRANA claims to have breached Iranian servers and stolen information - part of which has been leaked to the network
Cmdr. (res.) Eyal Pinko
| 14/02/2024
At the beginning of February, a cyber threat group called PRANA announced that it had successfully conducted a cyber attack on the organizational network of a company named Sahara Thunder. Apparently, the breach into the company was achieved through compromising its email server.
Sahara Thunder is a shell company operated by Iran's Revolutionary Guards. The company is registered in Iran, headquartered in Tehran, and is responsible for procurement for the Iranian Ministry of Defense. It is also engaged in selling oil, including operating tankers for the Iranian national shipping company, IRISL, to various countries (such as China and Venezuela). These sales circumvent the embargo imposed on Iran by President Trump in 2018.
The PRANA group reported that it succeeded in obtaining sensitive intelligence material from the computers of the heavy industry company (exceeding GB10), indicating the transfer of military assets between Iran and Russia, with emphasis on the transfer of unmanned aerial vehicles (UAVs) of the Shahed model. The UAVs were given the code name "Dolphin 632.”
Among the information presented by the attack group is technological data about the UAVs, the method of transporting the unmanned aerial vehicles (UAVs), including the use of the Alabuga Special Economic Zone in Russia, prices, and production rates of the UAVs. The presented information also includes extensive economic data, the company's structure, its operational cover infrastructure, logistical information on oil transfers, and more.
The group revealed that in 2022, the Iranians sold the Russians a license to produce 6,000 Iranian-made Shehad-model UAVs for two and a half years. The price of an Iranian UAV stands at around $375,000, but after negotiations between the parties and the purchase of 6,000 units, the Iranians lowered the price to $290,000.
The total value of the deal signed between the parties, including the transfer of knowledge, production line, and production of 6,000 units, is $1.75 billion.
In 2023, the Iranians sold Shehad 136-model UAVs to the Russians for $48,800 per unit, in a project valued at approximately $165 million (including production line upgrades and knowledge transfer). The Russian payment to Iran was partially made through gold bars, some of which may have originated from Africa, where the Wagner Group operates in several countries to extract gold and minerals for transfer to Russia.
From the information provided, it appears that the Russians transferred approximately 2,070 kilograms of gold to the Iranians in February 2023, valued at around $135 million. The payment transactions between the countries were facilitated with the assistance of companies from the United Arab Emirates named Generation Trading FZE Alabuga. The attack group not only stole information from the network of the Iranian heavy industry company but also wiped out all the data from the company's email servers.
At the moment, the identity of the PRANA attack group remains unknown.
A cyber attack group called PRANA claims to have breached Iranian servers and stolen information - part of which has been leaked to the network
At the beginning of February, a cyber threat group called PRANA announced that it had successfully conducted a cyber attack on the organizational network of a company named Sahara Thunder. Apparently, the breach into the company was achieved through compromising its email server.
Sahara Thunder is a shell company operated by Iran's Revolutionary Guards. The company is registered in Iran, headquartered in Tehran, and is responsible for procurement for the Iranian Ministry of Defense. It is also engaged in selling oil, including operating tankers for the Iranian national shipping company, IRISL, to various countries (such as China and Venezuela). These sales circumvent the embargo imposed on Iran by President Trump in 2018.
The PRANA group reported that it succeeded in obtaining sensitive intelligence material from the computers of the heavy industry company (exceeding GB10), indicating the transfer of military assets between Iran and Russia, with emphasis on the transfer of unmanned aerial vehicles (UAVs) of the Shahed model. The UAVs were given the code name "Dolphin 632.”
Among the information presented by the attack group is technological data about the UAVs, the method of transporting the unmanned aerial vehicles (UAVs), including the use of the Alabuga Special Economic Zone in Russia, prices, and production rates of the UAVs. The presented information also includes extensive economic data, the company's structure, its operational cover infrastructure, logistical information on oil transfers, and more.
The group revealed that in 2022, the Iranians sold the Russians a license to produce 6,000 Iranian-made Shehad-model UAVs for two and a half years. The price of an Iranian UAV stands at around $375,000, but after negotiations between the parties and the purchase of 6,000 units, the Iranians lowered the price to $290,000.
The total value of the deal signed between the parties, including the transfer of knowledge, production line, and production of 6,000 units, is $1.75 billion.
In 2023, the Iranians sold Shehad 136-model UAVs to the Russians for $48,800 per unit, in a project valued at approximately $165 million (including production line upgrades and knowledge transfer). The Russian payment to Iran was partially made through gold bars, some of which may have originated from Africa, where the Wagner Group operates in several countries to extract gold and minerals for transfer to Russia.
From the information provided, it appears that the Russians transferred approximately 2,070 kilograms of gold to the Iranians in February 2023, valued at around $135 million. The payment transactions between the countries were facilitated with the assistance of companies from the United Arab Emirates named Generation Trading FZE Alabuga. The attack group not only stole information from the network of the Iranian heavy industry company but also wiped out all the data from the company's email servers.
At the moment, the identity of the PRANA attack group remains unknown.
