The NSA Acknowledges What We All Feared: Iran Learns From US Cyberattacks
After the Stuxnet digital weapon was discovered on machines in Iran in 2010, many security researchers warned that US adversaries would learn from this and other US attacks and develop similar techniques to target America and its allies.
A newly published document leaked by Edward Snowden indicates that the NSA feared the same thing and that Iran may already be doing exactly this. The NSA document from April 2013, published today by The Intercept, shows the US intelligence community is worried that Iran has learned from attacks like Stuxnet, Flame and Duquall of which were created by the same teamsin order to improve its own capabilities.
The document suggests that such attacks dont just invite counterattacks but also school adversaries on new techniques and tools to use in their counterattacks, allowing them to increase the sophistication of these assaults. Iran, the document states, has demonstrated a clear ability to learn from the capabilities and actions of others.
The document, which was prepared for a meeting between the NSA director and the British spy agency Government Communications Headquarters, doesnt mention the Stuxnet attack by name, but instead refers to Western attacks against Irans nuclear sector. Stuxnet targeted machines controlling centrifuges in Iran that were being used to enrich uranium for Irans program.
In addition to attacks against Irans nuclear sector, however, the document also states that Iran learned from a different attack that struck its oil industry. The report says Iran then replicated the techniques of that attack in a subsequent attack called Shamoon that targeted Saudi Arabias oil conglomerate, Saudi Aramco.
Irans destructive cyber attack against Saudi Aramco in August 2012, during which data was destroyed on tens of thousands of computers, was the first such attack NSA has observed from this adversary, the NSA document states. Iran, having been a victim of a similar cyber attack against its own oil industry in April 2012, has demonstrated a clear ability to learn from the capabilities and actions of others.
The latter statement in the document is referring to the so-called Wiper attack, an aggressive and destructive piece of malware that targeted machines belonging to the Iranian Oil Ministry and the National Iranian Oil Company in April 2012. Wiper didnt steal datainstead it destroyed it, first wiping content on the machines before systematically erasing system files, causing the systems to crash, and preventing them from rebooting. Wiper was designed to quickly destroy as many files as effectively as possible, which can include multiple gigabytes at a time, according to researchers at Kaspersky Lab who examined the mirror images of hard drives in Iran that were destroyed by Wiper.
Wiper was the first known data destruction attack of its kind. Although the NSA document doesnt credit the US and its allies for launching the attack, Kaspersky researchers found that it shared some circumstantial hallmarks of the Duqu and Stuxnet attacks, suggesting that Wiper might have been created and unleashed on Iran by the US or Israel.
Many believe it served as inspiration for Shamoon, a subsequent destructive attack that struck computers belonging to Saudi Aramco in August 2012. The document claims Iran was behind Shamoon. The Shamoon malware wiped data from about 30,000 machines before overwriting the Master Boot Record, preventing machines from rebooting. The attack was designed to replace erased data with an image of a burning US American flag, though the malware contained a bug that prevented the flag image from completely unfurling on machines. Instead, only a fragment of the flag appeared. Researchers said at the time that Shamoon was a copycat attack that mimicked Wiper.
Wiper is also believed to have inspired a destructive attack that struck computers belonging to banks and media companies in South Korea in March 2013. That attack wiped the hard drives and Master Boot Record of at least three banks and two media companies simultaneously and reportedly put some ATMs out of operation, preventing South Koreans from withdrawing cash from them. The report does not suggest that Iran was behind this attack.
Read the rest here:
The NSA Acknowledges What We All Feared: Iran Learns From US Cyberattacks
- Securus Technologies Supports Expansion of Sheriff-Led NSA I.G.N.I.T.E. Initiative to Improve Jail Safety and Reentry Outcomes - PR Newswire - February 7th, 2026 [February 7th, 2026]
- NSA set to deal with defiant parties, politicians, supporters on integrity of democratic process - ThePointNG - February 7th, 2026 [February 7th, 2026]
- Where NSA zero trust guidance aligns with enterprise reality - Help Net Security - February 4th, 2026 [February 4th, 2026]
- UNG third in Division 1 of NSA cyber event - University of North Georgia - February 4th, 2026 [February 4th, 2026]
- Green Beret Lieutenant General Joshua Rudd Tapped To Lead NSA and US Cyber Command - SOFREP - February 4th, 2026 [February 4th, 2026]
- SC Flags Health Concerns, Urges Rethink on Sonam Wangchuks NSA Detention - The Morning Voice - February 4th, 2026 [February 4th, 2026]
- What security teams need to know about the NSA's new zero trust guidelines - IT Pro - February 4th, 2026 [February 4th, 2026]
- 'India won't be bullied': NSA Ajit Doval told Marco Rubio that New Delhi would wait out Trump term for trade deal: Report - theweek.in - February 4th, 2026 [February 4th, 2026]
- When Protest becomes a Threat: Inside the Supreme Court hearing on Sonam Wangchuks NSA detention - SabrangIndia - February 4th, 2026 [February 4th, 2026]
- If NSA Commits Database Query Violations, But Nobody Audits Them, Do They Really Happen? - emptywheel - February 4th, 2026 [February 4th, 2026]
- Army general tapped to lead NSA vows to follow the law if confirmed - Military Times - February 1st, 2026 [February 1st, 2026]
- Overturned tractor-trailer shuts portion of Route 32 near NSA - WBAL-TV - February 1st, 2026 [February 1st, 2026]
- Nominee to lead NSA backs controversial spying law - Defense One - February 1st, 2026 [February 1st, 2026]
- NSA pick champions foreign spying law as nomination advances - The Record from Recorded Future News - February 1st, 2026 [February 1st, 2026]
- NSA Releases Phase One and Phase Two of the Zero Trust Implementation Guidelines - National Security Agency (.gov) - February 1st, 2026 [February 1st, 2026]
- Army General Tapped to Lead NSA Said He Doesnt Know Much About the Biggest NSA Controversy - The Intercept - February 1st, 2026 [February 1st, 2026]
- Trump's pick to lead the NSA vows to follow the law if confirmed - ABC News - February 1st, 2026 [February 1st, 2026]
- Trump's pick to lead the NSA vows to follow the law if confirmed - Oskaloosa Herald - February 1st, 2026 [February 1st, 2026]
- Trump's pick to lead the NSA vows to follow the law if confirmed - The Derrick - February 1st, 2026 [February 1st, 2026]
- Overturned tractor-trailer shuts westbound Maryland Route 32 near NSA exit, police say - WBAL News Radio - February 1st, 2026 [February 1st, 2026]
- SC to hear plea against Sonam Wangchuks NSA detention on February 2 - The New Indian Express - February 1st, 2026 [February 1st, 2026]
- Powys sheep sector to hear from Llyr Gruffydd at NSA meeting - County Times - February 1st, 2026 [February 1st, 2026]
- NSA calls for consultation on castration and tail docking to involve sheep farmers - cravenherald.co.uk - January 24th, 2026 [January 24th, 2026]
- NSA launches 13th annual survey for insight into cases of sheep worrying by dogs - Yahoo News UK - January 24th, 2026 [January 24th, 2026]
- NSA Ajit Doval says he doesn't use phone or internet. Here's why - MSN - January 14th, 2026 [January 14th, 2026]
- NSA Ajit Doval says he doesnt use phone or internet; shares views on Indias future and youth - WION - January 11th, 2026 [January 11th, 2026]
- Liberia: NSA Director's Special Assistant Suspended Amid Alleged Gang Sodomy of 15-Year-Old; Authorities Remain Silent - FrontPageAfrica - January 11th, 2026 [January 11th, 2026]
- 'Wars happen because some countries want to impose their will on others': NSA Ajit Doval - Deccan Herald - January 11th, 2026 [January 11th, 2026]
- We have to avenge our history: NSA Ajit Doval urges youth to make India great in every aspect - The Indian Express - January 11th, 2026 [January 11th, 2026]
- CISA, NSA, and Canadian Cyber Centre update Brickstorm analysis with new Rust-based variants - Industrial Cyber - January 11th, 2026 [January 11th, 2026]
- ROVER communication terminals approved for international use by NSA - Military Embedded Systems - January 9th, 2026 [January 9th, 2026]
- L3Harris ROVER and TNR systems gain NSA approval enabling secure coalition interoperability - Defence Industry Europe - January 9th, 2026 [January 9th, 2026]
- Former NSA insider Kosiba brought back as spy agencys No. 2 - The Record from Recorded Future News - January 9th, 2026 [January 9th, 2026]
- Trumps tariff threat to India self-inflicted wound: Former US NSA John Bolton - The Indian EYE - January 9th, 2026 [January 9th, 2026]
- NSA Scotland demands support for sheep farmers ahead of Holyrood elections - Farmers Guardian - January 9th, 2026 [January 9th, 2026]
- Announcing tariffs for purchasing Russian oil unfortunate: Former US NSA backs closer relationship with India - Punjab News Express - January 9th, 2026 [January 9th, 2026]
- NSA Ajit Doval likely to be part of Indian delegation at WEF in Davos - The New Indian Express - January 9th, 2026 [January 9th, 2026]
- "A lot of hot air": Former NSA John Bolton on Trump's remarks on possible action beyond Venezuela - ANI News - January 9th, 2026 [January 9th, 2026]
- NSA employee sues Trump administration over order on transgender rights and two 'immutable' genders - Yahoo - December 22nd, 2025 [December 22nd, 2025]
- NSA employee sues the Trump administration over transgender rights and 'immutable' genders - AP News - December 22nd, 2025 [December 22nd, 2025]
- Senior official at Indo-Pacific Command is set to be Trumps pick to lead Cyber Command, NSA - The Record from Recorded Future News - December 22nd, 2025 [December 22nd, 2025]
- NSA employee sues the Trump administration over transgender rights and 'immutable' genders - Temple Daily Telegram - December 22nd, 2025 [December 22nd, 2025]
- Potential NSA, Cyber Command leader nomination transmitted to Senate - Nextgov/FCW - December 22nd, 2025 [December 22nd, 2025]
- After Eight Months, White House Names Nominee To Head NSA And CYBERCOM - Defense Daily - December 22nd, 2025 [December 22nd, 2025]
- Fubara Hosts NSA, Says Tinubu Happy With Rivers Governor - TVC News - December 22nd, 2025 [December 22nd, 2025]
- CISA, NSA warn of Chinas BRICKSTORM malware after incident response efforts - The Record from Recorded Future News - December 10th, 2025 [December 10th, 2025]
- CISA and NSA Warn of BRICKSTORM Malware Attacking VMware ESXi and Windows Environments - CybersecurityNews - December 10th, 2025 [December 10th, 2025]
- NSA, CISA, and Others Release Guidance on Integrating AI in Operational Technology - National Security Agency (.gov) - December 4th, 2025 [December 4th, 2025]
- NSA has met 2,000-person workforce reduction goal, people familiar say - Nextgov/FCW - December 4th, 2025 [December 4th, 2025]
- NSA Doval, Thai Foreign Minister Phuangketkeow discuss maritime security, threats of online scams - The Indian EYE - December 4th, 2025 [December 4th, 2025]
- NSA Doval, Thai FM discuss maritime security, threats of online scams - Awaz The Voice - December 4th, 2025 [December 4th, 2025]
- All-clear issued about 2 hours after NSA Naples schools evacuated over potential threat - Stars and Stripes - November 18th, 2025 [November 18th, 2025]
- 'Dhurandhar': R Madhavan reveals Aditya Dhar's little trick that perfected his NSA-inspired look for the - The Times of India - November 18th, 2025 [November 18th, 2025]
- Army officer with Indo-Pacific experience emerges as potential Cyber Command, NSA pick - The Record from Recorded Future News - November 18th, 2025 [November 18th, 2025]
- NSA Dr Rahman to attend Security Conclave in New Delhi - United News of Bangladesh - November 18th, 2025 [November 18th, 2025]
- Man claims NSA told him to shatter glass at AT&T building with hatchet, Nashville police say - WSMV - November 18th, 2025 [November 18th, 2025]
- How the heartbreaking lack of a confirmed leader is impacting CYBERCOM and NSA - Breaking Defense - November 7th, 2025 [November 7th, 2025]
- Goa invokes NSA for three months to tackle anti-socials - The Times of India - November 7th, 2025 [November 7th, 2025]
- CISA, NSA and other unveil security blueprint to harden Microsoft Exchange servers - Homeland Preparedness News - November 7th, 2025 [November 7th, 2025]
- NSA Shares Q3 Revenue Results Below Expectations - GuruFocus - November 7th, 2025 [November 7th, 2025]
- Filipinos aware of civilian supremacy over military NSA Ao - Philippine News Agency - October 28th, 2025 [October 28th, 2025]
- Sonam Wangchuk says his words were twisted to justify his NSA detention - The Statesman - October 26th, 2025 [October 26th, 2025]
- Nokia and stc pioneer the first commercial 5G NSA Cloud RAN deployment in the MEA region - ZAWYA - October 26th, 2025 [October 26th, 2025]
- China accuses NSA of multi-year hack targeting its national time systems - Nextgov/FCW - October 23rd, 2025 [October 23rd, 2025]
- Cybersecurity News: AWS outage, NSA hacking accusations, High risk WhatsApp automation - CISO Series - October 23rd, 2025 [October 23rd, 2025]
- Hackers Say They Have Personal Data of Thousands of NSA and Other Government Officials - Homeland Security Today - October 23rd, 2025 [October 23rd, 2025]
- AWS outage, NSA hacking accusations, High risk WhatsApp automation - LinkedIn - October 23rd, 2025 [October 23rd, 2025]
- Palestinian President Mahmoud Abbas: No Concessions Were Made In The Oslo Accords 1.85 Million Palestinians Returned To Their Homeland;... - October 23rd, 2025 [October 23rd, 2025]
- NSA to partner JKG to drive sports technology through Artificial Intelligence - GhanaWeb - October 23rd, 2025 [October 23rd, 2025]
- China claims NSA hacked its national timing systems using 42 "special cyber weapons" - TechSpot - October 23rd, 2025 [October 23rd, 2025]
- US NSA alleged to have launched a cyber attack on a Chinese agency - csoonline.com - October 21st, 2025 [October 21st, 2025]
- Hackers Say They Have Personal Data of Thousands of NSA and Other Government Officials - 404 Media - October 21st, 2025 [October 21st, 2025]
- China says it has foiled a series U.S. cyberattacks on its critical infrastructure Ministry of State Security says it has 'irrefutable evidence' NSA... - October 21st, 2025 [October 21st, 2025]
- China claims the NSA conducted cyberattacks on its national time center - Engadget - October 21st, 2025 [October 21st, 2025]
- China claims the US NSA conducted cyberattacks on its national time center - TechRadar - October 21st, 2025 [October 21st, 2025]
- Donald Trump's ex-NSA John Bolton indicted; charged over mishandling classified information; Trump calls - Times of India - October 19th, 2025 [October 19th, 2025]
- Trump critic and former NSA adviser John Bolton indicted on classified documents charges - MLive.com - October 19th, 2025 [October 19th, 2025]
- NSA Accused of Stealing Secrets from Chinas National Time Centre - Modern Diplomacy - October 19th, 2025 [October 19th, 2025]
- Ex-Donald Trump NSA John Bolton Indicted: All About The 18 Charges - NDTV - October 19th, 2025 [October 19th, 2025]
- Explained: What are the charges against ex-US NSA John Bolton? What next? - Firstpost - October 19th, 2025 [October 19th, 2025]