Security Market Segment LS
Friday, 22 February 2019 11:48

Iran or China? Competing claims about actor behind Parliament hack Featured

Iran or China? Competing claims about actor behind Parliament hack Pixabay

The Australian Parliament was hacked by a group based in Iran, a hitherto unknown security firm has claimed, adding that the Mabna Institute, which was backing the person or people involved, had also been implicated in attacks on the US and other Western countries.

The company which made the claim, Resecurity, said the attack was part of a wave which had targeted the Five Eyes intelligence alliance: the US, the UK, Canada, Australia and New Zealand.

The attack was made public on 8 February and on Monday Australian Prime Minister Scott Morrison claimed a sophisticated state actor was behind the breach.

His claim was contested by an American security professional, Joseph Carson of security outfit Thycotic, on Wednesday.

On Tuesday, it was reported that the attackers appeared to have used Web shells — scripts that can be uploaded to a Web server to enable remote administration of a machine — to effect the infiltration.

Resecurity president Charles Yoo told  The Wall Street Journal that the Mabna Institute was linked to Iran's Revolutionary Guard.

But the Sydney Morning Herald, citing "top-level sources", said China, not Iran, was behind the attack. These sources termed the Mabna theory an unlikely one, adding that China remained the main suspect.

As proof of his claim, Yoo showed the WSJ a database of 7354 records which had phone numbers and email addresses for Australian MPs and parliamentary staffers. It also included contact details for staff and ministerial advisers of most parties.

However, he did not say from where he had obtained the material.

iTWire sought to obtain more detail from Resecurity as the company had not issued a formal statement about its claims. A spokesperson said the company would issue comment soon, but nothing was received by the time of publication.

Comment was also sought from the Australian Cyber Security Centre about the competing claims of attribution. The ACSC said it would respond but had not done so at the time of publication.

Update, 23 February: An Australian Cyber Security Centre spokesperson said in response to a query: "Our cyber experts believe that a sophisticated state actor is responsible for this malicious activity.

"It would be too early to speculate on the specific offender – our immediate focus has been on securing the networks, protecting victims and conducting ongoing investigations.

"Proper and accurate attribution of a cyber incident takes time and any attribution would be done in a measured fashion.

"The public can rest assured that our security and intelligence agencies have identified the malicious activity and are responding appropriately."


You cannot afford to miss this Dell Webinar.

With Windows 7 support ending 14th January 2020, its time to start looking at your options.

This can have significant impacts on your organisation but also presents organisations with an opportunity to fundamentally rethink the way users work.

The Details

When: Thursday, September 26, 2019
Presenter: Dell Technologies
Location: Your Computer


QLD, VIC, NSW, ACT & TAS: 11:00 am
SA, NT: 10:30 am
WA: 9:00 am NZ: 1:00 pm

Register and find out all the details you need to know below.



iTWire can help you promote your company, services, and products.


Advertise on the iTWire News Site / Website

Advertise in the iTWire UPDATE / Newsletter

Promote your message via iTWire Sponsored Content/News

Guest Opinion for Home Page exposure

Contact Andrew on 0412 390 000 or email [email protected]


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments