The cyber capabilities of the Lebanese Hezbollah militia have significantly escalated. This was evidenced by a report from the cybersecurity company “ClearSky” in late January, which revealed that a Hezbollah-affiliated hacking group, named “Lebanese Cedar,” had carried out a global espionage campaign. Additionally, intelligence reports have indicated that the Iranian Revolutionary Guard Corps (IRGC) has established a new cybersecurity unit within Hezbollah’s counterintelligence apparatus. Hezbollah’s current efforts to bolster its cyber capabilities can be understood as a move to enhance the militia’s ability to easily spy on various Lebanese state institutions. It is also expected that Hezbollah might seek to leverage its growing cyber strength to launch cyber-attacks against some regional countries. The establishment of a new intelligence unit by Tehran for Hezbollah, under Iran’s supervision, aligns with Iran’s broader strategy to tighten its control over Lebanon.
Several key indicators point to the significant rise in Hezbollah’s cyber capabilities and the motivations behind the militia’s efforts to enhance its abilities in this domain:
1. Global Espionage Campaign:
The Tel Aviv-based cybersecurity company “ClearSky” reported in late January that a hacking group backed by Hezbollah had executed a global espionage campaign, primarily targeting telecommunications networks in several countries worldwide.
The company detailed that the hacking group, known as “Lebanese Cedar,” successfully breached over 250 servers in the United States, the United Kingdom, Egypt, Jordan, Lebanon, Israel, and the West Bank. The espionage campaign, launched by “Lebanese Cedar,” began in early 2020 before it was recently uncovered. The cyber-attacks conducted by this group aimed to gather intelligence and steal databases containing sensitive information. Media reports have suggested that most members of the “Lebanese Cedar” group were selected from the joint Iranian-Lebanese unit, which acts as an electronic army established following the assassination of former Lebanese Prime Minister Rafik Hariri in 2005.
2. Establishment of an Internal Espionage Unit:
According to reports like the one from Intelligence Online on March 24, the IRGC’s Quds Force has established a new cybersecurity unit within Hezbollah’s counterintelligence apparatus. These reports suggest that “Jawad Hassan Nasrallah,” the son of Hezbollah leader Hassan Nasrallah, is involved in this unit. The new unit’s purpose is to train Hezbollah spies in executing cyber-attacks.
The reports also noted that the new unit is headquartered in an abandoned building in the southern suburbs of Beirut. Tehran has equipped this headquarters with the latest technologies, similar to what was done at Sharif University in Tehran, which teaches computer science to around 90,000 students. The computer scientists from this university form a valuable talent pool for Iran’s intelligence agencies. The reports speculate that the IRGC will oversee the training of hackers in Beirut, who are recruited from Lebanon, Iraq, and Syria, to educate them on social profiling, direct cyber-attacks, and influence campaigns.
3. Spying on Lebanese State Institutions:
Hezbollah’s current push to enhance its cyber capabilities can be seen as an effort to increase the militia’s ability to easily spy on various Lebanese state institutions. This, in turn, would bolster Hezbollah’s strength in the domestic power balance within the country, allowing it to counter other forces.
4. Strengthening Iranian Control Over Lebanon:
Tehran’s establishment of a new intelligence unit for Hezbollah and its supervision of this unit is part of Iran’s broader strategy to tighten its grip on Lebanon. This move aligns with pledges made by the IRGC’s commander, Major General Hossein Salami, to expand the cyber and technical capabilities of Iran’s intelligence apparatus following the death of Qasem Soleimani.
In summary, the escalation of Hezbollah’s cyber capabilities represents a qualitative leap in the tools and resources at the militia’s disposal. This development is likely to enhance Hezbollah’s disruptive role in the region. Furthermore, Iranian oversight of these growing capabilities will solidify Hezbollah’s position as a key instrument in the regional project that Tehran is pursuing.
