Massive fire breaks out at Iranian petrochemical plants; "Computer systems likely hacked"

On Thursday, October 2, the Associated Press reported, referring to the consecutive fires in Iranian petrochemical plants, that the continuation of these incidents has increased the possibility of suspicions of hacking of petrochemical systems and software sabotage in Iran.

The report, citing Iranian officials' statements about "some cases of (virus) contamination," adds that hacking of systems may have played a role in these accidents.

The Associated Press writes that Iranian officials have insisted that six fires at petrochemical plants and other equipment over the past three months were not related to cyberattacks, but the government's confirmation of the virus contamination raises the possibility of a coordinated effort to target Iranian petrochemical equipment, just as the Stuxnet virus disabled thousands of Iranian uranium enrichment centrifuges several years ago.

According to the report, the worst recent incident was the fire at the Bu Ali Sina petrochemical plant, which Iranian insurance officials estimated to cost $67 million in damages. Iranian officials attributed the incident to a leak of paraxylene, a flammable substance.

The report adds that other fire incidents include:

– The fire at the Bisotun petrochemical storage tank on July 29, which Iranian authorities attributed to a power grid failure.

– The explosion of the Genaveh gas pipeline on August 6th, which killed one person and injured three others.

– A fire on August 7 at the Bandar Imam petrochemical tank, which took two days to extinguish.

– Fire in the effluent pond of phases 15 and 16 of South Pars on August 30 (September 9).

– And finally, the fire at Mobin Petrochemical on September 14, which injured four people.

The report refers to initial statements by Brigadier General Gholamreza Jalali, head of the Passive Defense Organization, who denied that the incidents were related to cyber sabotage, writing that Iran's aging equipment and pipelines have been left worn out by years of sanctions, and that, on the other hand, after the sanctions, Iran's production has seen a rapid increase in the past year. At the same time, "Iran also faces occasional attacks by separatist groups."

The report adds, however, that on August 27, Sardar Jalali warned that petrochemical industries had been attacked, attributing the cause to imported equipment and its installation in these industries.

According to IRNA news agency, he said that "viruses had infected petrochemical complexes and unusual commands of virus software could be dangerous."

However, he stressed that cyberattacks were not the cause of the fires. Jalali went on to say that defensive measures were being taken, but did not provide details.

The report adds that it is not yet clear whether Iran, which has recently expanded its cyber-attack countermeasures software, is capable of warding off the threats, but Russia's Kaspersky, one of the largest developers of content security management systems that was involved in the Stuxnet investigation, told The Associated Press that it was not involved in the investigation into Iranian petrochemicals.

The Associated Press further cited Jalali's remarks regarding viral contamination from imported parts, raising suspicions that a foreign power may be behind this issue.

Rubin Mills, an industrial expert and president of Qamar Energy in Dubai, told the news agency that Iran often sourced parts on the black market during the sanctions. “They probably weren’t always able to buy high-quality parts and were forced to buy second-hand equipment that was either of poor quality or didn’t meet the required standards,” he said.

Idan Udi Edri, a former Israeli military official who is now CEO of cybersecurity firm NationA, told the news agency that attacks like this require "a lot of resources" and cannot be the work of individual hackers.

Regarding the possibility of fires in Iranian petrochemical plants due to cyberattacks, he said that he is "100 percent" certain of this, given his own company's experience and monitoring, although no organization, government, or company would ever claim responsibility for these attacks.

However, Ralph Langer, another industry expert who also studied the Stuxnet virus, told The Associated Press that while his company has not investigated the matter, it is unlikely that the fires were the result of cyberattacks.

The Associated Press writes that there is widespread suspicion that the United States and Israel were behind Stuxnet. "Although the virus was the most famous cyberattack on Iran, it was not the only one targeting the country's industries."

Source: Radio Farda