Strategic Threat Intelligence Bulletin: Strike on Soleimani - Why Iran's Hands are Tied

Strategic Threat Intelligence Bulletin: Strike on Soleimani - Why Iran's Hands are Tied

Despite the gravity of the targeted strike against the iconic Qassem Soleimani, Iran is hamstrung in its ability to respond more significantly to the United States because of feared retaliation and escalation. Iran cannot afford an escalatory cycle of events with the US, especially one that it would be perceived as losing, making any devastating response to the United States a highly risky proposition that could start an unwinnable cycle of violence. For this reason, many options seemingly on the table, including a devastating cyber blow, are not actually suitable for Iran. The most likely response by Iran in the coming months—should it even decide to further respond at all—is a limited but targeted attack against U.S. assets in the region, probably either against the Baghdad embassy or naval assets in the Persian Gulf.

Recommendations

Companies that operate or have locations in the Middle East should monitor for any potential change in tensions between Iran and the United States. Identify any physical assets or entities that may be collocated with the U.S. government or that may have overt U.S. government connections—such as government contractors—and conduct an audit of your physical security protections for those assets. Develop robust incident response and contingency plans for interruptions of high-risk locations.

The low likelihood of an Iranian cyber attack against private companies does not negate the benefits of preparing for intrusions. Companies can help mitigate potential Iranian intrusions by following many best practices:

• Beware of phishing and social engineering schemes that have allowed for initial access in past Iranian intrusions.
• Iranian APTs have reportedly been targeting vulnerabilities in VPN services as of late and have been reported in the past using other exploits for initial access. Ensure your VPN capabilities and other externally facing services—such as RDP—in particular are patched, and disable unnecessary ports, protocols, and services where possible.
• To mitigate lateral movement, require complex passwords and multi-factor authentication wherever possible.
• Iranian actors have conducted DDoS attacks against private companies in the past, so ensure your protections for these types of attacks are up-to-date.
• Iranian actors have been attributed to wiper attacks in the past; although this type of attack is unlikely as retribution, maintaining off-site backups for your most critical data will help mitigate this threat.

Details

The Logic of the Missile Strikes

The United States’ strike against Qassem Soleimani—a military commander, leader, and hero like no other in Iran—was a significant blow to Iran’s military and the country as a whole. Head of the Islamic Revolutionary Guard Corps’ Quds Force, he was the mastermind for decades behind Iran’s overseas operations that gave the country substantial influence in the region. The U.S. strike was highly targeted, bombastic, and an affront to this influence in the region, especially in Iraq. For both domestic and international reasons Iran was forced to respond to this in short order.

Iraq’s Shia majority government is currently heavily influenced by Iran, and Iran’s ability to leverage irregular forces into control in the region is perhaps best exemplified by its role in Iraq. The magnitude of the U.S. strike in a country where Iran has significant influence required a demonstration of force to reassure allies and warn enemies that Iran would not give up its freedom of movement in the region.

By responding in kind, Iran mitigated the chances for further escalation. Iran was clearly keen to avoid further escalation beyond their missile attack: Tehran reportedly passed warnings about the missile strikes through other countries, giving the US enough time to move personnel to fortified bunkers, and Iranian officials also claimed the attack was “proportionate” and in “self-defense” under the UN Charter. Choosing the missile attack as its immediate reaction to the Soleimani strike afforded Iran a relatively measured and controlled response, enough to send a message but, as evidenced, not so much to prompt escalation. In contrast, switching the response from the same physical location and similar type of munition to, for example, the cyber domain and out of theater would have likely been viewed as escalatory by the United States, possibly prompting U.S. retaliation directly against assets in Iran.

Iran’s Current Calculations

The missile strikes against bases in Iraq solved the immediate need to show force, but especially because the impact was limited (in part perhaps because of warnings), Iran probably feels it needs to take further action. Iran has to prove to regional adversaries as well as its domestic audience—both the general populace and fundamentalist factions—that it will not allow other states to take such grievous action without retribution. A weak response might be seen by regional powers as a sign that Iran is distracted or unable to maintain its regional power status. A firm, calculated show of force could bolster nationalist pride and divert attention in the midst of some of the worst protests in the last decade, which were exacerbated by the Iranian regime’s admission of guilt in shooting down the Ukrainian airliner on January 8.

At the same time, Tehran wants to avoid any further escalation that could spin into a conflict it is not prepared for or capable of winning. Iran is already involved in some manner in conflicts in Iraq, Syria, Lebanon, and Yemen. Furthermore, despite Iran’s large conventional military, the United States’ superior air power, precision strike capability, and advanced technology would likely result in a significantly lopsided conflict favoring U.S. forces. A full-scale conflict between the United States and Iran might also draw in regional powers allied against Iran such as Saudi Arabia. By contrast Iran’s allies in the region are limited to proxy groups and a war-damaged Syria, and other global powers like Russia and China would probably provide only non-lethal aid and possibly limited lethal aid.

Iran’s concerns about U.S. retaliation are substantiated by over a decade of extrajudicial killings under the U.S. drone program and statements by current Administration officials. U.S. Secretary of Defense Mark Esper stated after the Iranian missile strike that the United States had the authority to strike against both Iran and its proxies in retaliation for any subsequent attacks. U.S. special representative for Iran Brian Hook stated that Soleimani’s successor, Esmail Ghaani, would “suffer the same fate” as Soleimani if he targeted Americans.

What are Iran’s Options?

On paper, Iran has a wide range of options to further harm the United States, including the oft-mentioned cyber attack. In practice, Iran will most likely need to meet certain criteria in order to judge a response to the United States as successful, limiting the options available. Those criteria do not simply include revenge for the targeted strike, but also posturing and the possibility of American retaliation and escalation, which is a significant constraint on any of Iran’s actions. Assuming Iran decides it needs to take further action, the only two options that meet all of these criteria are kinetic action or a cyber attack, and between those two, kinetic action is much more likely, because for a cyber attack to meet the criteria, it would likely be seen as a significant escalation and thus invite U.S. reprisals in Iran itself.

The criteria that Iran will likely consider in determining how to further respond to the United States include:

• Revenge
  • The action should make it clear it is retaliation for the strike on Soleimani.
    • It must be attributed to the Iranian state or Iranian-affiliated forces (as opposed to unaffiliated sympathizers or unknown actors).
  • It should be within a 3-month window to avoid confusion about whether it is retaliation or serves some other strategic purposes.
• Posturing
  • The action should send the message to sympathetic domestic and regional audiences, as well as regional adversaries, that Iran will not tolerate such actions without a response.
  • The action should be arguably proportionate to allow Iran to justify its response to the international community, for example under the U.N. Charter’s Article 51 (self-defense).
  • The action must beget the right type of attention on the event to have the most impact possible under the conditions. It should be visible and striking enough as to guarantee wide media coverage.
• The risk of U.S. reprisal
  • Any action should be no more than and most likely would be less than proportionate to avoid a subsequent U.S. reprisal.
  • It should be targeted to avoid a significant increase in the number of casualties.
  • It should focus on U.S. military influence in the region.

A kinetic strike on U.S. assets in the region meets many of the objectives. Whether by proxy groups or Iranian forces, a direct attack would send a clear message of retaliation, because even if conducted by a proxy group, the United States would consider such attacks the responsibility of Iran. Using proxy groups also may lessen the risk of retaliation by offsetting the attribution, though with Soleimani now deceased, control over Iranian-aligned proxy groups may be more difficult. Direct attacks would also probably be the easiest to accomplish in a short timeline given Iran’s foothold in the region, and there are a variety of physical targets given the United States’ presence.

The risk of U.S. reprisal significantly constrains Iran’s ability to respond via cyber means. An offensive attack risks retaliation because it changes the domain of the military action, opening up the possibility for the United States to respond via other offensive methods. It also might be difficult to achieve in a short- to mid-term time frame. American assets in the region are likely to be heavily guarded from a cyber perspective, while softer targets inside the United States might be easier to target but would be more likely to prompt escalation and retaliation because it expands the operational area outside the Middle East. Too, a cyber offensive that is measured enough to avoid retaliation risks ambiguity and an underwhelming effect; however, a larger attack that is more clearly attributed risks retaliation. There is a fine line that Iran would need to walk to achieve the right retaliation via cyber methods, and it may be difficult for Iran to accurately judge likely responses to a cyber attack.

Iran would most likely choose to respond via a cyber attack as a secondary option to kinetic action. Choosing cyber would most likely be the result of unpredictable internal factors, such as disputes and challenges among top government or military officials that affect decision-making or kinetic capabilities.

Other theoretical options—such as missile testing and conventional weapons development, nuclear advancements, or a disinformation campaign—do not clearly demonstrate revenge against the United States. Since the U.S. strike, Iran has already revealed a new ballistic missile and attempted to launch a satellite. Yet even though the United States has objected to Iran’s missile development and space launches, there was no media coverage or U.S. government statement connecting these most recent activities to any retaliation. However, Iran might consider missile testing and these other capabilities to help with the goal of posturing while also accomplishing longer-term strategic goals.

The Likeliest Option

Iran must choose an option where it can carefully control the risk for retaliation, otherwise it risks getting into an uncontrollable escalation cycle at a time when it is encumbered with significant domestic challenges and other regional conflicts. A follow-up kinetic attack by Iranian forces or proxy groups against US forces in the region is the option that would best achieve Iran’s objectives as outlined. Such an attack could be carefully moderated to avoid retaliation while emphasizing the message that Iran maintains control in the region.

One of the most high-profile targets in the region include the U.S. embassy in Baghdad, which has already been attacked by Iranian-affiliated proxy groups and would send an unmistakable message to the United States, who has had an embassy attacked by Iran once before. Another potential target in the region is the U.S. Fifth Fleet headquartered in Bahrain, another country with Iranian-affiliated proxy groups. Targeting U.S. naval vessels in the Persian Gulf with, for example, limpet mines would be a feasible option and one that Iran has reportedly used before.

In the unlikely event Iran did decide to respond with a cyber attack, it would likely be a relatively showy but low-impact cyber attack, probably against a softer, government-related target inside the United States. Such an attack would be focused first on government and then on peripheral industries, such as defense contracting or think tanks. Only after exploring those targets would Iran likely consider other U.S. companies with less clear connections to the government.