What Is the Link Between Unit 313 in the Iranian Revolutionary Guard Corps and the Disruption of Submarine Cables?

     As warnings of a U.S.-Russia clash rose after the Russian invasion of Ukraine, US President Joe Biden warned on March 21, 2022, that Russia was "considering attacks on critical US infrastructure." One of the scenarios that has been put forward since the beginning of the war in Ukraine is that Moscow will attack the submarine cables to cut off the Internet in the West. Since then, fears have increased that the submarine cables will be the target of armed and terrorist attacks.

What are submarine cables? What is their importance? What is their relationship to wars? Were the cables actually targeted? Who did that? What is the extent of the Iranian-Houthi involvement?

An investigation by Sheba Intelligence will attempt to answer all these questions and will devote space to tracking the operations of the Iranian Revolutionary Guard Corps and their relationship to asymmetric warfare, which sees targeting submarine cables as a quick path to victory over major powers.

The submarine cables:

Submarine cables are communications cables laid on the seabed, and they are part of a global network that carries communications between countries. Today, more than 550 underwater cables cross approximately (1.4 million kilometers) of the ocean floor.

Submarine cables between the Red Sea and the Mediterranean Sea transport between 17 and 30% of the world's total Internet traffic, or the data of 1.3 to 2.3 billion people. They transport Internet traffic from Europe to the Middle East, Asia, Africa, and vice versa. There are about 16 cable systems in the Red Sea that connect Europe to Asia.

"Oil without protection"

In his book "The Wires of War," which takes a look at the technology battle between the United States and China, American researcher Jacob Helberg, senior advisor at the Stanford University Center, describes marine optical fiber as "the oil of the 21st century, but it is not protected."

On March 4, 2024, NetBlocks noted that Internet access in Djibouti suffered from an outage. On that date, the Hong Kong Communications Company (HGC) issued a statement confirming the interruption of 4 Internet cables in the Red Sea. The statement estimated that 25% of Internet traffic between Asia and Europe as well as the Middle East, was impacted.

A week before the HGC's announcement, the international telecommunications company "Secom" said a defect in its infrastructure in the Red Sea affected the cable system in Africa. The international telecommunications company stated that the East African part of the cable system that crosses the Red Sea was disrupted on February 24, affecting the flow of (data) traffic between Africa and Europe.

Possible causes

The founder of the Indian company FLAG Telecom, Sunil Tagare, accused Yemen's Houthis of being behind cutting the Internet cables in the Red Sea. The Houthis have vehemently denied the allegations.

The International Committee for the Protection of Submarine Cables said that the anchor of the ship "Rubimar" may caused damage to Internet and international communications cables in the Red Sea. "

At the end of February 2024, the Yemeni Ministry of Communications of the Yemeni government accused the Houthis of planning to attack the Internet and communications cables in the Red Sea. However, Houthis hold the American and British forces responsible for militarizing the Red Sea.

Submarine cables and the "five eyes"

Since the Israeli war on the Palestinians moved to the Red Sea on October 31, 2023, and the Houthi group began targeting Israeli and later American and British commercial ships, the Red Sea has become one of the risky international trade routes. However, the dangers do not stop at the surface of the water, as marine cables off the coasts of Yemen sustained damage.

The term "Five Eyes" refers to an alliance of signals intelligence of the United States, the United Kingdom, Canada, Australia, and New Zealand. This alliance is accused of monitoring the Middle East through data that passes from submarine cables, which makes submarine cables a specific target in any war between allies of the United States and its opponents, in particular, the armed groups loyal to Iran, which pursue an asymmetric war to achieve victories in any confrontation with major powers.

Iran and the Red Sea battle

In 2022, one of the most important leaders of the Houthi group was assigned to create a plan for the submarine cables that pass along Yemen, which led him to contact an international technology company to obtain a cable map under the pretext of expanding the submarine cables connected to Yemen.

Sheba Intelligence approached the company to confirm the identity of the person who contacted it in mid-2022. That person was one of the senior military leaders associated with the military operations in Bab al-Mandab.

At the time, the Iranian Revolutionary Guard had placed submarine Internet cables as part of its battle plan to control the region, according to frequent information, some of which came out in the form of opinions.

The Battle of the Promised Conquest

Through Sheba Intelligence investigators tracking some documents of individuals linked to the Iranian Revolutionary Guard Corps, targeting the submarine cables was part of the battle plan called the Promised Conquest and Holy Jihad, which is the latest battle that Iran is betting on in controlling the Arabian Peninsula and removing Israel from the map, according to statements by Iranian officials.

Documents and literature reveal that Unit 313 of the Iranian Revolutionary Guard Corps and the Al-Ansar Cyber Unit actually carried out two operations targeting submarine cables passing from the Red Sea and are planning a third operation in the Mediterranean Sea.

The operations of the Iranian Revolutionary Guard Corps to disrupt submarine cables:

The first operation: the disruption of four submarine cables

An Iranian news agency post shows that the first operation took place in February 2024 and primarily targeted India and the Gulf states.

On February 26, Simorgh News, affiliated with the Iranian Resistance Axis, published a post that read: "The Ansar disrupted four maritime communications cables between Saudi Arabia and Djibouti in recent months. The successful attack on four cables believed to belong to the AAE-1, Seacom, EIG, and TGN systems indicates a major disruption in communications between Europe and Asia, with most direct damage occurring in the Gulf countries and India."

Simorgh News is an internal information outlet that posts news through Telegram.

Sheba Intelligence tracked the four cables and provided a graphic and informational explanation of each cable that was disabled and the areas that would be affected by such damage.

The first cable is located between Asia and Europe and passes through the Red Sea

The second cable is located between Asia and Africa and passes through the Red Sea.

The third cable is between India and Europe and passes through the Red Sea

The fourth cable is between the countries of the Arabian Gulf and does not pass through the Red Sea

Analyzing the data of the targeted submarine cables shows that the Houthis, who are launching operations in the Red Sea, are not able to cut the cables in the Arabian Gulf. There is another party, so who is it?

The second operation: Disabling three marine cables

Statements by the Cyber Security Unit of the Iranian Revolutionary Guard Corps explained that the second operation on March 6, 2024, aimed to disable three submarine cables linked to Israel.

On March 16, Muhammad Mahdi Babaei published important information about the operation. Babaei is one of the Revolutionary Guard intelligence investigators. He describes himself as a junior analyst in the Axis of Resistance. He has an account on Telegram through which he broadcasts information. He is followed by more than 30,000 leaders of the Revolutionary Guard Corps and armed groups affiliated with Iran.

The information he published claimed that the Houthis targeted three marine cables linked to Israel, and several accounts affiliated with the Axis of Resistance circulated his post, including the account of a Persian-speaking Yemeni news outlet that publishes news via Telegram. It introduces itself as the largest Persian-speaking Yemeni agency. The agency mentioned the names of the targeted cables, which are as follows:

Flag Europe-Asia (FEA)

RAMAN

SAUDI VISION

Photo (4) claims that the Ansar Allah (Houthi) group was responsible for attacking the cablesunder the management and supervision of the Iranian Revolutionary Guard. The accounts that circulated the posts bear the number 313 to indicate their affiliation to Unit 313 of the Revolutionary Guard. This confirms the connection between cyber units in performing intelligence operations, especially with regard to the communications and information technology sector.

Through tracking the targeted cables, Sheba Intelligence found no relationship between the three cables and Israel.

The first cable

It has nothing to do with Israel but rather connects Asia with Europe.

The second cable

This cable has nothing to do with Israel but is used by Saudi Arabia for special internal purposes.

The third cable

It has nothing to do with Israel but connects India, Djibouti, Oman, Saudi Arabia, and Jordan.

Third: Threatening to target submarine cables linked to Israel

Photo (5) shows the next operation will be in the Mediterranean Sea, where the Iranian Revolutionary Guard Corps plans to target Israel's interests, including submarine cables, as follows:

1. MedNautilus submarine System
2. Blue
3. Jonah
4. Andromeda
5. Tamares North
6. IC-1 (This cable is devoted to Israeli ports)

Sheba Intelligence verified the data of the cables:

The first cable

It has two branches, which are both connected to a port in Israel.

The second cable is linked to Israel

The third cable passes from Israel

The fourth cable is linked to Israel

The fifth cable  linked to Israel

The sixth cable: Inside Israel

Serving the interests of Russia and China

By tracking the actual targeting operations and the threat of targeting the submarine cables, we find that the common factor is Iran and Israel. The operations targeting the cables come within the battle plan of the Iranian Revolutionary Guard Corps. But the submarine cables linked to Israel are only under threat and have not been touched, while other submarine cables were actually targeted.

The targeting operations carried out by units affiliated with the Revolutionary Guard Corps in Yemen disrupt communications operations between East and West in a way that serves the Russian and Chinese agenda, but the attacks do not target Israel in any way.

The Iranian threats to target Israel in the Mediterranean Sea are the potential operations that will be carried out by the Revolutionary Guard Corps, which manages air and naval battles from within Yemeni territory in the Red Sea and the Arabian Sea, and its future battle will be in the Mediterranean Sea.

What do you know about Unit 313 of the Revolutionary Guard, which carried out attacks against submarine cables?

Unit 313 of the Iranian Revolutionary Guard is part of the Quds Force 300 Electronic Command led by General Hamid Reda. Unit 313 is specialized in Yemen and has links to other military units, such as the Al-Ansar Cyber Unit, whose mission is to help the rest of the units launch cyber attacks and set technical plans before implementing any operations.

Unit 313 has links to Iranian military units in Yemen, such as the unit of command and control in the air defense in Yemen led by the Iranian general Sayyid Ahmad Hosseini Benjaki, and the drone and missile force in Yemen led by the Iranian general Ali Mahdian, who is accused of cyber crimes to influence the American elections.