Iranian Cyber Activity Persists

Iranian cyber groups are actively using spear-phishing and credential attacks to target organizations, even after reported Israeli strikes aimed at disrupting their capabilities. These attacks are often part of broader campaigns that combine espionage with disruptive tactics. The Israel Defense Forces (IDF) reported striking a "large Iranian terror regime military compound" in Tehran in early March, which they identified as the Cyber Warfare headquarters of the Islamic Revolutionary Guard Corps (IRGC). Despite this, cybersecurity researchers have observed continued Iranian-linked cyber activity across the region. Iranian cyber operations frequently involve exploiting stolen data and AI to create sophisticated spear-phishing campaigns that can escalate into attacks on critical infrastructure. They have been known to target organizations holding large individual-level data sets, including ISPs and telecommunications providers, potentially to identify regime dissidents. Defenders should monitor for repeated login failures across multiple users, authentication attempts from unusual locations, MFA fatigue attacks, and logins outside of normal working hours to identify potential credential attacks. Iranian actors also commonly abuse remote access tools and suspicious DLLs. The DoD's Zero Trust strategy emphasizes verifying every identity and device to protect sensitive assets. This includes implementing baseline capabilities across seven pillars, with a focus on identity-centric security. The DoD Zero Trust framework is built on tenets such as "never trust, always verify" and assuming a hostile environment. Splunk users can leverage out-of-the-box detection searches and analytic stories to identify patterns and anomalies indicative of Iranian cyber threats. These resources can help in detecting spear-phishing, password spraying, and other credential theft methodologies. To strengthen operational resilience, organizations should rapidly mitigate external vulnerabilities, especially in network edge devices, and avoid directly connecting control systems to the public internet. Strong, unique passwords should be used across different accounts.