Iranian Cyber Threats Intensify Against U.S. Defense and OT Networks, Warn Federal Agencies

U.S. Agencies Warn of Escalating Iranian Cyber Threats to Defense and Critical Infrastructure

Multiple U.S. cybersecurity and intelligence agencies have issued a joint advisory cautioning organizations about an uptick in malicious cyber activity tied to Iranian state-sponsored and affiliated actors.

In a unified statement, the Cybersecurity and Infrastructure Security Agency (CISA), FBI, Department of Defense Cyber Crime Center (DC3), and National Security Agency (NSA) warned that Iranian-aligned threat groups have increased their activity in recent months—and the trend is expected to intensify amid escalating tensions in the Middle East.

"These cyber actors often exploit unpatched systems, outdated software, or devices and accounts with default or commonly used passwords," the advisory said.

---

No Coordinated Campaign—Yet

While the agencies have not seen evidence of a coordinated cyber campaign targeting U.S. infrastructure, they emphasized the need for heightened vigilance, particularly across the Defense Industrial Base (DIB) and organizations linked to Israeli research and defense sectors. These entities are considered high-risk targets for ransomware attacks, spear-phishing campaigns, and distributed denial-of-service (DDoS) operations.

---

How Iranian Cyber Actors Operate

Iranian threat groups often begin attacks with internet-wide reconnaissance tools like Shodan to identify vulnerable, internet-connected devices—particularly in Operational Technology (OT) and Industrial Control System (ICS) environments.

Once inside a network, they exploit common weaknesses like poor segmentation or misconfigured firewalls to move laterally. Past campaigns have involved:

• Remote access tools (RATs)

• Keyloggers

• Legitimate admin utilities like PsExec and Mimikatz

• Password cracking techniques, including brute-force attacks and exploiting default credentials

These attackers are also known to leverage system engineering and diagnostic tools to gain a foothold in OT environments.

---

Recent Activity and Threat Intelligence

Just last week, cyber intelligence firm Check Point reported that Iranian group APT35 targeted Israeli journalists, cybersecurity professionals, and academics with spear-phishing campaigns. The goal: steal Google credentials through fake login pages or fraudulent Google Meet invites.

This surge in activity coincides with a recent Department of Homeland Security (DHS) bulletin, which urged U.S. organizations to be prepared for possible "low-level cyber attacks" from pro-Iranian hacktivist groups amid ongoing geopolitical hostilities.

---

Mitigation Recommendations for U.S. Organizations

In light of the growing threat landscape, federal agencies recommend the following immediate actions:

• Disconnect OT/ICS assets from the public internet wherever possible

• Use strong, unique passwords and replace any default device or service credentials

• Enforce phishing-resistant multi-factor authentication (MFA), especially for remote access to OT networks

• Apply the latest security patches across all systems to eliminate known vulnerabilities

• Monitor access logs for suspicious activity, particularly involving remote access to sensitive networks

• Implement strict change management protocols to avoid unauthorized modifications or loss of control in OT environments

• Maintain full system and data backups to ensure recovery in the event of an attack

For organizations unsure where to begin, start by reviewing your external attack surface—identify exposed systems, open ports, and outdated services. Free tools like Nmap, or CISA’s Cyber Hygiene scanning service, can be useful for this.

Aligning your defenses with the MITRE ATT&CK framework can also help prioritize countermeasures based on real-world attack behaviors.