Loading story…
CISA reported that Iran-based threat actors exploited known vulnerabilities in enterprise VPN products to gain initial access to victim networks, using exposed remote access infrastructure as a foothold for broader intrusion activity. The campaign highlighted the risk from unpatched perimeter devices and showed how state-linked operators can move from internet-facing appliances into internal environments, targeting organizations in the United States and elsewhere.
A later CISA advisory said Iranian government-sponsored APT actors compromised a U.S. federal network and deployed a cryptominer alongside a credential harvester, indicating both opportunistic monetization and sustained access objectives. The activity tied together exploitation of public-facing weaknesses, credential collection, and post-compromise tooling, underscoring how Iranian operators have combined VPN exploitation with follow-on persistence and abuse inside victim networks.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
CISA later disclosed that Iranian government-sponsored APT actors compromised a federal civilian executive branch network. The intrusion included deployment of a cryptocurrency miner and a credential harvester on the victim environment.
CISA reported that Iran-based threat actors were exploiting known VPN vulnerabilities to gain initial access to networks in the United States and elsewhere. The activity involved targeting unpatched internet-facing appliances and using the access for follow-on intrusion activity.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA warned that Iranian government-sponsored and **Islamic Revolutionary Guard Corps (IRGC)-affiliated** cyber actors exploited unpatched **Microsoft Exchange** and **Fortinet** vulnerabilities to gain access to victim networks, establish persistence, and conduct follow-on malicious activity. The intrusions targeted internet-facing systems and relied on known vulnerabilities to move from initial compromise into broader enterprise environments, underscoring the continued risk from delayed patching of widely deployed edge and email infrastructure. U.S. authorities said the activity evolved beyond espionage-style access into **data extortion** and **disk encryption for ransom operations**, with the same Iranian-linked operators using compromised networks to steal information and pressure victims for payment. The advisories tie the campaigns to state-backed Iranian actors and describe a pattern in which vulnerability exploitation on exposed systems enabled credential access, lateral movement, and disruptive impact across victim organizations.
Jul 12, 2026
Fortinet reported that an Iranian state-backed threat group maintained a long-running intrusion inside a major critical national infrastructure organization in the Middle East, using stolen VPN credentials for initial access and sustaining operations from at least May 2023 through February 2025, with possible compromise indicators dating back to 2021. Investigators said the attackers focused on espionage and strategic prepositioning rather than ransomware, deploying web shells and backdoors including **Havoc**, **HanifNet**, **HXLibrary**, **NeoExpressRAT**, **SystemBC**, and **MeshCentral**, while harvesting credentials, collecting email, and moving laterally across the environment. The attackers also used proxying and tunneling tools such as **plink**, **Ngrok**, **glider proxy**, and **ReverseSocks5** to bypass segmentation and probe restricted networks tied to virtualization and operational technology, though Fortinet said it found no conclusive evidence that the OT network itself was breached or disrupted. After remediation began in late 2024, the group escalated efforts to retain or regain access through removed web shells, RDP and VPN logins, exploitation of an unpatched **ZKTeco ZKBioTime** server, and phishing sent from compromised third-party email accounts, with Fortinet assessing the activity overlaps tradecraft associated with **Lemon Sandstorm**, **Pioneer Kitten**, and **Fox Kitten**.
Aug 15, 2026
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026