Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters

MITRE Techniques

• [T1190] Exploit Public-Facing Application – Exploitation of internet-facing systems and exposed industrial devices was a recurring access path, including exposed PLCs and remote services (‘internet-facing Rockwell Automation and Allen-Bradley PLCs’, ‘exposed internet-facing systems’).
• [T1078] Valid Accounts – Compromised accounts, service-provider credentials, and legitimate admin access were used to maintain and expand access (‘persistent access’, ‘the authority already granted to an administrator, service account, RMM agent, identity provider, or support organization’).
• [T1133] External Remote Services – Service-provider and remote-management pathways were abused to move into targets (‘existing RMM access and compromised IT-provider environments opened paths into targets’).
• [T1219] Remote Access Software – Legitimate RMM tooling was leveraged as an access vector and to abuse deployed management capabilities (‘existing RMM access’, ‘abused a legitimate deployment feature’).
• [T1566] Phishing – Recruitment-themed social engineering and high-trust lures were used to gain access or credentials (‘tailored recruitment lures’, ‘high-trust social engineering’).
• [T1585] Establish Accounts – Personas and channels were repeatedly created or re-established to support influence and narrative operations (‘continued to establish new infrastructure’, ‘communications channels for influence and narrative control purposes’).
• [T1059] Command and Scripting Interpreter – A malicious file was used to execute commands and conceal activity (‘the actor used a malicious file to execute commands and conceal activity’).
• [T1204] User Execution – Operations relied on user interaction with malicious files or lures to enable execution (‘malicious file to execute commands’).
• [T1071] Application Layer Protocol – Data was attempted to be moved to commercial cloud storage and other online services (‘attempted transfer of data to commercial cloud storage’).
• [T1021] Remote Services – Remote administration and management channels were central to access and lateral movement (‘remote-management foothold’, ‘RMM access’).
• [T1499] Endpoint Denial of Service – Disruptive activity and outages were associated with destructive or availability-impacting operations (‘leaks, defacements, and outages’, ‘operational disruption’).
• [T1485] Data Destruction – Wiping and destructive campaigns were described as part of persona operations (‘destructive intrusions’, ‘recent Handala wiping script’).
• [T1486] Data Encrypted for Impact – Although not a classic encryption case, the article frames destructive impact operations that render systems unusable (‘combine destructive intrusions with data publication, doxxing, and threats’).
• [T1565] Data Manipulation – OT reporting described manipulation of project files and HMI/SCADA displays (‘manipulation of project files and HMI/SCADA displays’).
• [T1090] Proxy – VPNs and related intermediary tools were used to bypass restrictions and reach services (‘users seeking secure communications… turn to VPNs’).