Although there is currently a ceasefire in place, geopolitical tensions between the United States and Iran continue to escalate. As a result, we're witnessing a corresponding surge in Iranian-sponsored cyber activity targeting American organizations. Recent U.S. military strikes on Iranian nuclear facilities have prompted the Department of Homeland Security to issue warnings about heightened cyber threats from Iranian hacktivists and state-affiliated groups.
The data we're seeing from both our customer environments and research infrastructure tells a clear story: cyber operations from nation states like Iran are becoming more sophisticated, coordinated, and persistent.
Blumira provides a security operations platform for over 18,000 organizations to find and address threats and risks in their environment. Over the past 21 months, we've tracked 824 security incidents targeting our customers that can be attributed to Tactics, Techniques, and Procedures (TTPs) by Iranian cyber actors and Iranian-sourced networks. This sustained campaign included 383 RDP brute force attempts, 27 SSH attacks, and 414 web application scans, all originating from 67 unique Iranian IP addresses.
What makes this particularly concerning isn't just the volume but the timing and coordination. Our publicly-exposed security research lab has been monitoring Iranian reconnaissance patterns since June 2024, and the correlation between cyber activity spikes and geopolitical events is unmistakable:
These aren't random port scans or opportunistic attacks. They represent systematic intelligence gathering that military strategists call "preparation of the battlefield."
Iranian cyber groups have evolved considerably over the past two years. We're tracking several key Advanced Persistent Threat (APT) groups:
APT33 (Elfin Team, Refined Kitten, HOLMIUM, Peach Sandstorm)has expanded beyond traditional espionage to focus on satellite communications and critical infrastructure. In May 2024, they successfully compromised a U.S. swing state government entity, demonstrating their capability to target election infrastructure.
APT34 (OilRig, Helix Kitten, Hazel Sandstorm) is an Iranian threat group that has targeted various sectors, including financial, government, energy, chemical, and telecommunications, since at least 2014.
APT35 (Magic Hound, Charming Kitten, Phosphorus) has incorporated AI-enhanced social engineering techniques and continues to focus on aerospace and critical infrastructure sectors.
MuddyWater (Seedworm, Static Kitten, TEMP.Zagros) adopted the sophisticated DarkBeatC2 command-and-control framework in 2024, significantly enhancing their operational capabilities.
CyberAv3ngers (Soldiers of Soloman), affiliated with Iran's Islamic Revolutionary Guard Corps, specializes in targeting industrial control systems, particularly water infrastructure and Israeli-made Unitronics PLCs.
Our analysis shows Iranian actors are particularly focused on several key sectors:
If your organization operates in any of these sectors, you should assume you're being actively considered by Iranian threat actors.
The current conflict represents more than just another geopolitical crisis; it's a demonstration of how modern conflicts play out in cyberspace. And while the threat is real, it's not insurmountable: with the right preparation, tools, and expertise, organizations can build the resilience needed to withstand even nation-state attacks. The question isn't whether your organization will face disruptive events, whether by threat actors or acts of nature; it's whether you are prepared.
The key is to move beyond a purely defensive mindset and toward a proactive security posture. Instead of trying to build perfect walls around your organization, focus on building the capability to quickly detect risky and suspicious activity, understand what that activity represents, and respond effectively to mitigate and maintain operations.
We believe security shouldn't be about fear — it should be about building operational resilience. While nation-state threats like those above can seem overwhelming, our approach focuses on building security operations that keep the business running smoothly by focusing on addressing risk holistically, not just detecting the next threat. We provide visibility where it matters most, actionable guidance when you need it, and human expertise when critical issues arise – because we're passionate about helping the people behind the technology who keep their organizations safe every day.
Ready to strengthen your cyber defenses? Read our post about what you can do today to help protect your organization against cyber threats and build the operational resilience you need for the modern threat landscape.
This analysis is based on security intelligence gathered from our anonymized customer environments and research infrastructure. All data shared comes from legitimate security research operations designed to improve community threat intelligence and help organizations better defend against advanced threats.