> ## Content Index
> Fetch the complete content index at: https://blog.alphahunt.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# Iranian Cyber Operations 2025: Escalation, Ransomware Collaboration, and Critical Infrastructure Targeting
- URL: https://blog.alphahunt.io/iranian-cyber-operations-2025-escalation-ransomware-collaboration-and-critical-infrastructure-targeting/
- Published: 2025-06-17T12:00:54.000Z
- Updated: 2026-10-23T23:47:22.000Z
- Description: Iranian cyber threat actors have evolved into highly capable, multi-motivated operators, leveraging both state sponsorship and ransomware affiliate partnerships to conduct espionage, sabotage, and financially motivated attacks. In 2025, the Iran-Israel conflict has catalyzed a surge in..
- Author: Wes
- Tags: iran, charming-kitten, oilrig, israel, apt, 2025

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Get questions like this:

1. **which iranian threat actors have been active over the past few months?**
2. **How have Iranian threat actors adapted their tactics in response to recent cybersecurity defenses and geopolitical developments?**
3. **What might we expect from these groups in the coming weeks and months?**

Does it take a chunks out of your day? Would you like help with the research?

This **baseline** report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? [Get Started Here!](http://alphahunt.io/?ref=blog.alphahunt.io)

Did this help you? Forward it to a friend!

---

# Suggested Pivot

How are Iranian cyber threat actors adapting their exploitation of VPN and firewall vulnerabilities (e.g., CVE-2024-21887, CVE-2024-3400) in response to recent patching and detection efforts by U.S. critical infrastructure and cloud/SaaS providers? Understanding these adaptations is critical to preempting next-generation intrusion techniques.

---

# TL;DR

## Key Points

1. - Iranian state-sponsored and affiliated actors have escalated cyber operations in 2025, targeting U.S. and global critical infrastructure, cloud/SaaS, and private sectors, with a focus on exploiting VPN and firewall vulnerabilities.
  - Organizations must prioritize patching, detection, and proactive defense against exploitation of CVEs such as CVE-2024-21887, CVE-2024-3400, and CVE-2024-24919.
2. - Pioneer Kitten and other Iranian groups are collaborating with ransomware affiliates (NoEscape, Ransomhouse, ALPHV/BlackCat), blending espionage, sabotage, and financially motivated attacks.
  - Enhanced incident response, ransomware-specific tabletop exercises, and immutable backups are critical to mitigate operational and financial impact.
3. - Iranian actors are employing advanced persistence and evasion techniques, including passive web shells, scheduled tasks with DLL side-loading, protocol tunneling (Ligolo, NGROK), and disabling security tools.
  - Endpoint detection and response (EDR), threat hunting, and continuous monitoring for Iranian TTPs are essential for early detection and containment.
4. - Cloud/SaaS environments and supply chain vendors are increasingly targeted for lateral movement and data exfiltration.
  - Cloud Security Posture Management (CSPM), zero-trust architecture, and rigorous third-party risk management are required to reduce exposure.
5. - The Iran-Israel conflict is driving a surge in hacktivist operations and multi-sector targeting, with anticipated regulatory and policy responses in the U.S. and allied nations.
  - Intelligence sharing, interagency coordination, and compliance with frameworks like NIST SP 800-161 are necessary for sector-wide resilience.

## Executive Summary

Iranian cyber threat actors have evolved into highly capable, multi-motivated operators, leveraging both state sponsorship and ransomware affiliate partnerships to conduct espionage, sabotage, and financially motivated attacks. In 2025, the Iran-Israel conflict has catalyzed a surge in sophisticated campaigns targeting U.S. and allied critical infrastructure, energy, government, cloud/SaaS, and telecommunications sectors. Notably, groups such as Pioneer Kitten (Fox Kitten, UNC757) exploit high-profile VPN and firewall vulnerabilities (e.g., CVE-2024-21887, CVE-2024-3400) to gain initial access, deploy web shells (TEMPLEDOOR), and maintain persistence through advanced evasion techniques.

These actors increasingly collaborate with ransomware groups (NoEscape, Ransomhouse, ALPHV/BlackCat), enabling hybrid operations that combine espionage with disruptive and extortion-driven attacks. The operational model includes credential harvesting, account manipulation, protocol tunneling, and supply chain compromise, mapped to MITRE ATT&CK techniques such as T1190, T1505.003, T1078.002, and T1657.

The threat landscape is further complicated by the targeting of cloud/SaaS environments and third-party vendors, expanding the attack surface and facilitating lateral movement. Anticipated trends include the adoption of AI-driven evasion, expansion into new sectors and geographies, and increased hacktivist activity aligned with Iranian state objectives.

Defensive recommendations emphasize rapid patching of critical vulnerabilities, robust identity and access management (MFA, UEBA), advanced EDR and threat hunting, CSPM deployment, zero-trust adoption, and ransomware-specific incident response planning. Intelligence sharing and compliance with emerging regulatory frameworks are essential for resilience.

Organizations should expect continued escalation, with Iranian actors adapting TTPs to circumvent advanced defenses and exploit supply chain weaknesses. Proactive, multi-layered defense and sector-wide collaboration are imperative to mitigate the evolving threat.

---

# Research & Attribution

## Historical Context

Iranian cyber threat actors have evolved over the past decade from primarily espionage-focused groups to sophisticated operators conducting destructive and financially motivated attacks. Groups such as APT33, APT34 (OilRig), APT35 (Charming Kitten), and UNC1860 have targeted regional adversaries and global entities, especially in the Middle East and Western countries. The Iran-Israel conflict has significantly escalated cyber operations, with Iranian actors increasingly engaging in cyber espionage, sabotage, ransomware, and supply chain attacks. In 2025, these activities have intensified, reflecting Iran's strategic use of cyber capabilities to project power, retaliate, and disrupt critical infrastructure globally.

## Timeline

- Pre-2017: Early Iranian cyber espionage campaigns targeting regional adversaries.
- 2017-2020: Expansion of operations with destructive malware like Shamoon and increased targeting of energy and government sectors.
- 2021-2023: Rise in ransomware and financially motivated attacks linked to Iranian actors; collaboration with ransomware affiliates.
- 2024: Increased exploitation of VPN and firewall vulnerabilities; campaigns targeting U.S. education, finance, healthcare, and defense sectors.
- 2025: Escalation of cyber campaigns linked to the Iran-Israel conflict, targeting U.S. and global critical infrastructure, energy, government, and cloud/SaaS sectors.

## Origin

Iranian cyber threat actors are primarily state-sponsored or state-affiliated groups operating under the direction or influence of the Government of Iran (GOI). Attribution is supported by technical indicators, targeting patterns, and geopolitical context linking these actors to Iranian state interests. Some groups operate with direct GOI support, while others collaborate with ransomware affiliates for financial gain, sometimes independently of official sanction.

## Countries Targeted

1. United States – Targeted for critical infrastructure, government, and cloud/SaaS sectors amid geopolitical tensions.
2. Israel – Primary target in the Iran-Israel conflict, including government, telecommunications, and critical infrastructure.
3. Saudi Arabia – Regional adversary targeted for espionage and disruption.
4. United Arab Emirates – Targeted for economic and political intelligence.
5. Jordan – Threatened with attacks on critical infrastructure if supporting Israel.

## Sectors Targeted

1. Critical Infrastructure – Energy grids, water systems, transportation, and utilities targeted for espionage and sabotage.
2. Energy – Oil and gas sectors targeted for economic and strategic impact.
3. Government – Ministries, defense, and diplomatic entities targeted for intelligence and influence.
4. Cloud/SaaS – Increasingly targeted for access to broader networks and data exfiltration.
5. Telecommunications – Targeted to disrupt communications and gather intelligence.

## Motivation

Iranian cyber threat actors are motivated by geopolitical objectives including intelligence gathering, retaliation against adversaries (notably Israel and the U.S.), disruption of critical infrastructure, and economic impact. Their operations support Iran's strategic goals in regional dominance, deterrence, and asymmetric warfare. Financial gain through ransomware collaboration also plays a role, though some ransomware activities may be independent of GOI sanction.

## Attack Types

- Exploitation of VPN and firewall vulnerabilities (e.g., CVE-2019-19781, CVE-2024-21887, CVE-2024-3400)
- Credential harvesting and brute force attacks
- Deployment of web shells and passive backdoors for persistence
- Use of custom malware frameworks (e.g., TEMPLEPLAY, VIROGREEN, Shamoon)
- Ransomware-enabled attacks in collaboration with affiliates (NoEscape, Ransomhouse, ALPHV/BlackCat)
- Supply chain and cloud/SaaS exploitation
- Data exfiltration and destructive attacks

## Notable 2025 Campaign Example

In 2025, the Iranian-affiliated group Pioneer Kitten (also known as Fox Kitten, UNC757) has been observed exploiting vulnerabilities in VPN and firewall devices (including Palo Alto Networks PAN-OS and Check Point Security Gateways) to gain initial access to U.S. organizations across education, finance, healthcare, and defense sectors. After initial access, they deploy web shells and backdoors such as TEMPLEDOOR and use tools like Meshcentral and AnyDesk for remote control. The group collaborates with ransomware affiliates NoEscape, Ransomhouse, and ALPHV (BlackCat) to conduct ransomware attacks, providing access and strategizing extortion efforts. This campaign has caused significant operational disruption and data breaches, highlighting the evolving tactics of Iranian cyber actors in 2025.

## Evolving Tactics and Forecast

The Iran-Israel conflict is driving Iranian cyber actors to:

- Increase targeting of cloud/SaaS environments and supply chain vendors to maximize impact
- Employ more sophisticated persistence mechanisms, including passive backdoors that evade network detection
- Expand ransomware collaborations to monetize access while maintaining plausible deniability
- Shift focus toward U.S. critical infrastructure and private sector entities as geopolitical tensions escalate
- Anticipate increased hacktivist activity aligned with state objectives, amplifying disruptive campaigns

Organizations should prepare for heightened cyber espionage, sabotage, and ransomware threats linked to this conflict, emphasizing proactive defense and threat hunting.

## Technical Mapping (MITRE ATT&CK Techniques)

1. T1190 – Exploit Public-Facing Application (e.g., VPN/firewall CVEs)
2. T1596 – Search Open Technical Databases (Shodan)
3. T1505.003 – Server Software Component: Web Shell
4. T1136.001 – Create Account: Local Account
5. T1098 – Account Manipulation (exemptions to zero-trust policies)
6. T1053 – Scheduled Task/Job (DLL side-loading)
7. T1078.002 – Valid Accounts: Domain Accounts
8. T1562.001 – Impair Defenses: Disable or Modify Tools
9. T1056 – Input Capture (credential harvesting via web shells)
10. T1219 – Remote Access Software (Meshcentral, AnyDesk)
11. T1572 – Protocol Tunneling (Ligolo, NGROK)
12. T1657 – Compromise Infrastructure (ransomware collaboration)

## Known Aliases

- APT33 (Elfin, Magnallium)
- APT34 (OilRig)
- APT35 (Charming Kitten, Phosphorus)
- Pioneer Kitten (Fox Kitten, UNC757, Parisite, RUBIDIUM, Lemon Sandstorm, Br0k3r, xplfinder)
- UNC1860 (initial access provider group)

## Links to Other APT Groups

- Pioneer Kitten collaborates with ransomware affiliates NoEscape, Ransomhouse, and ALPHV (BlackCat)
- UNC1860 supports initial access operations for groups like APT34
- Iranian groups maintain operational links with ransomware affiliates to enable financially motivated attacks

## Similar Threat Actor Groups

- NoEscape (ransomware affiliate)
- Ransomhouse (ransomware affiliate)
- ALPHV (BlackCat) (ransomware affiliate)

## Breaches Involving This Threat Actor

- 2025 ransomware-enabled breaches in U.S. education, finance, healthcare, and defense sectors linked to Pioneer Kitten and affiliates
- Espionage and destructive campaigns targeting Israeli telecommunications and government sectors by UNC1860
- Supply chain compromises affecting cloud/SaaS providers facilitating broader network access

---

# Recommendations, Actions, Forecasts, and Next Steps

(Subscribers Only...)

---

# Recommendations, Actions, and Next Steps

Given the escalation of Iranian cyber operations in 2025, particularly targeting U.S. critical infrastructure, government, cloud/SaaS, and regional adversaries amid the Iran-Israel conflict, organizations must adopt a multi-layered, proactive defense posture. The following prioritized recommendations provide detailed, actionable steps aligned with the latest intelligence and authoritative guidance.

1. **Enhance VPN and Firewall Security with Targeted Vulnerability Management and Detection**

  - Prioritize patching and mitigation of critical vulnerabilities exploited by Iranian actors, including CVE-2019-19781 (Citrix Netscaler), CVE-2024-21887 (Pulse Secure/Ivanti VPN), CVE-2024-3400 (Palo Alto PAN-OS), CVE-2024-24919 (Check Point Security Gateways), and CVE-2022-1388 (F5 BIG-IP). Use automated vulnerability management tools such as Tenable, Qualys, or Rapid7 to continuously scan and remediate these exposures.
  - Deploy network intrusion detection and prevention systems (IDPS) with updated signatures for Iranian TTPs, including web shell detection and exploitation attempts. Solutions like Cisco Secure IPS, Palo Alto Networks Threat Prevention, or open-source Suricata with custom rules are effective.
  - Conduct regular penetration testing and red team exercises simulating Iranian threat actor tactics, focusing on VPN/firewall exploitation and lateral movement.
  - **Expected impact:** Significantly reduces initial access opportunities exploited by Iranian groups, limiting foothold establishment and subsequent operations.
  - **Implementation:** Immediate patch prioritization with monthly scanning cycles; IDPS tuning and signature updates quarterly; red team exercises biannually.
  - **Challenges:** Operational downtime during patching; need for skilled security personnel for advanced detection tuning.
  - **Metrics:** Achieve 100% patching of critical VPN/firewall CVEs within 30 days; reduce successful exploitation attempts by 50% within six months; number of detected web shell deployments.
  - **MITRE ATT&CK IDs:** T1190, T1505.003
2. **Implement Robust Identity and Access Management (IAM) with Continuous Monitoring**

  - Enforce multi-factor authentication (MFA) across all remote access, cloud/SaaS platforms, and privileged accounts to mitigate credential harvesting and brute force attacks.
  - Deploy User and Entity Behavior Analytics (UEBA) tools such as Microsoft Defender for Identity, Exabeam, or Splunk UBA to detect anomalous account activities indicative of Iranian actor tactics (e.g., account manipulation, creation of local/domain accounts).
  - Conduct regular audits to remove stale accounts and enforce least privilege access policies.
  - **Expected impact:** Mitigates credential-based intrusions and lateral movement, reducing persistent access risks.
  - **Implementation:** MFA rollout within 90 days; UEBA deployment and tuning within 6 months; quarterly account audits.
  - **Challenges:** User adoption resistance; integration complexity with legacy systems.
  - **Metrics:** 95% MFA coverage on critical accounts; reduction in anomalous account activity alerts by 40% over six months.
  - **MITRE ATT&CK IDs:** T1056, T1078.002, T1098
3. **Expand Endpoint Detection and Response (EDR) and Threat Hunting Capabilities Focused on Iranian TTPs**

  - Deploy or enhance EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne) with custom detection rules for Iranian-specific malware and backdoors such as TEMPLEDOOR, VIROGREEN, Shamoon, and web shells.
  - Establish dedicated threat hunting teams trained on Iranian actor TTPs, including detection of scheduled tasks/DLL side-loading (T1053), remote access tools (Meshcentral, AnyDesk), and protocol tunneling (Ligolo, NGROK).
  - Integrate threat intelligence feeds from CISA, FBI, and commercial providers to update detection signatures and IOC databases continuously.
  - **Expected impact:** Enables early detection and rapid response to persistent threats and ransomware-enabled intrusions.
  - **Implementation:** EDR deployment or upgrade within 3 months; threat hunting team formation and training within 6 months; continuous threat intel integration.
  - **Challenges:** Alert fatigue; requirement for skilled analysts.
  - **Metrics:** Mean time to detect (MTTD) and mean time to respond (MTTR) reduced by 30% within 6 months; number of Iranian TTP-related detections.
  - **MITRE ATT&CK IDs:** T1505.003, T1219, T1053, T1572
4. **Harden Cloud and Supply Chain Security Using Frameworks and CSPM Tools**

  - Conduct comprehensive security assessments of cloud/SaaS environments and third-party vendors using NIST SP 800-161 (Supply Chain Risk Management) and CIS Controls v8 benchmarks.
  - Implement Cloud Security Posture Management (CSPM) tools such as Prisma Cloud, Dome9, or Microsoft Defender for Cloud to continuously monitor cloud configurations, detect misconfigurations, and enforce compliance.
  - Adopt zero-trust architecture principles including micro-segmentation, continuous authentication, and least privilege access for cloud resources.
  - Establish rigorous third-party risk management programs with continuous monitoring and contractual security requirements for supply chain vendors.
  - **Expected impact:** Reduces risk of supply chain and cloud environment compromises exploited by Iranian actors to gain broader network access.
  - **Implementation:** Initiate cloud and vendor assessments within 3 months; CSPM deployment within 6 months; zero-trust roadmap development and phased implementation over 12 months.
  - **Challenges:** Complexity of cloud environments; vendor cooperation and transparency.
  - **Metrics:** 100% of critical cloud assets assessed; reduction in cloud misconfigurations by 60% within 6 months; number of supply chain security incidents.
  - **MITRE ATT&CK IDs:** T1190, T1657
5. **Prepare for and Mitigate Ransomware-Enabled Attacks with Incident Response and Backup Strategies**

  - Develop and regularly test ransomware-specific incident response plans incorporating scenarios involving Iranian-affiliated groups and their ransomware affiliates (NoEscape, Ransomhouse, ALPHV/BlackCat).
  - Implement immutable, offline backups with frequent testing of restoration processes to ensure data integrity and availability.
  - Enhance network segmentation and deploy ransomware detection tools such as behavioral analytics and honeypots to contain and detect ransomware spread.
  - Conduct user awareness training focused on ransomware phishing and social engineering tactics.
  - **Expected impact:** Minimizes operational disruption, data loss, and financial impact from ransomware attacks linked to Iranian threat actors.
  - **Implementation:** Incident response plan development and tabletop exercises within 3 months; backup infrastructure upgrades within 6 months; ongoing user training quarterly.
  - **Challenges:** Resource allocation for backup infrastructure; evolving ransomware tactics.
  - **Metrics:** Recovery time objective (RTO) met in 90% of tests; reduction in ransomware infection incidents by 40% within 12 months.
  - **MITRE ATT&CK IDs:** T1657

---

# Suggested Pivots

1. How are Iranian cyber threat actors adapting their exploitation of VPN and firewall vulnerabilities (e.g., CVE-2024-21887, CVE-2024-3400) in response to recent patching and detection efforts by U.S. critical infrastructure and cloud/SaaS providers? Understanding these adaptations is critical to preempting next-generation intrusion techniques.
2. What are the detailed supply chain attack vectors employed by Iranian groups in cloud environments, including recent case studies of compromised third-party vendors, and how can intelligence teams leverage frameworks like NIST SP 800-161 alongside real-time threat intelligence to enhance third-party risk management and detection capabilities?
3. Which intelligence sharing mechanisms—such as Information Sharing and Analysis Centers (ISACs), government-industry partnerships, or international coalitions—are most effective in disrupting the operational and financial collaborations between Iranian state-affiliated groups and ransomware affiliates like NoEscape and ALPHV (BlackCat)? This question aims to optimize collaborative defense strategies.
4. How might the anticipated increase in hacktivist activities aligned with Iranian state objectives influence the scale, targets, and tactics of cyber operations in the Iran-Israel conflict, and what early warning indicators can be developed to detect and mitigate these emergent threats before they cause significant disruption?
5. Given the multi-sector targeting of U.S. education, finance, healthcare, and defense by Iranian cyber actors, what are the implications for national security policy and interagency coordination, and how can these sectors improve information sharing and incident response to reduce vulnerabilities and enhance resilience?

---

# Forecast

## Short-Term Forecast (3-6 months)

1. **Intensified Exploitation of VPN and Firewall Vulnerabilities by Pioneer Kitten and Iranian Actors**

  - Iranian state-sponsored group Pioneer Kitten (aka Fox Kitten, UNC757) will escalate exploitation of critical VPN and firewall vulnerabilities such as CVE-2024-21887 (Pulse Secure/Ivanti VPN), CVE-2024-3400 (Palo Alto PAN-OS), and CVE-2024-24919 (Check Point Security Gateways) to gain initial access into U.S. critical infrastructure, cloud/SaaS, and private sector networks. This is corroborated by the August 2024 CISA advisory AA24-241A and ongoing 2025 campaigns.
  - The group’s tactics include deploying multiple web shells (e.g., TEMPLEDOOR) to maintain persistence even after patching, creating disguised local accounts, and leveraging scheduled tasks for execution and evasion.
  - **Examples:** Recent campaigns targeting education, finance, healthcare, and defense sectors with significant operational disruption and data breaches. Pioneer Kitten’s use of multiple web shells on Citrix Netscaler devices to maintain access despite remediation efforts.
  - **What to watch out for:**  
    - Increased detection of exploitation attempts against the above CVEs in network logs and intrusion detection systems
    - Alerts for web shell deployments and creation of suspicious local accounts mimicking legitimate system accounts (e.g., "IIS\_Admin," "sqladmin$")
    - Indicators of scheduled task creation with random names executing DLL side-loading payloads
2. **Expansion and Sophistication of Ransomware Collaborations with Iranian Affiliates**

  - Iranian cyber actors will deepen operational collaboration with ransomware affiliates such as NoEscape, Ransomhouse, and ALPHV (BlackCat), providing initial access and strategic support for ransomware deployment and extortion. This hybrid espionage-ransomware model increases operational impact and complicates attribution.
  - **Examples:** The 2025 ransomware-enabled breaches in U.S. sectors linked to Pioneer Kitten and affiliates, with active participation in ransom negotiation and network lockdown strategies.
  - **What to watch out for:**  
    - Surge in ransomware incidents with extortion demands linked to Iranian-affiliated ransomware groups
    - Shared infrastructure or TTP overlaps between Iranian groups and ransomware affiliates detected in threat intelligence feeds
3. **Increased Use of Advanced Persistence and Evasion Techniques**

  - Iranian actors will employ sophisticated persistence mechanisms such as passive web shells, disabling or modifying security tools, scheduled tasks with DLL side-loading, and encrypted protocol tunneling (Ligolo, NGROK) to evade detection and maintain long-term access.
  - **Examples:** Use of Meshcentral and AnyDesk for remote control, daily Windows service tasks with randomized names to execute malicious DLLs, and encrypted tunnels to bypass network defenses.
  - **What to watch out for:**  
    - Detection of anomalous scheduled tasks or services with random names
    - Network traffic consistent with encrypted tunneling protocols evading standard inspection
    - Alerts for disabled or modified endpoint security tools
4. **Heightened Targeting of Cloud/SaaS Providers and Supply Chain Vendors**

  - Iranian threat actors will increasingly target cloud and SaaS environments, exploiting misconfigurations and vulnerabilities in third-party vendors to gain broader access and maximize impact on U.S. and allied networks. This aligns with their strategic goal to disrupt adversaries and gather intelligence.
  - **Examples:** Supply chain compromises facilitating lateral movement into critical infrastructure and private sector networks, similar in impact to past supply chain attacks like SolarWinds.
  - **What to watch out for:**  
    - Reports of cloud misconfigurations or breaches linked to Iranian TTPs
    - Increased reconnaissance activity against cloud assets and third-party vendors
5. **Emergence of Hacktivist Operations Supporting Iranian State Objectives**

  - Hacktivist groups aligned with Iranian geopolitical goals may increase disruptive cyber activities such as website defacements, DDoS attacks, and data leaks targeting Israel, U.S., and regional adversaries, amplifying state-sponsored campaigns.
  - **Examples:** Past hacktivist surges during Iran-Israel conflict escalations, with potential for coordinated campaigns timed with geopolitical events.
  - **What to watch out for:**  
    - Public claims of responsibility by hacktivist groups linked to Iran
    - Sudden spikes in low-sophistication disruptive attacks coinciding with diplomatic or military tensions

## Long-Term Forecast (12-24 months)

1. **Institutionalization of Hybrid Cyber Operations Integrating Espionage, Sabotage, and Ransomware**

  - Iranian cyber threat actors will formalize a hybrid operational model combining espionage, destructive sabotage (e.g., Shamoon, VIROGREEN), and financially motivated ransomware attacks, supported by expanded ransomware affiliate collaborations and supply chain compromises. This will increase campaign complexity and impact on critical infrastructure and private sectors globally.
  - **Examples:** The 2025 trend of Pioneer Kitten’s multi-faceted campaigns; parallels with Russian and North Korean state actors’ hybrid models.
  - **What to watch out for:**  
    - Persistent multi-vector campaigns with espionage and ransomware components
    - Increased sophistication in ransomware extortion tactics combined with intelligence objectives
2. **Evolution of Iranian TTPs to Circumvent Advanced Defensive Technologies, Including Early AI-Driven Evasion**

  - Iranian groups will adapt to bypass advanced detection technologies such as EDR, UEBA, and zero-trust architectures by developing or adopting AI-assisted evasion techniques, supply chain subversion, and novel malware frameworks. While direct evidence of AI-driven evasion by Iranian actors is limited, industry research (e.g., CrowdStrike 2025 Global Threat Report) highlights adversaries experimenting with AI to enhance stealth and automation, suggesting early-stage adoption.
  - **Examples:** Current use of passive backdoors and protocol tunneling evolving toward more stealthy, AI-assisted evasion methods.
  - **What to watch out for:**  
    - Emergence of malware variants exhibiting adaptive behavior or evasion patterns consistent with AI techniques
    - Reports or indicators of AI-assisted attack automation in Iranian campaigns
3. **Expansion of Targeting Beyond Traditional Geopolitical Adversaries to Global Supply Chains and Emerging Markets**

  - Iranian cyber operations will broaden to include new sectors and countries beyond the Middle East and Western targets, focusing on emerging markets, multinational corporations, and international organizations to expand influence and economic impact.
  - **Examples:** Potential targeting of global cloud providers, multinational financial institutions, and international organizations, mirroring the expansion patterns of Chinese and Russian cyber actors.
  - **What to watch out for:**  
    - Reports of Iranian-linked intrusions in new geographic regions or sectors
    - Increased reconnaissance and exploitation activity in global supply chains
4. **Strengthening of International Cybersecurity Coalitions and Intelligence Sharing to Counter Iranian Threats**

  - In response to escalating Iranian cyber operations, international coalitions and public-private partnerships will enhance intelligence sharing, joint defense initiatives, and coordinated response frameworks to disrupt Iranian ransomware collaborations and espionage campaigns.
  - **Examples:** Expansion of ISACs, government-industry partnerships, and multinational cyber defense exercises focused on Iranian TTPs, similar to NATO and Five Eyes models.
  - **What to watch out for:**  
    - Announcements of new international cybersecurity agreements or task forces
    - Increased joint advisories and public disclosures of Iranian cyber campaigns
5. **Regulatory and Policy Developments Targeting Supply Chain and Critical Infrastructure Security**

  - Governments, especially in the U.S. and allied countries, will enact stricter regulations and compliance mandates for supply chain security, cloud/SaaS providers, and critical infrastructure operators to mitigate Iranian cyber threats. This will include mandatory vulnerability management, incident reporting, and zero-trust adoption.
  - **Examples:** Broader adoption of NIST SP 800-161, new cybersecurity executive orders, and sector-specific regulations following precedents set after SolarWinds and other supply chain incidents.
  - **What to watch out for:**  
    - Publication of new cybersecurity regulations or standards targeting supply chain and critical infrastructure
    - Increased enforcement actions and compliance audits in affected sectors

## MITRE ATT&CK IDs

T1190, T1596, T1505.003, T1136.001, T1098, T1053, T1078.002, T1562.001, T1056, T1219, T1572, T1657

---

# Appendix

## References

1. (2024-08-28) [Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations - CISA](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a?ref=blog.alphahunt.io)
2. (2025-06-16) [US critical infrastructure could become casualty of Iran-Israel conflict - Cybersecurity Dive](https://www.cybersecuritydive.com/news/us-critical-infrastructure-iran-israel-conflict/750799/?ref=blog.alphahunt.io)
3. (2024-09-19) [UNC1860 and the Temple of Oats: Iran's Hidden Hand in Middle Eastern Networks - Google Cloud Blog](https://cloud.google.com/blog/topics/threat-intelligence/unc1860-iran-middle-eastern-networks?ref=blog.alphahunt.io)
4. (2025-06-13) [Reflections of the Israel-Iran Conflict on the Cyber World - SOCRadar](https://socradar.io/reflections-of-israel-iran-conflict-cyber-world/?ref=blog.alphahunt.io)
5. (2024-11-12) [TA455's Iranian Dream Job Campaign Targets Aerospace - Infosecurity Magazine](https://www.infosecurity-magazine.com/news/ta455s-iranian-dream-job-campaign/?ref=blog.alphahunt.io)
6. (2023-12-15) [NIST SP 800-161 Rev. 1: Supply Chain Risk Management Practices for Federal Information Systems and Organizations](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final?ref=blog.alphahunt.io)
7. (2024-11-01) [CIS Controls v8](https://www.cisecurity.org/controls/cis-controls-list/?ref=blog.alphahunt.io)
8. (2025-05-10) [CrowdStrike 2025 Global Threat Report: Iranian Cyber Threat Actors and Ransomware Affiliates](https://go.crowdstrike.com/rs/281-OBQ-266/images/CrowdStrikeGlobalThreatReport2025.pdf?version=0&ref=blog.alphahunt.io)
9. (2024-09-19) [Pioneer Kitten: Iranian Threat Actors Facilitate Ransomware Attacks - Picus Security](https://www.picussecurity.com/resource/blog/pioneer-kitten-cisa-alert-aa24-241a?ref=blog.alphahunt.io)

## AlphaHunt

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Get questions like this:

1. **which iranian threat actors have been active over the past few months?**
2. **How have Iranian threat actors adapted their tactics in response to recent cybersecurity defenses and geopolitical developments?**
3. **What might we expect from these groups in the coming weeks and months?**

Does it take a chunks out of your day? Would you like help with the research?

This **baseline** report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? [Get Started Here!](http://alphahunt.io/?ref=blog.alphahunt.io)

Did this help you? Forward it to a friend!

(c) 2025 CSIRT Gadgets, LLC

## MITRE ATT&CK

### Techniques

1. [T1190](https://attack.mitre.org/techniques/T1190/?ref=blog.alphahunt.io) (Exploit Public-Facing Application) – Exploitation of vulnerabilities in internet-facing systems such as VPNs and firewalls (e.g., CVE-2019-19781, CVE-2024-21887, CVE-2024-3400) to gain initial access.

  - Central to Iranian cyber threat actors' 2025 campaigns, including Pioneer Kitten's exploitation of Palo Alto PAN-OS CVE-2024-3400, enabling initial foothold in U.S. critical infrastructure and cloud sectors.
  - Corroborated by CISA advisory: [Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations - CISA](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a?ref=blog.alphahunt.io)
2. [T1505.003](https://attack.mitre.org/techniques/T1505/003/?ref=blog.alphahunt.io) (Server Software Component: Web Shell) – Deployment of web shells such as TEMPLEDOOR for persistence and remote access.

  - Used by Pioneer Kitten post-exploitation to maintain access and harvest credentials.
  - Detailed in CISA advisory and Picus Security blog: [Pioneer Kitten: Iranian Threat Actors Facilitate Ransomware Attacks](https://www.picussecurity.com/resource/blog/pioneer-kitten-cisa-alert-aa24-241a?ref=blog.alphahunt.io)
3. [T1078.002](https://attack.mitre.org/techniques/T1078/002/?ref=blog.alphahunt.io) (Valid Accounts: Domain Accounts) – Use and manipulation of valid domain accounts for lateral movement and persistence.

  - Iranian actors create and manipulate accounts to evade detection and maintain access.
4. [T1098](https://attack.mitre.org/techniques/T1098/?ref=blog.alphahunt.io) (Account Manipulation) – Modifying account permissions or settings to bypass security controls.

  - Enables exemptions from zero-trust policies and persistent access.
5. [T1053](https://attack.mitre.org/techniques/T1053/?ref=blog.alphahunt.io) (Scheduled Task/Job) – Use of scheduled tasks or DLL side-loading for execution and persistence.

  - Employed by Iranian groups to execute malware and maintain foothold.
6. [T1056](https://attack.mitre.org/techniques/T1056/?ref=blog.alphahunt.io) (Input Capture) – Credential harvesting via keylogging or web shells.

  - Critical for Iranian actors to escalate privileges.
7. [T1219](https://attack.mitre.org/techniques/T1219/?ref=blog.alphahunt.io) (Remote Access Software) – Abuse of legitimate remote access tools like Meshcentral and AnyDesk.

  - Facilitates remote control and lateral movement.
8. [T1572](https://attack.mitre.org/techniques/T1572/?ref=blog.alphahunt.io) (Protocol Tunneling) – Use of tunneling protocols such as Ligolo and NGROK to evade network defenses.

  - Enables covert command and control channels.
9. [T1657](https://attack.mitre.org/techniques/T1657/?ref=blog.alphahunt.io) (Compromise Infrastructure) – Collaboration with ransomware affiliates to enable financially motivated attacks.

  - Reflects Iranian groups' evolving tactics combining espionage and ransomware.
  - Supported by Cybersecurity Dive report: [US critical infrastructure could become casualty of Iran-Israel conflict](https://www.cybersecuritydive.com/news/us-critical-infrastructure-iran-israel-conflict/750799/?ref=blog.alphahunt.io)
10. [T1596](https://attack.mitre.org/techniques/T1596/?ref=blog.alphahunt.io) (Search Open Technical Databases) – Use of tools like Shodan for reconnaissance.

  - Used to identify vulnerable VPN/firewall devices.

### Tactics

1. [TA0001](https://attack.mitre.org/tactics/TA0001/?ref=blog.alphahunt.io) (Initial Access) – Exploiting public-facing applications to gain entry.

  - Iranian actors exploit VPN/firewall vulnerabilities for initial access.
2. [TA0005](https://attack.mitre.org/tactics/TA0005/?ref=blog.alphahunt.io) (Defense Evasion) – Techniques to avoid detection and maintain persistence.

  - Use of web shells, disabling defenses, and account manipulation.
3. [TA0006](https://attack.mitre.org/tactics/TA0006/?ref=blog.alphahunt.io) (Credential Access) – Stealing credentials to escalate privileges.

  - Credential harvesting via input capture and web shells.
4. [TA0007](https://attack.mitre.org/tactics/TA0007/?ref=blog.alphahunt.io) (Discovery) – Reconnaissance activities such as searching open technical databases.

  - Use of Shodan for target identification.
5. [TA0011](https://attack.mitre.org/tactics/TA0011/?ref=blog.alphahunt.io) (Command and Control) – Establishing communication channels with compromised systems.

  - Use of remote access software and protocol tunneling.
6. [TA0040](https://attack.mitre.org/tactics/TA0040/?ref=blog.alphahunt.io) (Impact) – Disruptive and destructive attacks including ransomware.

  - Iranian groups conduct ransomware-enabled and destructive campaigns.

### Mitigations

1. [M1051](https://attack.mitre.org/mitigations/M1051/?ref=blog.alphahunt.io) Patch Management – Regularly apply security patches to vulnerable systems.

  - Critical for mitigating exploitation of VPN/firewall vulnerabilities.
2. [M1031](https://attack.mitre.org/mitigations/M1031/?ref=blog.alphahunt.io) Network Intrusion Prevention – Deploy network-based intrusion detection and prevention systems.

  - Detects exploitation attempts and web shell activity.
3. [M1032](https://attack.mitre.org/mitigations/M1032/?ref=blog.alphahunt.io) Multi-factor Authentication – Enforce MFA to reduce credential-based attacks.

  - Mitigates credential harvesting and use of valid accounts.
4. [M0936](https://attack.mitre.org/mitigations/M0936/?ref=blog.alphahunt.io) Account Use Policies – Implement least privilege and regular account audits.

  - Reduces risk from account manipulation and stale accounts.
5. [M1037](https://attack.mitre.org/mitigations/M1037/?ref=blog.alphahunt.io) Filter Network Traffic – Monitor and filter protocol tunneling.

  - Helps detect and block covert communication channels.

### Groups

1. [G0117](https://attack.mitre.org/groups/G0117/?ref=blog.alphahunt.io) Pioneer Kitten (Fox Kitten, UNC757, Parisite, RUBIDIUM, Lemon Sandstorm, Br0k3r, xplfinder)

  - Iranian-affiliated group active in 2025 exploiting VPN/firewall vulnerabilities including CVE-2024-3400, deploying web shells, and collaborating with ransomware affiliates.
2. [G0049](https://attack.mitre.org/groups/G0049/?ref=blog.alphahunt.io) APT34 (OilRig)

  - Iranian espionage group targeting Middle East and Western entities.
3. [G0059](https://attack.mitre.org/groups/G0059/?ref=blog.alphahunt.io) APT35 (Charming Kitten, Phosphorus)

  - Focused on espionage and credential harvesting.