Forum Discussion
Cyber Retaliation: Analyzing Iranian Cyber Activity Following Operation Epic Fury
In the wake of Operation Epic Fury, digital attacks have shifted from quiet espionage to a loud, coordinated campaign of economic and physical retaliation. In response, the Tenable Research Special Operations (RSO) team is examining the latest threats and cyber operations linked to Iranian threat actors.
Recently Ministry of Intelligence and Security (MOIS) affiliated groups have significantly escalated their operations, shifting from espionage to disruptive and destructive campaigns. MuddyWater and the Void Manticore persona known as Handala are two groups which have seen an increased level of malicious activity surrounding the recent military operations in Iran.
For more information about this threat activity, including the availability of patches for the CVEs covered in our analysis as well as Tenable product coverage, please visit our blog.
2 Replies
Is there a way to see the full list of 136 CVE that CISA shared as being used by threat actors?
CISA has provided several cybersecurity advisories in recent years covering threat actors aligned with Iran and several of these publications do include lists of CVEs known to have been abused. One recommendation of material publicly available from CISA is:
https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran
