---
title: "Iranian Government Affiliated Intrusions: Documented Tradecraft"
description: Insights into Iranian cyber tactics, targeting critical sectors, and defensive measures based on documented tradecraft from CISA, FBI, and NSA reports.
---

[Skip to content](https://blog.reconinfosec.com/iranian-government-affiliated-intrusions-documented-tradecraft#main-content)

[![recon_infosec.png](https://blog.reconinfosec.com/hs-fs/hubfs/recon-logo-full-on-white.png?width=7680&height=2304&name=recon-logo-full-on-white.png "recon_infosec.png")](http://reconinfosec.com)

- [Website Home](https://www.reconinfosec.com/)

- [Website Home](https://www.reconinfosec.com/)

# Iranian Government Affiliated Intrusions: Documented Tradecraft

[Luke Rusten](https://blog.reconinfosec.com/author/luke-rusten)

When geopolitical tensions rise, defenders tend to ask the same question: What does Iranian cyber activity actually look like on the wire?

Rather than speculate, it’s far more productive to focus on documented tradecraft observed in real intrusions and published by CISA, FBI, and NSA.

Across multiple joint advisories, Iranian government-affiliated actors have consistently demonstrated:

- Heavy reliance on built-in Windows administrative tools
- Rapid Active Directory discovery after initial access
- Credential dumping using native capabilities
- Service creation and scheduled tasks for lateral movement
- Selective destructive behavior

## Primary Sectors

- Critical Infrastructure 
    - Water and Wastewater Systems
    - Energy Sector
    - Industrial Control Systems (ICS) environments
- Defense Industrial Base (DIB)
- U.S. Government Entities 
    - Federal agencies
    - State and local government organizations
- Healthcare and Public Health Sector
- Information Technology & Managed Service Providers (MSPs)

## Iranian State-Linked APTs (with MITRE ATT&CK Links)

1. [APT33 (Holmium / Elfin / Peach Sandstorm) - G0064](https://attack.mitre.org/groups/G0064/) **-** One of the most well-documented Iranian APTs. Targets aerospace, energy, and defense sectors with espionage and sometimes destructive operations.
2. [MuddyWater - G0069](https://attack.mitre.org/groups/G0069/) **-** A cyber espionage group assessed to be part of Iran’s Ministry of Intelligence and Security (MOIS). Active against government and private organizations globally.
3. [APT39 (Chafer / ITG07 / Remix Kitten) - G0087](https://attack.mitre.org/groups/G0087/) **-** Known for espionage targeting travel, telecom, and information technology sectors.
4. [CopyKittens - G0052](https://attack.mitre.org/groups/G0052/) **-** An Iranian cyber espionage group tracked for operations dating back to at least 2013.
5. [CURIUM (Crimson Sandstorm / TA456) - G1012](https://attack.mitre.org/groups/G1012/) -Tracked as an Iranian threat group with sustained activity targeting IT service providers and other organizations.
6. [Magic Hound - G0059](https://attack.mitre.org/groups/G0059/) -Identified by MITRE as an Iranian-sponsored cyber espionage group (sometimes associated with Charming Kitten overlaps).
7. [CyberAv3ngers - G1027](https://attack.mitre.org/groups/G1027/) -A suspected IRGC-affiliated APT group with activity claims (note: attribution is debated in public reporting).

## Documented Activity Observed in Recent Iranian Intrusions

### Active Directory Discovery

```
nltest /dclist
nltest /domain_trusts
nltest /domain_trusts /all_trusts
net group "Domain Admins" /domain
net group "Enterprise Admins" /domain
net group "Administrators" /domain
net user /domain
net accounts /domain
net view /domain
        
```

Commands used for domain/user discovery

### PowerShell LDAP Query

```
$i=0
$D= [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$L='LDAP://' . $D
$D = [ADSI]$L
$str = '(&(objectcategory=computer)(operatingSystem=*serv*))'
$s = [adsisearcher]$str
$s.searchRoot = $L.$D.distinguishedName
$s.PropertiesToLoad.Add('cn') > $Null
$s.PropertiesToLoad.Add('operatingsystem') > $Null
Foreach ($CA in $s.FindAll()) {
    Write-Host $CA.Properties.Item('cn')
    $CA.Properties.Item('operatingsystem')
}
        
```

PowerShell to query Active Directory (AD) using Lightweight Directory Access Protocol (LDAP). The script is used to enumerate computer objects within the directory, retrieving attributes such as hostnames, operating systems, and distinguished names.

### Signed Binary Proxy Execution (LOLBins)

Explicitly documented in AA22-055A:

- `mshta.exe`
- `CMSTP.exe` (with malicious .INF)
- `rundll32.exe` (via Registry Run key)
- .NET `csc.exe` (compile after delivery)

### Credential Access

Observed credential enumeration (AA24-290A):

`Cmdkey /list`

Used to enumerate cached credentials on compromised systems.

### LSASS Dumping

```
rundll32.exe comsvcs.dll, MiniDump
procdump.exe -ma lsass.exe
        
```

### Archive & Staging

Observed tool (AA22-055A): `makecab.exe`

Used to compress collected data prior to exfiltration.

## Final Takeaway for Defenders

Iranian government-affiliated operators consistently demonstrate:

- Living-off-the-land tradecraft
- Active Directory-centric operations
- Credential dumping before lateral movement
- Scheduled tasks and services for persistence
- Destructive capability via shadow copy deletion

## Mitigations (Per CISA AA24-290A)

- Implement phishing-resistant MFA \[CPG 2.H\]
- Continuously review MFA coverage across all internet-facing services \[CPG 2.W\]
- Disable accounts for departing staff immediately \[CPG 2.D\]
- Ensure password policies align with NIST Digital Identity Guidelines 
    - Enforce minimum password strength \[CPG 2.B\]
    - Avoid common passwords (e.g., seasonal formats)

### Helpdesk & Credential Controls

- Review IT helpdesk password reset procedures
- Ensure identity verification aligns with policy
- Prevent weak reset practices

### User Awareness

- Provide basic cybersecurity training \[CPG 2.I\]
- Train users to deny unexpected MFA requests
- Encourage reporting of failed login attempts \[CPG 2.G\]

### Infrastructure Hardening

- Disable RC4 for Kerberos authentication
- Audit internet-facing VPNs and edge appliances
- Validate MFA on all exposed protocols

## Validate Security Controls (Per CISA Guidance)

CISA recommends testing security controls against ATT&CK techniques described in advisories:

1. Select a documented ATT&CK technique
2. Align security technologies to the technique
3. Test detection & prevention capability
4. Analyze performance
5. Tune people, processes, and tools
6. Repeat continuously at scale in production environments

This structured validation approach ensures defensive controls perform effectively against documented Iranian TTPs.

## References

- [CISA AA24-290A: Iranian Cyber Actors](https://www.cisa.gov/sites/default/files/2024-10/aa24-290a-iranian-cyber-actors-conduct-brute-force-and-credential-access-activity.pdf)
- [CISA Iran Publications](https://www.cisa.gov/topics/cyber-threats-and-advisories/nation-state-cyber-actors/iran/publications)

## Read On

### [When Browser Extensions Go Rogue](https://blog.reconinfosec.com/when-browser-extensions-go-rogue)

So it's a random Wednesday night and I'm studying for my GIAC GCFE exam (which I just passed...

[![](https://lh6.googleusercontent.com/hKOE9u5jsUy-4JOw2Z2G_bFbZwfiawpLKNXax-T97fJYEh55vg29TV0qxQHRULQqj_9_MqwQVMBgoCtk1iAJGVz1XKzbA_qvujidS1XdJ5zPZnbSWqpXJE0TiFn2wZ1-Q1dsqCXDjQ)](https://blog.reconinfosec.com/phishing-campaign)

### [Widespread Phishing and Business Email Compromise Campaign](https://blog.reconinfosec.com/phishing-campaign)

In this blog post we cover a widespread phishing campaign Recon recently observed targeting...

[![](https://blog.reconinfosec.com/hs-fs/hubfs/recon-thumbnail.png?width=352&name=recon-thumbnail.png)](https://blog.reconinfosec.com/advanced-email-protection-detection-techniques-in-action)

### [Advanced Email Protection: Detection Techniques in Action](https://blog.reconinfosec.com/advanced-email-protection-detection-techniques-in-action)

Hopefully you have read all about why we are excited to be offering Advanced Email Protection (AEP)...

© 2026 All rights reserved. [RSS Feed](https://blog.reconinfosec.com/rss.xml)