CyberzSOC

The actors likely aim to obtain credentials and information describing the victim’s network that can then be sold to enable access to cybercriminals. Since October 2023, Iranian actors have used brute force, such as password spraying, and multifactor authentication (MFA) ‘push bombing’ to compromise user accounts and obtain access to organizations. The actors frequently modified MFA registrations, enabling persistent access. The actors performed discovery on the compromised networks to obtain additional credentials and identify other information that could be used to gain additional points of access. The authoring agencies assess the Iranian actors sell this information on cybercriminal forums to actors who may use the information to conduct additional This advisory provides the actors’ tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs).