Security News > 2020 > February > Iranian Cyberspies Focus on Long-Running Operations
The Iranian cyber-espionage group referred to as MuddyWater continues to focus on long-running operations even after a U.S. airstrike killed General Qassem Soleimani on January 2.
Cyber-retaliation continues to be a probability, and even industrial systems might be at risk, but for now Iranian threat groups appear to focus on their long-running cyber-espionage activity instead, Secureworks' security researchers say.
Looking into the activity associated with Iran-linked hackers, Secureworks observed that most operations commenced prior to the U.S. drone strike.
Many of the attacks MuddyWater launched over the past couple of years started with the collection of credentials via social engineering, phishing, password spraying, brute-force attacks, and exploitation of publicly available systems, the security researchers say.
"Although Iran has not launched a cyber-retaliation for Soleimani's death as of this publication, CTU researchers acknowledge that planning and coordinating for a response takes time. Iran has destructive and disruptive capabilities that it has historically employed for retaliatory purposes against organizations. In some cases, these responses materialized several months after provocations toward Iran occurred. However, Iran's cyberespionage operations continue," Secureworks concludes.