009.1: CRASH COURSE: IRAN | Geopolitics, Cyber Threat Groups and Operations

Key Topics: * US-Iran Historical Tensions * Iran’s Demographics & Strategy * Nuclear Program & 2025 Strikes * Proxy Networks (Axis of Resistance) * Iranian Cyber Threat Actors Call to Action: * Subscribe to the podcast for more episodes on high-profile cyber intrusions. * Visit our website at intrusionsindepth.com for additional stories and insights. * Share your thoughts on social media using #IntrusionsInDepth. Books: * Stuxnet and the Launch of the World’s First Digital Weapon Countdown to Zero Day - Kim Zetter * Iran’s Perilous Pursuit of Nuclear Weapons — David Albright & Sarah Burkhard * From Intel to Iran: The Defection of Monica Witt — Borna Ahadi Links and Resources: * https://en.wikipedia.org/wiki/Judicial_system_of_the_Islamic_Republic_of_Iran * https://attack.mitre.org/groups/G0069/ * https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming * https://cloud.google.com/security/resources/insights/apt-groups#global-threats-iran * https://en.wikipedia.org/wiki/Shamoon * https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a * https://cyberscoop.com/hack-and-leak-group-black-shadow-keeps-targeting-israeli-victims/ * https://iapp.org/news/b/black-shadow-hackers-re-emerge-with-second-israeli-breach * https://www.securiwiser.com/news/black-shadow-hits-cyberserve-and-lgbtq-dating-app-client/ * https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations * https://cloud.google.com/blog/topics/threat-intelligence/uncovering-iranian-counterintelligence-operation * https://cloud.google.com/blog/topics/threat-intelligence/unc1860-iran-middle-eastern-networks * https://www.mei.edu/publications/iranian-apts-overview * https://cloud.google.com/blog/topics/threat-intelligence/apt42-charms-cons-compromises * https://www.csis.org/programs/strategic-technologies-program/significant-cyber-incidents * https://darknetdiaries.com/transcript/30/ * https://risky.biz/why-iran-is-a-scaredy-cat-cyber-chicken/ * https://www.fbi.gov/contact-us/field-offices/boston/news/press-releases/fbi-releases-cybersecurity-advisory-on-previously-undisclosed-iranian-malware-used-to-monitor-dissidents-and-travel-and-telecommunications-companies * https://home.treasury.gov/news/press-releases/sm1127 * https://mjolnirsecurity.com/the-asymmetric-battlefield-an-anthropological-and-geopolitical-analysis-of-iranian-cyber-threats-to-north-american-critical-infrastructure/ * https://cloud.google.com/blog/topics/threat-intelligence/apt33-insights-into-iranian-cyber-espionage * https://www.picussecurity.com/resource/blog/understanding-active-iranian-apt-groups * https://therecord.media/iran-state-backed-hackers-industrial-attacks-spring-2025 * https://www.mei.edu/publications/iranian-apts-overview * https://cloud.google.com/blog/topics/threat-intelligence/unc1860-iran-middle-eastern-networks * https://cloud.google.com/blog/topics/threat-intelligence/uncovering-iranian-counterintelligence-operation * https://www.darkreading.com/vulnerabilities-threats/anatomy-of-the-new-iranian-apt * https://www.infopoint-security.de/medien/fireeye-operation-saffron-rose.pdf * https://narimangharib.com/ * https://darknetdiaries.com/transcript/30/ * https://www.youtube.com/playlist?list=PLjiTz6DAEpuINUjE8zp5bAFAKtyGJvnew * https://www.zdnet.com/article/source-code-of-iranian-cyber-espionage-tools-leaked-on-telegram/ * https://cloud.google.com/blog/topics/threat-intelligence/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware * Host: Josh Stepp * Produced by: Josh Stepp Thank you for tuning in to IntrusionsinDepth. Stay informed, stay safe, and see you in the next episode! Get full access to IntrusionsInDepth at www.intrusionsindepth.com/subscribe