Iranian cyber ops shift: less custom malware, more destructive LotL. They target the enterprise m...

Summary

Iranian threat actors are evolving their operational tactics away from custom malware toward destructive living-off-the-land (LotL) attacks that target enterprise management planes rather than just endpoint detection and response (EDR) evasion. This shift reflects a focus on compromising identity and access control systems within organizations. The analysis emphasizes that defenders must strengthen identity resilience to counter this emerging attack pattern.

Entities