[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQATS4Y8nyaLU8Z2bLgnH5rGD--k_EkVqTOkXHaPh9SE":3},{"article":4,"iocs":45,"watch_terms":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":11,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":29},"3149668f-c38b-4c98-9910-04a5c91ab9d2","Iranian cyber ops shift: less custom malware, more destructive LotL. They target the enterprise m...","iranian-cyber-ops-shift-less-custom-malware-more-destructive-lotl-they-target-th","Iranian cyber ops shift: less custom malware, more destructive LotL. They target the enterprise management plane, not just EDR evasion. When management tools become weapons, defense must evolve to strict identity resilience. Read the full analysis: https:\u002F\u002Ft.co\u002Fi2xzhBzm0Y https:\u002F\u002Ft.co\u002Fc7wEdKXZUF","Iranian threat actors are evolving their operational tactics away from custom malware toward destructive living-off-the-land (LotL) attacks that target enterprise management planes rather than just endpoint detection and response (EDR) evasion. This shift reflects a focus on compromising identity and access control systems within organizations. The analysis emphasizes that defenders must strengthen identity resilience to counter this emerging attack pattern.","Iranian cyber ops shift to living-off-land techniques targeting enterprise management infrastructure.",null,"https:\u002F\u002Fx.com\u002FUnit42_Intel\u002Fstatus\u002F2039765832897642754","2026-04-02T18:04:06+00:00","2026-04-02T19:00:13.945378+00:00",7,[17,20,23],{"name":18,"type":19},"Iranian cyber operations","threat_actor",{"name":21,"type":22},"living-off-the-land (LotL) techniques","technology",{"name":24,"type":22},"EDR (Endpoint Detection and Response)","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":25,"icon":11,"name":27,"slug":28},"Nation-state","nation-state",[30,35,40],{"category":31},{"id":32,"icon":11,"name":33,"slug":34},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":36},{"id":37,"icon":11,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":11,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[]]