APT34

G0057

⚠ Critical Threat

Iraq and Yemen Espionage, Post-October 7 Operational Surge, Edge Infrastructure Targeting

Origin Iran

Sponsor Ministry of Intelligence and Security (MOIS) of the Islamic Republic of Iran

Motivation Strategic cyber-espionage and intelligence collection to advance Iranian geopolitical objectives

Target Sectors

Government Critical Infrastructure Telecommunications Finance Energy Defense Chemical Aviation Education

Rapid exploitation of internet-facing systems (VPNs, Edge devices)

Spearphishing

Social Engineering

Credential Harvesting

Web shells

Living-off-the-land (LotL) techniques

Custom DNS Tunneling for C2

Supply chain attacks

Exploitation of edge network CVEs (Fortinet, Citrix, Ivanti, F5)

CISA Advisories ↗

Hacking the mainframe…