Investigating Initial Access Strategies and Malware Deployment Tactics Used by Iranian Advanced Persistent Threat Groups

In the domain of cyber threats, Iran is listed among the top four concerns for the United States. Beyond its nuclear potential, Iran commands a substantial cyber force linked to at least 11 Advanced Persistent Threats (APTs), responsible for a wide range of cyber attacks targeting government, healthcare, infrastructure, and essential services like power. Mapping APT threats is crucial in the Cyber Threat Intelligence (CTI) field, as network defenders must have actionable knowledge to implement defenses. Linking these Tactics, Techniques, and Procedures (TTPs) and common attack vectors is one step toward this goal. There is a gap in existing research identifying similarities and common tactics shared among Iran APT malware and initial access vectors. This research examines the Advanced Persistent Threats (APTs) attributed to Iran, focusing on historically documented and currently active groups, focusing on their malware and TTPs.