009.1: CRASH COURSE: IRAN | Geopolitics, Cyber Threat Groups and Operations

Key Topics:

• US-Iran Historical Tensions

• Iran’s Demographics & Strategy

• Nuclear Program & 2025 Strikes

• Proxy Networks (Axis of Resistance)

• Iranian Cyber Threat Actors
  
  

  ---

Call to Action:

• Subscribe to the podcast for more episodes on high-profile cyber intrusions.

• Visit our website at intrusionsindepth.com for additional stories and insights.

• Share your thoughts on social media using #IntrusionsInDepth.

---

Books:

• Stuxnet and the Launch of the World’s First Digital Weapon Countdown to Zero Day - Kim Zetter

• Iran’s Perilous Pursuit of Nuclear Weapons — David Albright & Sarah Burkhard

• From Intel to Iran: The Defection of Monica Witt — Borna Ahadi

---

Links and Resources:

• https://en.wikipedia.org/wiki/Judicial_system_of_the_Islamic_Republic_of_Iran

• https://attack.mitre.org/groups/G0069/

• https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming

• https://cloud.google.com/security/resources/insights/apt-groups#global-threats-iran

• https://en.wikipedia.org/wiki/Shamoon

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a

• https://cyberscoop.com/hack-and-leak-group-black-shadow-keeps-targeting-israeli-victims/

• https://iapp.org/news/b/black-shadow-hackers-re-emerge-with-second-israeli-breach

• https://www.securiwiser.com/news/black-shadow-hits-cyberserve-and-lgbtq-dating-app-client/

• https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations

• https://cloud.google.com/blog/topics/threat-intelligence/uncovering-iranian-counterintelligence-operation

• https://cloud.google.com/blog/topics/threat-intelligence/unc1860-iran-middle-eastern-networks

• https://www.mei.edu/publications/iranian-apts-overview

• https://cloud.google.com/blog/topics/threat-intelligence/apt42-charms-cons-compromises

• https://www.csis.org/programs/strategic-technologies-program/significant-cyber-incidents

• https://darknetdiaries.com/transcript/30/

• https://risky.biz/why-iran-is-a-scaredy-cat-cyber-chicken/

• https://www.fbi.gov/contact-us/field-offices/boston/news/press-releases/fbi-releases-cybersecurity-advisory-on-previously-undisclosed-iranian-malware-used-to-monitor-dissidents-and-travel-and-telecommunications-companies

• https://home.treasury.gov/news/press-releases/sm1127

• https://mjolnirsecurity.com/the-asymmetric-battlefield-an-anthropological-and-geopolitical-analysis-of-iranian-cyber-threats-to-north-american-critical-infrastructure/

• https://cloud.google.com/blog/topics/threat-intelligence/apt33-insights-into-iranian-cyber-espionage

• https://www.picussecurity.com/resource/blog/understanding-active-iranian-apt-groups

• https://therecord.media/iran-state-backed-hackers-industrial-attacks-spring-2025

• https://www.mei.edu/publications/iranian-apts-overview

• https://cloud.google.com/blog/topics/threat-intelligence/unc1860-iran-middle-eastern-networks

• https://cloud.google.com/blog/topics/threat-intelligence/uncovering-iranian-counterintelligence-operation

• https://www.darkreading.com/vulnerabilities-threats/anatomy-of-the-new-iranian-apt

• https://www.infopoint-security.de/medien/fireeye-operation-saffron-rose.pdf

• https://narimangharib.com/

• https://darknetdiaries.com/transcript/30/

• https://www.youtube.com/playlist?list=PLjiTz6DAEpuINUjE8zp5bAFAKtyGJvnew

• https://www.zdnet.com/article/source-code-of-iranian-cyber-espionage-tools-leaked-on-telegram/

• https://cloud.google.com/blog/topics/threat-intelligence/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware

  
  

---

• Host: Josh Stepp

• Produced by: Josh Stepp

---

Thank you for tuning in to IntrusionsinDepth. Stay informed, stay safe, and see you in the next episode!