Escalating Iranian APT Threats Against Critical Infrastructure Amid Geopolitical Conflict

Nozomi Networks and Cybersecurity News report a notable rise in Iran-affiliated APT activity concurrent with regional military strikes, highlighting MuddyWater, OilRig (APT34), APT33 and UNC1549 targeting manufacturing, transportation, energy and defense. Observed activity is largely early-stage reconnaissance—default credential abuse, brute force, valid account misuse and network scanning—with three IP IoCs listed (37.1.213.152, 184.75.210.206, 162.0.230.185); the report urges immediate hardening of OT/IoT assets, network segmentation, updated threat signatures and continuous monitoring.