Iranian Hackers Are Quietly Building Access They Can Turn Into Wartime Disruption

Iran-linked threat actors are quietly establishing persistent access across companies, cloud accounts, service providers, and industrial control systems — a strategy the report calls 'access optionality'. Using stolen credentials, remote administration tools, recruitment-themed phishing, signed-software/backdoors, and attacks on internet-facing PLCs (Rockwell/Allen-Bradley), these campaigns enable long-term espionage, data theft, pressure campaigns, and selective disruption; the report urges removing direct internet access to OT, enforcing phishing-resistant MFA, restricting and monitoring vendor access, and testing isolated recovery systems.