Iran-Linked Hackers Exploit Trusted Access and Exposed OT Systems for Espionage and Disruption

This report assesses Iran-linked activity as prioritizing durable, flexible access in enterprise and OT networks—gained via compromised administrator accounts, remote-management abuse, and service-provider relationships—to enable espionage, downstream targeting, or selective disruption; it highlights use of AI-assisted tooling and persona-driven propaganda channels, and documents probing and exploitation of internet-facing PLCs and HMI/SCADA assets in critical infrastructure sectors.