Microsoft: Iran is refining its cyber operations

Microsoft Threat Analysis Center reports that Iranian-linked cyber operations have evolved from opportunistic, reactive actions to coordinated, destructive campaigns across a wider geographic scope; researchers track an increase from nine to 15 Iranian-linked groups, use of contractor-managed personas, AI-driven influence operations, and attacks that targeted countries and infrastructure (including an Israeli-made PLC in a Pennsylvania water utility), raising concerns about threats to U.S. critical infrastructure and the 2024 elections.