Iranian-linked hackers collaborate with ransomware affiliates, feds say

U.S. agencies warn that Iranian-linked APT Pioneer Kitten (Lemon Sandstorm) has been acting as an access broker for ransomware affiliates including ALPHV/BlackCat, seeking initial network access in education, finance, healthcare, and defense, using tools like Shodan and targeting Ivanti VPNs and Citrix NetScaler devices; the group also conducts separate espionage activity against Israel and Azerbaijan.