Iranian hackers are going after critical infrastructure sector passwords, agencies caution

Iranian-affiliated cyber actors have been conducting sustained brute-force and credential-access attacks since October against healthcare, government, IT, energy and engineering sectors, using password spraying, trial-and-error attempts and MFA "push bombing" to gain and retain access; agencies warn the stolen credentials are sold on criminal forums and may be used or brokered to ransomware and other malicious operators.