Iran Cyber Threat Overview: Everything To Know

### Executive summary This Sekoia.io analysis assesses Iran-nexus intrusion sets (IRGC and MOIS) active in 2022–2023 — including APT35/APT42, MuddyWater, Oilrig, Hexane, Cotton Sandstorm and Nemesis Kitten — as conducting strategic espionage, domestic surveillance, destructive operations and information operations, leveraging contractors and fronts, exploiting public CVEs, and targeting energy, telecommunications, maritime transport, government and NGO individuals.