Iranian Use of Cybercriminal Tactics in Destructive Cyber Attacks

This advisory warns that Iranian state-sponsored and aligned actors increasingly blend ransomware, data-wiping malware, DDoS, and hacktivist tactics to conduct destructive, retaliatory campaigns against political targets and critical infrastructure; it profiles groups such as UNC757 and Handala, reviews past incidents (e.g., Albania, municipal ransomware), describes likely TTPs (VDI/VPN exploitation, long-term access and exfiltration), and provides prioritized defensive actions including patching, strong MFA, hardened VDI/VPN, monitoring for persistence/tunneling, dedicated anti-ransomware controls, DDoS protection, and incident response planning.