Iranian Hackers Acting As Ransomware Access Brokers

Executive summary: A US government joint advisory details Iran-linked, state-sponsored cyber actors (aliases: Pioneer Kitten, Lemon Sandstorm, xplfinder) that have evolved into access brokers for ransomware affiliates while continuing espionage and hack-and-leak operations; they exploit known vulnerabilities in internet-facing devices (multiple CVEs listed), maintain persistent access using webshells and backdoors, and have observable IOCs (IPs, domains, tunneling tools, and bitcoin addresses) — organizations in critical sectors are urged to patch, monitor for suspicious outbound connections and unauthorized remote-access tools, and review provided MITRE ATT&CK mappings and IOCs for detection and mitigation.