Iranian hackers have been actively targeting critical infrastructure sectors worldwide. They have been breaching such networks and then selling access to other cybercriminals. A joint advisory from US, Canadian, and Australian cybersecurity agencies highlights that the hackers have focused on sectors like healthcare, government, energy, and information technology.

These attackers act as initial access brokers, selling credentials and network data that they have stolen on underground forums.

“Since October 2023, Iranian actors have used brute force, such as password spraying, and multifactor authentication (MFA) ‘push bombing’ to compromise user accounts,” the advisory reported. These methods grant hackers access by overwhelming users with repeated MFA requests until one is mistakenly approved.

Once inside the targeted systems, the hackers gather additional credentials and escalate their privileges, gaining deeper control over the compromised networks. These credentials are often then sold to other threat actors, who can exploit them for espionage or further cyberattacks.

BleepingComputer pointed out that the hackers have sold “full domain control privileges“, enabling buyers to use the domain for malicious purposes. Additionally, SecurityWeek revealed that Iranian hackers, particularly a group known as Cyber Av3ngers, have recently turned to AI tools like ChatGPT to aid in their reconnaissance and attack planning.

OpenAI reported that this group used ChatGPT to identify vulnerabilities in industrial control systems (ICS) and conduct attacks on water utilities in the US and Ireland. Although the AI tools didn’t provide groundbreaking capabilities, they assisted in vulnerability research.

With these evolving tactics, the advisory urges organizations to strengthen their defenses by implementing phishing-resistant MFA, monitoring for unusual login activity, and enhancing password security policies.