LevelBlue SpiderLabs has been tracking the very active and destructive cyber activities taking place during the ongoing US-Israel-Iran war since it kicked off on March 2.
Ziv Mador, vice president of Security Research at LevelBlue, conducted a 30-minute webinar this week, Operation Epic Fury Decoded: Iran's Cyber Escalation Playbook that gave an overview of that research along with the information the team had published a two-part blog series (Part 1 and Part 2) covering the war.
The webinar replay can be viewed at your convenience by following this link.
Some of the points covered during the presentation include:
- How Israeli and US cyber teams were able to track Iran’s former leader by hacking traffic cameras in Tehran, providing information that led to an air strike on his position
- How Iranian threat actors like MuddyWater, Charming Kitten, OilRig, APT33, and affiliated operators are evolving their tradecraft
- Early retaliation signals, from reconnaissance and DDoS to destructive pre-positioning
- How to align SOC detection with the intrusion-to-disruption lifecycle and take steps to prepare your organization to defend itself during this developing situation
- Which critical infrastructure sectors are most at risk and why
It’s important to remember that despite the fact the kinetic aspect of the war is regional, it has the war’s cyber operations have the potential to strike targets worldwide, so everyone needs to be prepared and understand what is taking place.
