Frequently Asked Questions About Iranian Cyber Operations

Tenable’s Research Special Operations team focuses on some frequently asked questions about Iranian cyber operations, including the tactics, techniques and procedures employed by Iran-based threat actors.

Background

Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding Iranian cyber operations in the wake of the recent conflict and warnings from U.S. government agencies, including the Department of Homeland Security (DHS), about potential retaliatory attacks from cyber actors affiliated with the Iranian government as well as hacktivists.

This FAQ provides a focused analysis of Iranian state-sponsored cyber threats, detailing the types of threats used by Advanced Persistent Threat (APT) groups, tactics, techniques and procedures (TTPs) mapped to the MITRE ATT&CK framework and the specific vulnerabilities they consistently exploit. We also provide guidance about Tenable product coverage you can use to reduce your cyber exposure to these threats.

FAQ

Has there been an increase in threat activity related to Iran-based threat actors?

While there have been ample warnings from U.S. government agencies about retaliatory attacks, we’re also seeing a slight increase in reported activity by threat actors. Reports have cited that threat actors have begun targeting U.S. finance, defense, and energy sectors. While this activity has been limited to distributed-denial-of-service (DDoS) attacks, there have also been recent reports of an increase in targeted phishing attacks.

Which threat actors are believed to be Iran-based or linked to the Iranian government?

In recent years, several Iran-based groups have been identified by security vendors and U.S. government agencies, including the Cybersecurity and Infrastructure Security Agency (CISA). In some alerts, threat activity has been linked to the Iranian Islamic Revolutionary Guard Corps (IRGC), while other APT groups and hacktivist groups have been identified as having ties to Iran. The table below outlines the groups and known activities linked to them. While this is not an exhaustive list of all known APTs and threat actors known to have previously been attributed to Iran, these groups have been recent subjects of CISA and other U.S. government alerts and have been featured in reports from multiple security vendors.

What are the vulnerabilities that have been targeted by Iranian threat actors?

The following table contains a list of CVEs that have been known to be exploited by Iran-based threat actors. This list of CVEs covers a wide range of commonly exploited vulnerabilities that have also been abused by a wide variety of threat actors beyond just Iran-based APTs or state-sponsored actors.

*Please note: Tenable’s Vulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was published on June 27 and reflects VPR at that time.

Has Tenable released any product coverage for these vulnerabilities?

The CVEs covered in this blog have product coverage from Tenable. A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages:

• CVE-2017-11774
• CVE-2018-13379
• CVE-2019-0604
• CVE-2019-11510
• CVE-2019-19781
• CVE-2019-5591
• CVE-2020-12812
• CVE-2020-1472
• CVE-2021-31207
• CVE-2021-34473
• CVE-2021-34523
• CVE-2021-44228
• CVE-2021-45046
• CVE-2021-45105
• CVE-2022-1388
• CVE-2022-26134
• CVE-2022-30190
• CVE-2022-42475
• CVE-2022-47966
• CVE-2022-47986
• CVE-2023-27350
• CVE-2023-3519
• CVE-2023-38831
• CVE-2023-46805
• CVE-2023-6448
• CVE-2024-21887
• CVE-2024-24919
• CVE-2024-30088
• CVE-2024-3400

These links will display all available plugins for the listed vulnerabilities, including upcoming plugins in our Plugins Pipeline. In addition to plugin coverage, the tables below highlight additional Tenable product coverage for the MITRE ATT&CK IDs that are known to be associated with Iran-based threat actors.

Tenable attack path techniques

Tenable Identity Exposure Indicators of Exposure and Indicators of Attack

Tenable Web App Scanning

Tenable OT Security

What else should I do to remain secure?

Cyber hygiene is even more critical in the face of heightened awareness than it is in normal times. Many of the attacks stemming from Iranian-sponsored threat actors mirror tactics used by other cyber actors, including exploiting software and devices that use weak authentication. Attacks have also targeted operational technology (OT) devices. To strengthen your cyber defenses, we recommend:

• Using strong passwords and enforcing a strong password policy
• Enabling multi-factor authentication (MFA)
• Changing default passwords, especially on OT hardware
• Patching vulnerabilities in assets exposed to the internet
• Identifying and prioritizing your most valuable assets for remediation
• Developing a remediation plan and continuing to test and improve it

Get more information

• Tenable Blog: Navigating a Heightened Cyber Threat Landscape: Military Conflict Increases Attack Risks
• Tenable Blog: AA24-241A : Joint Cybersecurity Advisory on Iran-based Cyber Actors Targeting US Organizations
• Tenable Blog: AA22-257A: Cybersecurity Agencies Issue Joint Advisory on Iranian Islamic Revolutionary Guard Corps-Affiliated Attacks
• Department of Homeland Security National Terrorism Advisory System Bulletin - June 22, 2025

Join Tenable's Research Special Operations (RSO) Team on the Tenable Community.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.