Iranian Cyber Ops Maintain US Network Footholds and Expand Surveillance Activity

What happened

Iran-linked threat actors have established and maintained covert access inside multiple U.S. and Canadian networks while simultaneously expanding cyber operations targeting surveillance infrastructure in the Middle East. The activity involves long-term persistence within compromised environments, allowing attackers to monitor systems and potentially prepare for future operations. Researchers noted that the campaign focuses on maintaining footholds rather than launching immediate disruptive attacks, with tactics including credential-based access and lateral movement across networks. In parallel, the same actors have targeted internet-connected cameras and surveillance systems to support intelligence gathering efforts tied to regional geopolitical activity. The campaign reflects a shift toward sustained access and reconnaissance rather than short-term disruption. 

Who is affected

Organizations in the United States and Canada across sectors such as finance, transportation, and infrastructure are affected, particularly those where attackers have established persistent access within internal networks. 

Why CISOs should care

Persistent footholds inside enterprise networks increase the risk of future cyber operations, as attackers can remain undetected while conducting reconnaissance, collecting data, or positioning themselves for later disruption. 

3 practical actions

1. Monitor for long-term persistence. Detect abnormal authentication patterns and lateral movement across internal systems. 
2. Audit credential exposure risks. Investigate potential credential theft or reuse that could enable initial access. 
3. Inspect surveillance and IoT systems. Identify unauthorized access to cameras and connected devices used for intelligence gathering. 

For more coverage of major incidents and threat activity, explore our reporting on Cyberattacks.