Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Iran’s APT42 — also known as Charming Kitten or Mint Sandstorm — is redefining social engineering with generative AI, deepfake voice cloning, and long-term phishing campaigns. In this episode of the Cyber Resilience Brief, we break down how Iranian state-sponsored threat actors are using AI-powered phishing, MFA fatigue attacks, credential harvesting, and hack-and-leak operations to target journalists, political campaigns, academics, and enterprise executives.

In today’s cyber landscape, intelligence services often rely on proxy networks to expand their reach. Through ransomware affiliates, access brokers, and loosely connected cybercriminal ecosystems — sometimes referred to conceptually as “Plozny Jurak” — states can benefit from disruptive or espionage activity without direct attribution. To dive deeper, watch the full podcast, Blueprint Thieves: Inside Iran’s Industrial Espionage Machine, at the links below.

In this episode of _The Cyber Resilience Brief_, we break down the modern reality of *Iranian cyber warfare and industrial espionage*. Host Tova Dvorin and offensive security engineer Adrian Culley analyze the tactics, techniques, and procedures (TTPs) of *APT33, OilRig (APT34), and MuddyWater* — three of the most active Iranian state-sponsored threat actors targeting *energy, aviation, manufacturing, government, and critical infrastructure*.

In Part 2 of our Russia cyber threat series, we unpack the Western cybercrime ecosystem powering Russian ransomware operations. We examine *Scattered Spider, LAPSUS$, and Shiny Hunters*, and how social engineering, SIM swapping, MFA bypass, and AI-driven voice spoofing are breaching Fortune 100 companies — without zero-days. Learn how access brokers commoditize breaches, why help desks are prime targets, and what this shift means for CISOs and security teams.