A feeling that has always been there regarding the vulnerability of our digital infrastructure gets solidified with news like this.
Iranian hackers have reportedly been breaching critical sectors like healthcare and energy, and then selling access on cybercriminal forums. It's one thing when financially motivated attacks were the case, but when state-backed actors initiate, that's a different story, a more dangerous one. You get this feeling that some kind of war is being prepared by nations, and the battlefield could be any place that we least expect.
Brute-force attacks, MFA push bombing (happened to me not so long ago), and leveraging utilities such as PowerShell via basic Microsoft Word files. It's not high-tech in the way people might imagine, but it's easily accessible.
These aren't one-time events, this is a calculated process: initial access, lateral movement, credential dumping, it’s all very systematic and methodical. Worst of all, most organizations are not equipped to detect such attacks in good time.
Everything from tips on checking logs and impossible logins, yet all of it just feels so reactive. Even as a tech-savvy guy, I still have this little feeling of helplessness: our systems really need to evolve, or this is unfortunately going to be the new norm.
