DomainTools Investigations exposes the Zedxion and Zedcex ecosystem—a layered financial architecture leveraging disposable UK shell companies, persistent digital tokens, and UAE-based trade fronts to facilitate IRGC-linked sanctions evasion and illicit Iranian funds transfers.
Moving beyond traditional state-centric APT structures, the pro-Iran coalition of jihadist-aligned collectives, nationalist actors, and opportunistic groups coordinates via Telegram to turn low-cost cyber operations into high-impact psychological warfare. While individual actors primarily rely on technically unsophisticated tradecraft like DDoS-for-hire tools, website defacements, and recycled breach data, their strategic strength lies in speed, visibility, and rapid mobilization alongside real-world kinetic events.
DTI reveals how Russia, China, and Iran are exploiting weak OT security and internet-facing PLCs to target critical water and wastewater infrastructure. From Volt Typhoon's strategic pre-positioning to Sandworm-adjacent sabotage, discover the primary TTPs, vulnerabilities, and MITRE ATT&CK mappings reshaping modern hybrid warfare.
.png)
When government backlogs trigger appointment scarcity, scammers step in.This investigation exposes the mechanics of "scarcity scams"—from replica portals to weaponized session-recording tools. Discover how cybercriminals exploit administrative bottlenecks globally to extract fake fees and harvest critical identity data.
Commentary followed by links to cybersecurity articles and resources that caught our interest internally.
DomainTools Investigations exposes the Zedxion and Zedcex ecosystem—a layered financial architecture leveraging disposable UK shell companies, persistent digital tokens, and UAE-based trade fronts to facilitate IRGC-linked sanctions evasion and illicit Iranian funds transfers.
Moving beyond traditional state-centric APT structures, the pro-Iran coalition of jihadist-aligned collectives, nationalist actors, and opportunistic groups coordinates via Telegram to turn low-cost cyber operations into high-impact psychological warfare. While individual actors primarily rely on technically unsophisticated tradecraft like DDoS-for-hire tools, website defacements, and recycled breach data, their strategic strength lies in speed, visibility, and rapid mobilization alongside real-world kinetic events.
DTI reveals how Russia, China, and Iran are exploiting weak OT security and internet-facing PLCs to target critical water and wastewater infrastructure. From Volt Typhoon's strategic pre-positioning to Sandworm-adjacent sabotage, discover the primary TTPs, vulnerabilities, and MITRE ATT&CK mappings reshaping modern hybrid warfare.
When government backlogs trigger appointment scarcity, scammers step in.This investigation exposes the mechanics of "scarcity scams"—from replica portals to weaponized session-recording tools. Discover how cybercriminals exploit administrative bottlenecks globally to extract fake fees and harvest critical identity data.
Commentary followed by links to cybersecurity articles and resources that caught our interest internally.
A sophisticated AiTM phishing kit bypassing traditional MFA to steal Microsoft 365 session cookies. Get the full breakdown and IOCs.
