Cybercrime isn't just a cover for Iran's government goons - it's a key part of their operations

A cluster of active, high-impact cyber incidents and trends: Iranian state-linked groups are increasingly embedding and reusing criminal malware/ransomware pipelines for espionage and persistence; MuddyWater backdoors and broad camera/IoT targeting around the Israel–Iran conflict have been observed. Criminals compromised hundreds of legitimate WordPress sites (including a US Senate candidate’s page) to deliver infostealers via fake CAPTCHA, while a Russian-speaking actor used malicious ISO job applications that disable EDR before data theft. Vishing against a vendor led to an Ericsson breach (