When geopolitical conflict escalates, enterprise security teams outside the immediate zone are tempted to treat it as noise, relevant to governments and defence contractors but not to organisations running commercial operations in Southeast Asia or Europe. That instinct is wrong, and 2026 has shown why.

After Israeli strikes on Iranian nuclear facilities in February, more than 60 hacktivist groups activated within 72 hours. Iranian APT clusters targeted Gulf energy infrastructure and UAE financial services organisations. CISA issued emergency guidance. GPS signals were disrupted across the Gulf, affecting more than 1,100 vessels. The cyber dimension of geopolitical conflict does not observe geographic boundaries, and it does not limit itself to direct adversaries.

The FBI's assessment of Iranian threat actor methodology is the one thing I would ask any CISO to read carefully. Its characterisation: these groups target the simplest gaps in the most consequential systems. Default passwords. Unpatched internet-facing devices. Misconfigured cloud access controls. These are not exotic, nation-state-exclusive vulnerabilities. They are hygiene failures present in the majority of enterprise environments globally.

‍

What They Actually Do, and How

Peach Sandstorm, the IRGC-linked cluster documented by Microsoft Threat Intelligence, spent much of the February escalation period running large-scale password spraying operations against Azure Active Directory environments. Not zero-days. Not sophisticated custom implants. Systematically trying common passwords across thousands of accounts until something unlocks. It works because a significant proportion of cloud environments still do not enforce MFA, or enforce it in ways that do not adequately protect against spraying at volume.

CyberAv3ngers, another IRGC-affiliated group, compromised more than 75 programmable logic controllers in US water treatment facilities. The entry method was internet-facing industrial control systems with default credentials that had never been changed. The attack demonstrated reach and capability. Operators kept manual control, so the harm was limited. But the technical capability to disrupt water treatment operations had been proven. What constrained the outcome was adversarial intent, not adversarial capability.

The implication for organisations outside the Middle East is direct. If your environment has internet-facing systems with default credentials, unpatched VPN gateways, or cloud identity controls that do not prevent password spraying, you are exposed to the same initial access vectors Iranian threat actors are actively exploiting, whether or not you are in their targeting scope.

‍

The Practical Response: Five Concrete Actions

Geopolitical threat intelligence is only useful if it translates into operational action. Based on the documented techniques of Iranian APT clusters, five areas warrant immediate attention in most enterprise environments.

First, credential hygiene across all internet-facing systems. This is not a policy review but active verification that default credentials have been changed on every device, management interface, and OT system. Second, prioritised patching of internet-facing infrastructure such as VPN gateways, firewalls, and remote access services, where known exploits are documented in CISA's Known Exploited Vulnerabilities catalogue. Third, cloud identity hardening for Azure AD environments specifically, which means reviewing authentication logs for password spray indicators, enforcing phishing-resistant MFA on cloud management access, and auditing conditional access policy completeness. Fourth, verification of OT network segmentation, confirming that IT/OT boundaries are technically enforced and not just documented in policy. Fifth, an incident response plan review for nation-state scenarios, since the TTPs of state-sponsored threat actors differ materially from ransomware and commodity threats, and playbooks should reflect that difference.

None of these are advanced capabilities. They are disciplined execution of fundamentals. That is what the FBI assessment tells us is required, and it is a message that should be both reassuring and sobering. Reassuring because the gap is closable. Sobering because it has not been closed yet.

‍

Conclusion

The February 2026 escalation is a case study in how geopolitical cyber risk transmits to enterprises. The key lesson is not that every organisation is a direct target of Iranian state actors. It is that the techniques Iranian actors rely on for initial access are the same ones any threat actor uses against any organisation with the same hygiene gaps.

Addressing credential hygiene, internet-facing attack surface, cloud identity security, and OT segmentation is warranted regardless of any specific geopolitical threat. The current environment simply adds urgency to work that should already have been prioritised.