How Prepared Is the Defense Industrial Base for Iranian Cyber Attacks?

Iranian cyber actors have been targeting the Defense Industrial Base for years, and with Operation Epic Fury underway, the question now isn't whether they're coming. It's whether the security requirements already on the books are actually equipped to stop them.

These aren't projections or best-case scenarios. They are derived directly from MITRE's publicly available ATT&CK dataset and CISA's own advisories; the same technical intelligence the security community has been building for decades.

Before going any further, let's clarify one thing: CMMC is not a set of security requirements. It's a verification program. The actual requirements come from NIST SP 800-171, which defense contractors handling sensitive government information are already obligated to implement under their contracts.

CMMC exists because the government learned that having requirements on paper and actually implementing them are two different things. The program's entire value is in the verification. So, the real question isn't whether CMMC stops Iranian hackers, but whether the underlying requirements that CMMC verifies are actually matched to the real-world threat.

The answer is an unequivocal yes.

We pulled the profiles for five Iranian threat groups known to target defense contractors: MuddyWater, APT33, OilRig, Fox Kitten, and Ajax Security Team. These groups work at the direction of the Iranian government and have been caught targeting defense, aviation, manufacturing, and energy companies; exactly the sectors that make up the DIB. 

Across those five groups, the database documents 130 distinct attack techniques. OilRig alone accounts for 82 documented techniques, followed by MuddyWater at 58 and Fox Kitten at 41, reflecting their greater operational tempo and broader targeting across the defense sector.

The top techniques cluster into two categories that should concern every defense contractor: credential theft (this includes: dumping passwords from system memory, harvesting credentials stored in files, and pulling saved browser passwords), and initial access, most commonly through spearphishing attachments and malicious files that employees are socially engineered into opening. Notice how these aren't sophisticated zero-days. They are well-documented, repeatable playbooks that Iranian operators have been running for years.

The data shows that 68% of the techniques these Iranian groups use can be mitigated with the right controls in place. (Some techniques can’t be mitigated with preventative security controls because they are based on what's known as the abuse of system features and native utilities.) But here's the other number worth remembering: 100%. Every known Iranian technique can be detected if you have monitoring in place. You may not be able to stop all of them, but none of them have to be invisible.

What’s equally striking is how concentrated the defensive value is. Half of the mitigation coverage against known Iranian techniques comes from just ten security controls, and four of them do the heaviest lifting: system monitoring covers 84 of the 130 techniques, configuration settings covers 76, baseline configuration covers 68, and malicious code protection covers 58. Together, these four controls provide at least partial protection against every technique used by these Iranian actors.

These aren't exotic or expensive capabilities. They're the fundamentals: know what's on your network, keep it configured the way you set it up, watch for things that shouldn't be happening. The controls that generate the most pushback from contractors as burdensome or costly are the same ones carrying most of the defensive weight against a nation-state adversary.

That said, the baseline doesn't cover everything it could.

About half of the security controls that would further reduce Iranian cyber risk aren't included in the 800-171 baseline at all. Some were excluded because they fall outside the specific scope of protecting sensitive government information. Others were left out of Rev. 2 on the assumption that contractors would already be doing them without being told. That assumption proved wrong, and Rev. 3 corrected it, though largely by reclassifying those controls as out of scope rather than adding them to the baseline. The floor rises slightly from Rev. 2 to Rev. 3, but not dramatically.

The practical implication is that 800-171 compliance gets you most of the way there. All ten of the top controls that provide the bulk of mitigation value against Iranian techniques are present in 800-171 across both revisions. This proves that the framework was built with exactly this kind of threat coverage in mind.

However, if your organization handles particularly sensitive programs, sits in a high-risk part of the supply chain, or has reason to believe it's a specific target, the baseline is a floor, not a ceiling. Those organizations should be looking beyond 800-171 to the full NIST SP 800-53 catalog, where the remaining coverage gaps get closed.

If you're implementing 800-171 and pursuing CMMC certification, you are not going through a compliance exercise disconnected from real-world threats. The requirements you're being asked to meet are, by independent analysis, among the most efficient tools available for detecting and disrupting Iranian cyber activity.

The highest-leverage investments you can make right now are monitoring, configuration management, baseline hardening, and malicious code protection. Those aren't the flashiest investments in your security program, but they're the ones the data says matter most.

In a threat environment where Iranian cyber actors are actively targeting the defense industrial base, the question isn't whether 800-171 is relevant. The question is whether you've actually done it.

Jacob Horne is the Chief Cybersecurity Evangelist at Summit 7, specializing in DFARS, NIST, and CMMC compliance for contractors in the Defense Industrial Base. With over 18 years of experience in offensive and defensive cybersecurity operations, he began his career as an NSA intelligence analyst and U.S. Navy cryptologic technician.