IBM's X-Force security team says it has obtained five hours of screen recordings from Iran-linked hacking group ITG18 that were uploaded to an exposed server
Andy Greenberg / Wired :
Context & Ripple Effects
IBM's X-Force has been in the threat-intelligence publishing business for years — since it opened decades of cyber-threat data to the public on X-Force Exchange in 2015 — and Iran-linked intrusion crews are a recurring subject of its research, going back to researchers' claims that such actors hauled at least 6TB out of Citrix in the long-running Citrix breach. What makes this story different is the source: rather than inferring tradecraft from network artifacts, X-Force says it pulled five hours of the hackers' own screen recordings off a server ITG18 left exposed.
The find lands amid heightened scrutiny of Iranian operations — the same period when sources reported suspected attacks on water and wastewater utilities across at least a dozen US states with Iran as the prime suspect — so primary-source visibility into an Iranian crew's working methods is unusually valuable ammunition for defenders.
First-order effects
- Defenders and IBM's clients get a direct window into ITG18's tools, targets, and workflow straight from the operators' screens, letting X-Frame analysts convert the footage into concrete indicators rather than inferred ones.
- ITG18 itself is immediately compromised operationally: credentials, victim lists, and internal tooling visible in the recordings must be assumed burned, forcing rapid rotation of infrastructure.
Second-order effects
- Rival threat-intel vendors and government agencies will scramble to acquire or independently corroborate the same footage, turning an accidental leak into a competitive intelligence asset and pressuring attribution timelines on Iran-linked campaigns.
- Other state-aligned groups face renewed audit pressure on their own operational security — exposed staging servers have now cost attackers real capability twice over, following the pattern of earlier leaks like Kaspersky's deep documentation of the Stuxnet-linked Equation Group.
Third-order effects
- If attacker operational-security failures keep feeding vendor research this directly, the commercial threat-intel market consolidates around firms that can capture and weaponize raw adversary material fastest, raising the bar smaller shops cannot meet.
- For nation-state hacking programs, the structural lesson is that cloud-era convenience — staging captures on internet-reachable servers — creates a counterintelligence risk that may push sophisticated crews toward air-gapped workflows and harder-to-seize infrastructure.
The trend: Nation-state hacking groups' own infrastructure mistakes are becoming a primary raw material for the commercial threat-intelligence industry, shifting attribution from inference to direct observation.