Members of a notorious Iranian hacking crew are using false personas to steal credentials and access victim cloud environments, per a new Mandiant report.

The group known as TA453 has added "outlier" attacks to its portfolio over the past two years, seemingly in concert with Iranian hardliners.