Iran Conflict Cyber Operations: Russia-Iran Infrastructure Cooperation Deepens as Fuel Sector Targeting Confirmed

Anomali Threat Research

Published on

May 18, 2026

Table of Contents

Threat Assessment Level: HIGH <h2> Introduction </h2> Seventy-nine days into the Iran-US/Israel kinetic and cyber conflict, the cyber dimension is not only keeping pace with battlefield operations — it is accelerating independently of diplomatic efforts. A Trump-brokered ceasefire framework that explicitly excludes cyber operations has created a permissive environment where Iranian state actors and their Russian partners continue offensive operations unabated. This week's intelligence confirms three converging developments that demand immediate executive attention: Russian GRU infrastructure actively refreshed on Iranian networks (indicating deepening operational cooperation), a second independent confirmation of Iranian targeting of US fuel distribution systems, and a new publicly available Linux privilege escalation exploit that compounds risk across ICS/OT environments. The operational tempo has not decreased — and the 72-hour window following Iran's drone strike against the UAE's Barakah Nuclear Energy Plant on 17 May makes retaliatory cyber operations highly probable. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> APT28 (GRU) refreshed 4 IPs on Iranian ASN 213790 on 17 May </td> <td> Russia-Iran cyber cooperation is structural and ongoing — shared infrastructure active for 60+ days </td> </tr> <tr> <td> US fuel station ATG targeting confirmed by second source (Sunday Guardian, 16 May) </td> <td> Corroborates CISA KEV addition of CVE-2026-1340 (CVSS 9.8); Iranian actors actively exploiting Veeder-Root systems </td> </tr> <tr> <td> DirtyDecrypt Linux LPE exploit published publicly (18 May) </td> <td> Weaponization risk for all Linux-based ICS management interfaces and attacker C2 infrastructure </td> </tr> <tr> <td> PANICPOACH Android malware targeting Israeli citizens (campaign updated 13 May) </td> <td> Mobile surveillance expansion — assessed as battle damage assessment collection for kinetic targeting </td> </tr> <tr> <td> 8 CISA ICS advisories for Siemens SIMATIC CN 4100 and Ruggedcom ROX (14–15 May) </td> <td> Directly relevant to OT environments in Iranian target set </td> </tr> <tr> <td> Handala/Void Manticore — no new destructive claims observed since 11 March operation </td> <td> Operational silence over 60+ days assessed as preparation for follow-on attack, not cessation of activity </td> </tr> <tr> <td> MuddyWater (MOIS) OAuth device-code flow phishing confirmed targeting M365/Azure AD </td> <td> Persistent access technique bypasses MFA; financial and government sectors at elevated risk </td> </tr> <tr> <td> Ceasefire negotiations ongoing — cyber explicitly excluded </td> <td> Diplomatic track has zero observable effect on cyber operational tempo </td> </tr> </tbody> </table> Change from prior cycle: Threat level holds at HIGH. The Barakah drone strike (17 May) was the most significant kinetic escalation since the conflict began, but cyber indicators show continuation rather than further escalation. The APT28 infrastructure refresh within 24 hours of the Barakah strike suggests pre-positioned capability rather than reactive mobilization. <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Category </th> </tr> </thead> <tbody> <tr> <td> 28 Feb 2026 </td> <td> Iran conflict begins </td> <td> Kinetic </td> </tr> <tr> <td> 11 Mar 2026 </td> <td> Handala/Void Manticore destroys 200,000+ Stryker Corp endpoints via weaponized Microsoft Intune </td> <td> Destructive Cyber </td> </tr> <tr> <td> 7 Apr 2026 </td> <td> Reuters confirms Russia providing Iran satellite imagery + cyber support </td> <td> Cooperation </td> </tr> <tr> <td> 8 Apr 2026 </td> <td> US officials warn of Iranian cyber attacks targeting US infrastructure </td> <td> Advisory </td> </tr> <tr> <td> 18 Apr 2026 </td> <td> Forbes reports ceasefire framework explicitly excludes cyber domain </td> <td> Diplomatic </td> </tr> <tr> <td> 22 Apr 2026 </td> <td> UK MI6 chief names Russia, Iran, China as top cyber threats </td> <td> Strategic </td> </tr> <tr> <td> 14–15 May 2026 </td> <td> CISA issues 8 ICS advisories (Siemens SIMATIC, Ruggedcom ROX) </td> <td> Vulnerability </td> </tr> <tr> <td> 15 May 2026 </td> <td> CVE-2026-1340 (CVSS 9.8) — Iranian exploitation of US gas station ATG systems confirmed </td> <td> Exploitation </td> </tr> <tr> <td> 16 May 2026 </td> <td> Sunday Guardian confirms Iranian targeting of US fuel monitoring systems (second source) </td> <td> Corroboration </td> </tr> <tr> <td> 16 May 2026 </td> <td> APT42 BELLACIAO/SHELLAFEL campaigns refreshed in ThreatStream </td> <td> Actor Activity </td> </tr> <tr> <td> 17 May 2026 </td> <td> Iran drone strike on UAE Barakah Nuclear Energy Plant </td> <td> Kinetic Escalation </td> </tr> <tr> <td> 17 May 2026 </td> <td> APT28 IPs refreshed on Iranian ASN 213790 — 4 active indicators </td> <td> Infrastructure </td> </tr> <tr> <td> 18 May 2026 </td> <td> DirtyDecrypt Linux LPE exploit published publicly </td> <td> Weaponization </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Russia-Iran Cyber Cooperation: From Passive Hosting to Active Coordination </h3> Four IP addresses attributed to APT28 (Fancy Bear / GRU Unit 26165) were refreshed on 17 May within ASN 213790 ("Limited Network") , geolocated to Tehran. These indicators carry execution ( T1059 ) and command-and-control ( T1071 , T1571 ) capabilities. This ASN has hosted Russian state actor infrastructure for over 60 days — this is not temporary or opportunistic hosting. It represents a deliberate, structural cooperative arrangement. The convergence of signals — Reuters-confirmed satellite imagery sharing, shared network infrastructure, and the UK MI6 chief's joint naming of Russia-Iran-China — indicates the cooperation has moved beyond passive resource sharing to active operational coordination. The practical implication: attacks against Gulf state and Israeli targets may combine Russian technical sophistication with Iranian regional targeting knowledge. Key actors: APT28 (GRU Unit 26165), operating from Iranian ASN 213790 <h3> 2. Fuel Infrastructure Under Active Exploitation </h3> Iranian actors affiliated with CyberAv3ngers (Shahid Kaveh Group / IRGC-CEC) and Ababil of Minab are actively targeting Automatic Tank Gauge (ATG) systems — specifically Veeder-Root fuel monitoring equipment — at US gas stations. CVE-2026-1340 (CVSS 9.8) was added to the CISA Known Exploited Vulnerabilities catalog on 15 May, and a second independent source (Sunday Guardian, 16 May) corroborated the targeting. This represents a direct threat to fuel distribution continuity. ATG systems control inventory monitoring, leak detection, and safety shutoffs. Manipulation could cause physical safety incidents, supply disruption, or environmental damage. Key actors: CyberAv3ngers/Shahid Kaveh Group (IRGC-CEC), Ababil of Minab Key CVE: CVE-2026-1340 (CVSS 9.8) <h3> 3. Handala/Void Manticore — Destructive Capability Demonstrated, Next Strike Overdue </h3> Handala (also tracked as Void Manticore / BANISHED KITTEN) conducted the conflict's most devastating cyber operation on 11 March — destroying 200,000+ endpoints at Stryker Corporation by weaponizing Microsoft Intune MDM administrator credentials. The group typically claims operations every 3–5 days during active conflict periods. As of 18 May, no new claims have been observed — an absence that may indicate operational preparation for a larger follow-up attack rather than a cessation of activity. Key actors: Handala / Void Manticore / BANISHED KITTEN (IRGC-affiliated) Key technique: MDM weaponization (Microsoft Intune admin credential abuse) <h3> 4. Mobile Surveillance Expansion — PANICPOACH </h3> A suspected Iranian threat group is deploying PANICPOACH , an Android surveillance tool targeting Israeli citizens. The malware masquerades as legitimate applications and captures location data, contacts, screen content, and keystrokes. This is assessed as battle damage assessment (BDA) collection — mobile surveillance of civilian populations provides targeting data that bridges cyber espionage and kinetic strike planning. Key malware: PANICPOACH (Android) Key actors: Suspected IRGC-IO affiliated (APT42 operational pattern) <h3> 5. Linux Privilege Escalation — DirtyDecrypt </h3> A new Linux privilege escalation vulnerability dubbed DirtyDecrypt now has a publicly available exploit (published 18 May). While not yet confirmed in Iranian operations, this is operationally significant because: <ul> <li> Iranian APTs heavily use Linux-based C2 infrastructure </li> <li> Siemens ICS management interfaces run on Linux </li> <li> Post-compromise escalation on Linux servers enables deeper OT network penetration </li> </ul> This compounds the risk created by 8 new CISA ICS advisories for Siemens SIMATIC CN 4100 and Ruggedcom ROX equipment — systems deployed across energy and water sector OT environments. <h3> 6. OAuth Authorization Flow Abuse </h3> Intelligence confirms Iranian-aligned actors are adopting OAuth device-code flow phishing techniques to bypass MFA and establish persistent access to Microsoft 365 / Azure AD environments. This technique exploits legitimate OAuth authorization flows (RFC 6749/RFC 8628) to obtain tokens without triggering traditional credential-theft detections. Key technique: T1550.001 (Application Access Token), OAuth device-code flow abuse Key actor: MuddyWater (MOIS-affiliated) — Microsoft Teams credential theft operations <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability (72h) </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Handala/Void Manticore claims new destructive operation </td> <td> 70% </td> <td> Overdue based on historical 3–5 day cadence; Barakah strike likely triggers retaliatory cyber </td> </tr> <tr> <td> APT42 BELLACIAO/SHELLAFEL produces new IOCs </td> <td> 50% </td> <td> Campaign metadata refreshed 16 May without new indicators — typical pre-operation pattern </td> </tr> <tr> <td> CyberAv3ngers escalates from advisory to demonstrated PLC manipulation </td> <td> 30% </td> <td> Advisory issued Day 69; historical pattern shows 5–10 day gap between advisory and action </td> </tr> <tr> <td> Joint Russia-Iran operation against Gulf state energy infrastructure </td> <td> 25% </td> <td> APT28 infrastructure refresh + Barakah strike creates both capability and motive </td> </tr> <tr> <td> DirtyDecrypt weaponized in Iranian APT operation </td> <td> 20% </td> <td> Public exploit available; adoption timeline typically 7–14 days for sophisticated actors </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> <table> <thead> <tr> <th> ATT&CK Technique </th> <th> Detection Focus </th> <th> Hunting Hypothesis </th> </tr> </thead> <tbody> <tr> <td> T1059 (Command & Scripting Interpreter) </td> <td> Monitor for PowerShell/bash execution from processes communicating with ASN 213790 IPs </td> <td> "If APT28 C2 is on Iranian ASN, compromised hosts will show scripting interpreter spawning after connections to 172.94.9.0/24 or 192.253.248.0/24" </td> </tr> <tr> <td> T1071 (Application Layer Protocol) </td> <td> Alert on HTTPS/DNS traffic to ASN 213790 ("Limited Network", Tehran) </td> <td> "Outbound connections to Iranian ASN from non-expected systems indicate potential C2 beaconing" </td> </tr> <tr> <td> T1571 (Non-Standard Port) </td> <td> Flag outbound connections on unusual ports to known APT28 IPs </td> <td> "GRU infrastructure historically uses non-standard ports to evade default firewall rules" </td> </tr> <tr> <td> T1190 (Exploit Public-Facing Application) </td> <td> Monitor Veeder-Root ATG systems, Ivanti EPMM, Cisco ASA/FTD for exploitation indicators </td> <td> "Iranian actors exploit edge devices within days of advisory publication" </td> </tr> <tr> <td> T1068 (Exploitation for Privilege Escalation) </td> <td> Deploy Linux kernel exploit detection (DirtyDecrypt signatures) on all Linux hosts </td> <td> "Post-compromise LPE on Linux ICS management servers enables lateral movement to OT" </td> </tr> <tr> <td> T1078 (Valid Accounts) </td> <td> Audit Azure AD for anomalous OAuth device-code flow authorizations </td> <td> "Iranian actors use device-code phishing to obtain persistent tokens bypassing MFA" </td> </tr> <tr> <td> T1565.001 (Stored Data Manipulation) </td> <td> Monitor ATG/fuel system data integrity — unexpected inventory readings, sensor value changes </td> <td> "ATG manipulation may present as anomalous fuel level readings before physical impact" </td> </tr> </tbody> </table> <h3> Blocking Guidance </h3> Block the following at perimeter firewalls, proxy, and EDR: <table> <thead> <tr> <th> Type </th> <th> Indicator </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IP </td> <td> 192.253.248[.]52 </td> <td> APT28 C2 on Iranian ASN 213790 (confidence: 90) </td> </tr> <tr> <td> IP </td> <td> 192.253.248[.]55 </td> <td> APT28 C2 on Iranian ASN 213790 (confidence: 90) </td> </tr> <tr> <td> IP </td> <td> 172.94.9[.]170 </td> <td> APT28 scanner/C2 on Iranian ASN 213790 (confidence: 92) </td> </tr> <tr> <td> IP </td> <td> 172.94.9[.]171 </td> <td> APT28 scanner/C2 on Iranian ASN 213790 (confidence: 92) </td> </tr> <tr> <td> IP </td> <td> 185.93.89[.]43 </td> <td> Associated Iranian APT infrastructure (confidence: high) </td> </tr> </tbody> </table> <h3> Investigation Triggers </h3> <ul> <li> Any connection to ASN 213790 from internal hosts → escalate immediately </li> <li> OAuth token grants using device-code flow from unrecognized devices → investigate within 1 hour </li> <li> Siemens SIMATIC/Ruggedcom management interface access from non-admin workstations → treat as potential ICS compromise </li> <li> Microsoft Intune admin credential usage outside change windows → assume Handala TTP until proven otherwise </li> <li> Linux kernel exploitation indicators (unexpected privilege escalation, new root processes) → correlate with DirtyDecrypt signatures </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> <ul> <li> Primary threat: OAuth device-code flow phishing for persistent M365 access; credential theft enabling wire fraud </li> <li> Action: Audit all Azure AD conditional access policies; restrict device-code flow to managed devices only; review OAuth application consent grants for unauthorized third-party apps </li> <li> Monitor: Anomalous token refresh patterns, new OAuth app registrations, Teams-based social engineering attempts (MuddyWater TTP) </li> </ul> <h3> Energy </h3> <ul> <li> Primary threat: ATG/fuel monitoring system exploitation (CVE-2026-1340); Siemens SIMATIC/Ruggedcom vulnerabilities; CyberAv3ngers PLC targeting </li> <li> Action: Immediately patch Siemens SIMATIC CN 4100 and Ruggedcom ROX per CISA advisories; segment all Veeder-Root ATG systems; implement allowlist-only communications for tank gauge protocols; verify no unauthorized Modbus/TCP connections </li> <li> Monitor: Unexpected ATG sensor readings, unauthorized PLC logic changes, outbound connections from OT networks to internet-facing IPs </li> </ul> <h3> Healthcare </h3> <ul> <li> Primary threat: MDM weaponization (Handala/Void Manticore Intune attack pattern); DirtyDecrypt LPE on Linux-based medical device management servers </li> <li> Action: Audit Microsoft Intune admin accounts — enforce hardware token MFA, restrict to named individuals, alert on any policy push outside change windows; patch Linux servers hosting medical device management interfaces </li> <li> Monitor: Mass device policy changes, unexpected Intune compliance policy modifications, Linux privilege escalation on clinical systems </li> </ul> <h3> Government </h3> <ul> <li> Primary threat: APT28/APT42 espionage via shared Russia-Iran infrastructure; mobile surveillance (PANICPOACH) targeting officials; pre-positioning in diplomatic networks </li> <li> Action: Block ASN 213790 at all perimeters; brief personnel on PANICPOACH mobile indicators; enforce mobile device management on all government-issued phones; review Azure AD for dormant service accounts </li> <li> Monitor: Connections to Iranian IP space, new mobile app installations on managed devices, anomalous VPN access patterns from diplomatic posts </li> </ul> <h3> Aviation / Logistics </h3> <ul> <li> Primary threat: Refined Kitten/APT33 pre-positioning in aerospace/DIB networks (currently quiet — assessed as possible dormant implant scenario); supply chain compromise via npm/GitHub </li> <li> Action: Commission threat hunt for dormant APT33 implants — focus on service accounts, GitHub repository access, and T1078 valid account abuse; audit CI/CD pipelines for unauthorized dependency changes; pin GitHub Actions to commit SHAs </li> <li> Monitor: Dormant service account reactivation, unusual repository cloning patterns, supply chain dependency changes in build systems </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🔴 </td> <td> SOC </td> <td> Block APT28 IPs at all perimeter controls: 192.253.248[.]52, 192.253.248[.]55, 172.94.9[.]170, 172.94.9[.]171, 185.93.89[.]43 </td> </tr> <tr> <td> 🔴 </td> <td> IT Ops </td> <td> Audit and patch all Siemens SIMATIC CN 4100 and Ruggedcom ROX devices per CISA advisories ICSA-26-134-10/11/12/16 </td> </tr> <tr> <td> 🔴 </td> <td> SOC </td> <td> Review last 72 hours of logs for any connection to ASN 213790 — treat any hit as confirmed compromise </td> </tr> <tr> <td> 🔴 </td> <td> IT Ops </td> <td> Verify Microsoft Intune admin accounts: enforce hardware MFA, confirm no unauthorized admins added, alert on policy pushes </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟠 </td> <td> SOC </td> <td> Deploy detection rules for DirtyDecrypt LPE exploitation on all Linux servers, prioritizing ICS/SCADA management hosts </td> </tr> <tr> <td> 🟠 </td> <td> Identity/IAM </td> <td> Audit Azure AD OAuth token grants — identify and revoke any device-code flow authorizations from unrecognized devices </td> </tr> <tr> <td> 🟠 </td> <td> IT Ops </td> <td> Verify Ivanti EPMM patch status across all MDM infrastructure; confirm no unauthorized admin sessions </td> </tr> <tr> <td> 🟠 </td> <td> SOC </td> <td> Implement ASN 213790 monitoring rule — any new IOC with country:IR + actor:APT28/APT27/Turla auto-escalates </td> </tr> <tr> <td> 🟠 </td> <td> OT Security </td> <td> Validate ATG/fuel system network segmentation; confirm Veeder-Root devices cannot reach internet directly </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟡 </td> <td> CISO </td> <td> Commission targeted threat hunt for Refined Kitten/APT33 dormant implants in aerospace and DIB contractor networks </td> </tr> <tr> <td> 🟡 </td> <td> OT Security </td> <td> Implement allowlist-only communications for all tank gauge protocols; deploy OT-specific IDS on fuel distribution networks </td> </tr> <tr> <td> 🟡 </td> <td> CISO </td> <td> Conduct tabletop exercise simulating Handala-style MDM weaponization attack — test IR playbook for mass endpoint destruction </td> </tr> <tr> <td> 🟡 </td> <td> Legal/Executive </td> <td> Review cyber insurance coverage against state-sponsored destructive attacks; assess whether ceasefire exclusion of cyber affects policy terms </td> </tr> <tr> <td> 🟡 </td> <td> IT Ops </td> <td> Add DIB-specific threat feed (DC3/DCISE indicators) to address persistent intelligence gap in aerospace targeting </td> </tr> </tbody> </table> <h3> Executive / IR Preparedness </h3> <ul> <li> Board briefing: The ceasefire framework's explicit exclusion of cyber operations means your organization remains a legitimate target regardless of diplomatic progress. Budget and posture accordingly. </li> <li> IR retainer activation: Ensure your incident response retainer is current and the provider has been briefed on Iranian destructive attack patterns (MDM weaponization, wiper deployment, ICS manipulation). </li> <li> Communication plan: Pre-draft stakeholder communications for a Handala-style destructive event (200,000+ endpoint loss scenario). Response time matters — Stryker had hours, not days. </li> <li> Cyber insurance: Confirm your policy covers state-sponsored attacks. Some policies exclude "acts of war" — the Iran conflict creates ambiguity that insurers may exploit. </li> </ul> <h2> Bottom Line </h2> The Iran conflict's cyber dimension has now been active for 79 days with no indication of abatement. The diplomatic track explicitly excludes cyber operations, creating a strategic vulnerability that Iranian and Russian actors are actively exploiting. Infrastructure cooperation between Moscow and Tehran is structural — it will persist regardless of ceasefire outcomes. The convergence of confirmed fuel infrastructure exploitation, publicly available Linux privilege escalation exploits, fresh Russian-Iranian shared infrastructure, and 8 new ICS vulnerabilities creates a compounding risk environment. Each element individually is manageable. Together, they represent an attack surface expanding faster than most organizations can defend. The absence of new Handala destructive claims is not reassurance — it is a warning. Historical cadence suggests the next operation is overdue. The 72-hour window following the Barakah drone strike is the highest-risk period for retaliatory cyber operations. Act now. Patch the Siemens systems. Block the infrastructure. Hunt for dormant implants. Brief your board. The ceasefire that ignores cyber is not a ceasefire — it is a permission slip. Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream and partner feeds. Anomali CTI Desk | 2026-05-18 | For questions or additional context, contact your Anomali intelligence analyst.

FEATURED RESOURCES

May 19, 2026

Anomali Cyber Watch

Iran's Cyber Offensive Hits U.S. Fuel Infrastructure: What CISOs Must Know Now

May 18, 2026

Anomali Cyber Watch