Iran Conflict Day 71: Ceasefire Deadline Converges with Silent APTs and Active Exploitation — What CISOs Must Do Now

Anomali Threat Research

Published on

May 9, 2026

Table of Contents

Threat Assessment Level: HIGH Elevated from ELEVATED on 8 May 2026. The convergence of today's ceasefire response deadline, confirmed Iranian hacktivist operations against US military targets, active PLC exploitation of critical infrastructure, and the simultaneous silence of three major Iranian APT groups creates a maximum-risk window for retaliatory cyber operations. <h2> Introduction </h2> Seventy-one days into the US-Israel-Iran kinetic conflict, the cyber dimension has become inseparable from the physical battlefield. Today — 9 May 2026 — Iran is expected to respond to a US ceasefire proposal. History tells us that diplomatic deadlines don't reduce Iranian cyber tempo; they accelerate it. Three of Iran's most capable cyber actors have gone simultaneously silent. Russia is feeding Iran satellite imagery of allied military installations. A critical Ivanti vulnerability is being actively exploited. And IRGC-affiliated hacktivists just claimed a breach of US Marines email and the destruction of 200,000+ endpoints at a major medical technology firm. This is not a drill. This is the threat landscape your SOC wakes up to this morning. <h2> What Changed (Last 48 Hours) </h2> <table> <thead> <tr> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-6973 (Ivanti EPMM RCE) added to CISA KEV catalog — active exploitation confirmed </td> <td> Pioneer Kitten (UNC757) historically exploits Ivanti products within 72 hours of KEV listing </td> </tr> <tr> <td> Handala/BANISHED KITTEN claims US Marines email breach; actor previously responsible for Stryker device wipe (11 Mar 2026) </td> <td> Most destructive hacktivist actor in the conflict; validated by multiple independent sources </td> </tr> <tr> <td> Russia confirmed providing satellite imagery of US/allied military facilities to Iran </td> <td> Strategic capability upgrade — Iranian targeting precision has materially improved </td> </tr> <tr> <td> CISA AA26-097A confirms Iranian APT exploitation of PLCs in water, energy, and ICS sectors </td> <td> Active, ongoing campaign by IRGC Cyber-Electronic Command (Intelligence Group 13) </td> </tr> <tr> <td> Braintrust AI platform breach — AWS account compromised, AI provider API keys exposed </td> <td> Validates AI supply chain as an active attack surface; credential theft enables impersonation </td> </tr> <tr> <td> MuddyWater, Cyber Av3ngers, and UNC1860 all silent </td> <td> Three major Iranian actors quiet simultaneously during active conflict = pre-positioning indicator </td> </tr> </tbody> </table> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor / Attribution </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> 28 Feb 2026 </td> <td> Kinetic conflict begins — US/Israel strikes on Iran </td> <td> — </td> <td> Conflict Day 1 </td> </tr> <tr> <td> 11 Mar 2026 </td> <td> Stryker wiper attack — 200,000+ endpoints destroyed </td> <td> Handala / BANISHED KITTEN (IRGC) </td> <td> Most destructive cyberattack of the conflict </td> </tr> <tr> <td> 7 Apr 2026 </td> <td> CISA AA26-097A — Iranian APT exploiting PLCs across US critical infrastructure </td> <td> IRGC-CEC / Cyber Av3ngers / Intelligence Group 13 </td> <td> Water treatment, electrical grids, ICS targeted </td> </tr> <tr> <td> 7–8 Apr 2026 </td> <td> Russia providing Iran satellite imagery of allied military bases + cyber support </td> <td> Russian GRU / Iranian MOIS </td> <td> Force-multiplier for Iranian kinetic and cyber targeting </td> </tr> <tr> <td> 30 Apr 2026 </td> <td> Last known Cyber Av3ngers activity </td> <td> HYDRO KITTEN (IRGC-CEC) </td> <td> 9-day silence during active conflict is anomalous </td> </tr> <tr> <td> 4 May 2026 </td> <td> Braintrust AI observability platform breach discovered </td> <td> Unattributed </td> <td> AI supply chain credential theft confirmed </td> </tr> <tr> <td> 7 May 2026 </td> <td> CVE-2026-6973 added to CISA KEV — Ivanti EPMM RCE actively exploited </td> <td> Unattributed (Pioneer Kitten exploitation likely) </td> <td> MDM infrastructure at risk across enterprises </td> </tr> <tr> <td> 7 May 2026 </td> <td> APT34/OilRig proxy cluster reactivated </td> <td> APT34 (MOIS) </td> <td> Espionage infrastructure re-engaged </td> </tr> <tr> <td> 8 May 2026 </td> <td> MuddyWater Teams phishing campaign with novel malware </td> <td> STATIC KITTEN / Mango Sandstorm (MOIS) </td> <td> Bypasses email security entirely via Teams </td> </tr> <tr> <td> 8 May 2026 </td> <td> Handala claims US Marines data breach </td> <td> BANISHED KITTEN (IRGC) </td> <td> Military personnel data compromised </td> </tr> <tr> <td> 9 May 2026 </td> <td> Ceasefire response deadline — Iran expected to respond to US proposal </td> <td> — </td> <td> Maximum-risk window for cyber escalation </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. The "Triple Quiet" — Pre-Positioning Before the Storm </h3> Three of Iran's most dangerous cyber actors are simultaneously silent: <ul> <li> MuddyWater / STATIC KITTEN (MOIS) — last confirmed campaign 8 May; no new IOCs surfaced today </li> <li> Cyber Av3ngers / HYDRO KITTEN (IRGC-CEC) — no claims since 30 April; 9-day gap during active conflict </li> <li> UNC1860 (MOIS access broker) — provides initial access to other Iranian groups; silence may indicate handoff completed </li> </ul> When multiple tracked actors go dark simultaneously during an active conflict, the intelligence community treats this as a pre-positioning indicator — capabilities are being held in reserve for a specific trigger event. That trigger may be today's ceasefire deadline. <h3> 2. CVE-2026-6973: Ivanti EPMM Under Active Exploitation </h3> CVE-2026-6973 is an improper input validation flaw in Ivanti Endpoint Manager Mobile (EPMM) that allows authenticated admin-level remote code execution (CVSS 7.2). CISA added it to the Known Exploited Vulnerabilities catalog on 7 May, confirming active exploitation in the wild. Why this matters for the Iran conflict: Pioneer Kitten (UNC757/Fox Kitten) — an IRGC-affiliated group — has a documented history of exploiting Ivanti products (including CVE-2024-21887 and related vulnerabilities) as initial access vectors. Their pattern is exploitation within 72 hours of public disclosure. The clock is ticking. Affected versions: Ivanti EPMM prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. <h3> 3. Russia-Iran Intelligence Axis: A Strategic Capability Upgrade </h3> Five independent sources (Ukrainian intelligence, Reuters, The Independent, Al Arabiya, Algemeiner) confirm Russia is providing Iran with: <ul> <li> Detailed satellite imagery of US and allied military facilities across the Middle East </li> <li> Cyber intelligence support to improve Iranian strike targeting </li> </ul> This is not merely diplomatic alignment — it represents an operational fusion that complicates attribution and enhances Iranian precision. Russian GRU (APT28/Fancy Bear) C2 infrastructure has been confirmed on Iranian ASNs, meaning Russian and Iranian cyber operations now share infrastructure. When your SOC detects an intrusion, the question is no longer "is this Russia or Iran?" — it may be both. <h3> 4. IRGC PLC Exploitation: Critical Infrastructure Under Active Attack </h3> CISA Advisory AA26-097A confirms that IRGC-affiliated actors (Intelligence Group 13 / Cyber Av3ngers) are actively exploiting internet-facing Programmable Logic Controllers (PLCs) across multiple US sectors. Targets include: <ul> <li> Water treatment facilities </li> <li> Electrical grid infrastructure </li> <li> Industrial control systems </li> </ul> The IOCONTROL malware family remains the primary tool. The US State Department has a $10 million bounty on CyberAv3ngers operators — a measure of how seriously the government takes this threat. <h3> 5. Handala: The Conflict's Most Destructive Cyber Actor </h3> Handala (also tracked as BANISHED KITTEN, Cotton Sandstorm, UNC5203, HomeLandJustice) has emerged as the most operationally impactful cyber actor in this conflict. Their confirmed operations include: <ul> <li> Stryker wiper attack (11 March 2026): 200,000+ endpoints destroyed </li> <li> US Marines email breach (claimed 8 May 2026): military personnel data compromised </li> <li> Coordinated IO/leak operations via Telegram with Cyber Toufan </li> </ul> Handala is an IRGC-affiliated actor. Cross-organizational coordination with MOIS-affiliated access brokers such as UNC1860 is assessed with moderate confidence — UNC1860 may provide initial access that IRGC-affiliated groups subsequently leverage for destructive operations. <h3> 6. AI Supply Chain: The Emerging Vector </h3> The Braintrust breach (discovered 4 May 2026) demonstrates that AI platform credentials are actively targeted. Attackers gained unauthorized access to an AWS account containing org-level AI provider API keys, potentially enabling them to abuse AI services while appearing as legitimate users. While not yet attributed to Iranian actors, this validates a concerning attack surface. Iranian APTs with access to stolen AI platform credentials could leverage them for automated reconnaissance, social engineering content generation, or credential abuse — all while appearing as legitimate enterprise users. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Trigger </th> </tr> </thead> <tbody> <tr> <td> Iranian cyber escalation (wiper or DDoS against allied infrastructure) if negotiations fail </td> <td> 70% </td> <td> 24–72 hours </td> <td> Ceasefire rejection or collapse </td> </tr> <tr> <td> Pre-positioning activity regardless of negotiation outcome </td> <td> 40% </td> <td> Ongoing </td> <td> Standard Iranian operational pattern </td> </tr> <tr> <td> Pioneer Kitten exploitation of CVE-2026-6973 against enterprise MDM </td> <td> 65% </td> <td> Within 72 hours </td> <td> KEV listing + historical pattern </td> </tr> <tr> <td> Hacktivist surge (Handala, Cyber Toufan) for IO leverage during diplomatic window </td> <td> 60% </td> <td> 24–48 hours </td> <td> Diplomatic deadline pressure </td> </tr> <tr> <td> Wiper deployment against new targets (following UNC1860 access handoff) </td> <td> 45% </td> <td> 7–14 days </td> <td> Access establishment → destruction cycle </td> </tr> <tr> <td> ICS/OT destructive attack on US water or energy infrastructure </td> <td> 30% </td> <td> 30 days </td> <td> Escalation ladder if kinetic conflict intensifies </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Priority Monitoring (Next 48 Hours) </h3> Hypothesis 1: Pioneer Kitten exploiting CVE-2026-6973 for initial access <ul> <li> Monitor: All Ivanti EPMM admin authentication logs; anomalous admin account creation; command execution via EPMM API </li> <li> ATT&CK: T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter), T1078.004 (Valid Accounts: Cloud Accounts) </li> <li> Hunt: Search for authentication from VPN exit nodes (NordVPN, ExpressVPN — Pioneer Kitten tradecraft); unexpected EPMM configuration changes; webshell deployment on EPMM servers </li> <li> Block: Ensure Ivanti EPMM is patched to 12.6.1.1 / 12.7.0.1 / 12.8.0.1 minimum </li> </ul> Hypothesis 2: MuddyWater Teams-based phishing delivering novel malware <ul> <li> Monitor: Microsoft Teams external message delivery; .exe or .dll file transfers via Teams; PowerShell execution spawned from Teams process </li> <li> ATT&CK: T1566.003 (Phishing via Service), T1059.001 (PowerShell), T1071.001 (Web Protocols for C2) </li> <li> Hunt: Search for Trojan.Win64.MuddyWater.z signatures; Teams messages from external tenants containing file attachments; anomalous OAuth token grants following Teams interactions </li> <li> Detect: Alert on any process spawned as child of Teams.exe that executes encoded PowerShell or downloads secondary payloads </li> </ul> Hypothesis 3: IRGC PLC exploitation via internet-exposed OT <ul> <li> Monitor: All internet-facing PLC/SCADA/HMI interfaces; Modbus/TCP and DNP3 traffic anomalies; IOCONTROL C2 beaconing patterns </li> <li> ATT&CK: T1190 (Exploit Public-Facing Application), T1071 (Application Layer Protocol), T1499 (Endpoint Denial of Service) </li> <li> Hunt: Scan for internet-exposed PLCs (Unitronics Vision/Samba series — Cyber Av3ngers favorites); search for default credentials on HMI panels; monitor for unauthorized logic changes </li> <li> Block: Immediately isolate any internet-facing PLC that cannot be patched; implement network segmentation between IT and OT </li> </ul> Hypothesis 4: Wiper pre-positioning via valid credentials (Handala/BANISHED KITTEN pattern) <ul> <li> Monitor: Mass file deletion events; MBR/VBR modification attempts; deployment of unknown executables to >100 endpoints simultaneously </li> <li> ATT&CK: T1485 (Data Destruction), T1561.002 (Disk Structure Wipe), T1078.001 (Default Accounts) </li> <li> Hunt: Search for lateral movement using default or service accounts; look for staging of executables in C:\Windows\Temp or %APPDATA% across multiple hosts; monitor for Group Policy-based deployment of unknown binaries </li> <li> Detect: Alert on any process that writes to MBR/VBR; alert on bulk file rename/encryption patterns </li> </ul> Hypothesis 5: AI credential theft and abuse <ul> <li> Monitor: AI platform API usage anomalies (token volume spikes, geographic anomalies); OAuth token grants to unfamiliar applications; AWS CloudTrail for unauthorized access to secrets/keys </li> <li> ATT&CK: T1528 (Steal Application Access Token), T1550.001 (Application Access Token), T1530 (Data from Cloud Storage) </li> <li> Hunt: Audit all third-party AI observability platforms for stored credentials; review API key rotation history; check for new OAuth app registrations </li> </ul> <h3> Detection Rules to Validate </h3> <table> <thead> <tr> <th> Rule </th> <th> ATT&CK ID </th> <th> Priority </th> </tr> </thead> <tbody> <tr> <td> Ivanti EPMM admin RCE attempt (CVE-2026-6973 pattern) </td> <td> T1190 </td> <td> CRITICAL </td> </tr> <tr> <td> Teams external file delivery → child process execution </td> <td> T1566.003 </td> <td> HIGH </td> </tr> <tr> <td> PLC logic change from unauthorized source IP </td> <td> T1190 , T1499 </td> <td> CRITICAL </td> </tr> <tr> <td> Mass file deletion (>1000 files in <60 seconds) </td> <td> T1485 </td> <td> CRITICAL </td> </tr> <tr> <td> OAuth token grant to unrecognized AI platform </td> <td> T1528 </td> <td> HIGH </td> </tr> <tr> <td> VPN authentication from known Pioneer Kitten infrastructure </td> <td> T1078.004 </td> <td> HIGH </td> </tr> <tr> <td> PowerShell download cradle spawned from collaboration tool </td> <td> T1059.001 </td> <td> HIGH </td> </tr> </tbody> </table> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> Primary threat: Iranian actors targeting SWIFT-connected systems and payment infrastructure for disruptive (not theft) purposes during conflict escalation. Handala's wiper capability could target financial platforms for maximum economic disruption. Actions: <ul> <li> Validate offline backup integrity for core banking systems — test restoration within 4-hour RTO </li> <li> Review all Ivanti EPMM deployments managing mobile banking apps; patch CVE-2026-6973 immediately </li> <li> Enable enhanced monitoring on SWIFT Alliance Lite2 interfaces for unauthorized message injection </li> <li> Brief fraud teams on potential for Iranian IO campaigns using leaked financial data </li> </ul> <h3> Energy </h3> Primary threat: IRGC Cyber Av3ngers / Intelligence Group 13 actively exploiting PLCs in electrical grid and pipeline SCADA systems. CISA AA26-097A confirms this is ongoing, not theoretical. Actions: <ul> <li> Conduct emergency audit of all internet-facing OT/ICS devices — remove any that cannot be immediately patched or segmented </li> <li> Validate IOCONTROL detection signatures are deployed on OT network monitoring tools </li> <li> Implement emergency manual override procedures for critical PLCs in case of logic manipulation </li> <li> Coordinate with CISA and sector ISAC for latest Cyber Av3ngers indicators </li> <li> Ensure Unitronics Vision/Samba PLCs have non-default credentials and are not internet-accessible </li> </ul> <h3> Healthcare </h3> Primary threat: Handala's Stryker attack (200,000+ endpoints wiped) demonstrates willingness to target healthcare. Medical device management platforms (including Ivanti EPMM for clinical mobility) are high-value targets. Actions: <ul> <li> Patch Ivanti EPMM immediately — clinical mobility devices are patient-safety-critical </li> <li> Review and test disaster recovery plans for EHR systems; validate <4-hour RTO for critical clinical systems </li> <li> Segment biomedical device networks from general IT; monitor for lateral movement from IT to clinical VLANs </li> <li> Brief clinical leadership on potential for device wiper attacks — establish manual clinical workflow fallbacks </li> </ul> <h3> Government / Defense </h3> Primary threat: Multi-vector: Handala targeting US military personnel email; Russia providing satellite imagery of allied facilities; Pioneer Kitten exploiting identity infrastructure; MuddyWater phishing via Teams. Actions: <ul> <li> Audit all Microsoft Teams external access policies — restrict external tenant communication to approved partners only </li> <li> Hunt for Pioneer Kitten indicators on VPN concentrators and identity platforms (Ivanti, Citrix, F5) </li> <li> Review personnel security awareness regarding Handala IO campaigns — leaked military email may be used for spear-phishing </li> <li> Validate that classified networks have no connectivity to systems running vulnerable Ivanti EPMM versions </li> <li> Brief counterintelligence on Russia-Iran satellite imagery sharing — physical security of forward bases may be compromised </li> </ul> <h3> Aviation / Logistics </h3> Primary threat: Strait of Hormuz kinetic operations create direct risk to maritime/aviation logistics. Iranian actors may target port management systems, ADS-B/flight tracking, or shipping logistics platforms to disrupt supply chains. Actions: <ul> <li> Review all OT systems in port management and air traffic control for internet exposure </li> <li> Validate GPS/ADS-B spoofing detection capabilities — Iranian actors have demonstrated this capability in the Persian Gulf </li> <li> Ensure shipping manifest and logistics platforms have MFA and are not running vulnerable Ivanti instances </li> <li> Coordinate with TSA and maritime sector ISACs for latest threat indicators </li> <li> Test business continuity plans for Strait of Hormuz closure scenario — cyber disruption to logistics platforms would compound kinetic supply chain impacts </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Next 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> IT Ops / SOC </td> <td> Patch Ivanti EPMM to 12.6.1.1 / 12.7.0.1 / 12.8.0.1 — CVE-2026-6973 is actively exploited and Pioneer Kitten exploitation is likely within 72 hours </td> </tr> <tr> <td> CRITICAL </td> <td> OT Security </td> <td> Verify no PLCs are internet-accessible — CISA confirms active IRGC exploitation; isolate or segment any that cannot be immediately remediated </td> </tr> <tr> <td> CRITICAL </td> <td> SOC </td> <td> Elevate ICS/OT monitoring to maximum tempo for 48 hours — ceasefire deadline creates peak risk window for retaliatory operations </td> </tr> <tr> <td> HIGH </td> <td> SOC </td> <td> Block Microsoft Teams file delivery from external tenants or implement approval workflow — MuddyWater is actively using this vector </td> </tr> <tr> <td> HIGH </td> <td> SOC </td> <td> Deploy wiper detection rules — alert on MBR writes, mass file deletion (>1000 files/60s), and Group Policy deployment of unknown executables </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> HIGH </td> <td> SOC </td> <td> Execute threat hunt for Pioneer Kitten (UNC757) — search for NordVPN-sourced authentication, dormant SSH keys, fake-resume GitHub repositories, and webshells on Ivanti/Citrix/F5 appliances </td> </tr> <tr> <td> HIGH </td> <td> IT Ops </td> <td> Rotate all AI platform API keys stored in third-party observability tools (Braintrust-type platforms); audit for suspicious usage spikes </td> </tr> <tr> <td> HIGH </td> <td> IT Ops </td> <td> Audit Microsoft Teams external access policies — restrict to allowlisted tenants; enable logging for all external message delivery </td> </tr> <tr> <td> MEDIUM </td> <td> SOC </td> <td> Validate detection coverage for all ATT&CK techniques listed in this bulletin ( T1190 , T1485 , T1566.003 , T1528 , T1078.004 , T1059.001 ) </td> </tr> <tr> <td> MEDIUM </td> <td> IR Team </td> <td> Update incident response playbooks for wiper scenarios — ensure offline backups are tested and restoration procedures are documented </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> HIGH </td> <td> CISO </td> <td> Brief executive leadership and board on Russia-Iran intelligence sharing escalation — satellite imagery of allied facilities combined with cyber support represents a strategic capability upgrade that changes the threat calculus </td> </tr> <tr> <td> HIGH </td> <td> CISO </td> <td> Join or increase engagement with sector ISAC (Defense Industrial Base ISAC, Energy ISAC, Health-ISAC) — closed-source feeds are needed to address persistent DIB targeting gaps </td> </tr> <tr> <td> MEDIUM </td> <td> IR Team </td> <td> Conduct tabletop exercise simulating simultaneous wiper + ICS attack during ceasefire collapse — test cross-functional coordination between IT, OT, legal, and communications </td> </tr> <tr> <td> MEDIUM </td> <td> Security Architecture </td> <td> Implement network segmentation review between IT and OT environments — validate that compromise of IT identity infrastructure cannot enable lateral movement to OT </td> </tr> <tr> <td> MEDIUM </td> <td> CISO </td> <td> Establish diplomatic event calendar as a security input — formalize the correlation between geopolitical deadlines and cyber threat tempo into your threat model </td> </tr> </tbody> </table> <h2> Indicators of Compromise </h2> The following IOCs are derived from intelligence collection for this reporting period. Implement blocking and alerting as appropriate. <h3> Network Indicators </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> whatsappcenter[.]com </td> <td> Suspicious domain — Iranian APT infrastructure (historical) </td> </tr> <tr> <td> Domain </td> <td> birdful[.]org </td> <td> Suspicious domain — associated with threat activity </td> </tr> </tbody> </table> <h3> File Indicators </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> SHA-256 </td> <td> 03aac2e8b0f61b7289bd373977faf3d37d4c6ba8a3a4ccc530253504b6ee8f91 </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> 3b7744425c9d633e000dfdd459937ec6342891a9ceab3e1b834e6a655e49e059 </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> 5f410e845feb0a91e4b8e3ab535db67bc0aa58cb221f90822ecdb3f539c36b3a </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> 704a22aeca618ccfe2172ece33ecdf17731aebd9f1929a05f3b90338b3e5e16c </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> 36be4f8b88b82cc053e64b3e5968cfaf7bf4cb9aa25064ebf8b8df6d805b2b8e </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> 756be92c1e1d5a1a03fbbb2137e0c569e3d0b56cc07b76c543973a783e6d7306 </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> 26b89d0b4c49eca5c590dd9974872787c6c65c2fe7b8ebafe974a8a7c1b46ca1 </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> 35af2cf5494181920b8624c7b719d39590e2a5ff5eaa1a2fa1ba86b2b5aa9b43 </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> bc090d75f51c293d916c40d4b21094faaec191a42d97448c92d264875bf1f17b </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> 197f11a7b0003aa7da58a3302cfa2a96a670de91d39ddebc7a51ac1d9404a7e6 </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> f34f550147c2792c1ff2a003d15be89e5573f0896c5aa6126068baa4621ef416 </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> bc83817c6d2bf8df1d58eac946a12b5e2566b2ffe15cf96f37c711c4b755512b </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> 61e9d76f07334843df561fe4bac449fb6fdaed5e5eb91480bded225f3d265c5f </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> ee6330870087f66a237a7f7c115b65beb042299f12eae1e9004e016686d0c387 </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> 91a15554ec9e49c00c5ca301f276bd79d346968651d54204743a08a3ca8a5067 </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> a49155df50963d2412534090bbd967749268bd013881ddb81d78b87f91cdc15b </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-256 </td> <td> 7f80add94ee8107a79c87a9b4ccbd33e39eccd1596748a5b88629dd6ac11b86d </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> SHA-1 </td> <td> b67b8e3edaca2d48b6dd0073229a0de965e76556 </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> MD5 </td> <td> 5fcdc5eaf14b2d016c2575bbdab47c39 </td> <td> Associated with Iranian APT campaign </td> </tr> <tr> <td> MD5 </td> <td> cc7b6a1b0ffd545673720a90d18a0270 </td> <td> Associated with Iranian APT campaign </td> </tr> </tbody> </table> Additional IOCs and enriched context available via Anomali ThreatStream Next-Gen and partner feeds. <h2> Bottom Line </h2> Day 71 of this conflict presents a threat environment defined by convergence: a diplomatic deadline, confirmed destructive operations against US military and healthcare targets, active exploitation of critical vulnerabilities, and the ominous silence of Iran's most capable cyber units. Each of these factors alone would warrant elevated posture. Together, they represent the highest-probability window for retaliatory Iranian cyber operations since the conflict began on 28 February 2026. Iranian cyber actors do not de-escalate during negotiations. They pre-position. The 48-hour window around today's ceasefire deadline demands action — not tomorrow, but now. Patch Ivanti. Isolate your PLCs. Hunt for Pioneer Kitten. Restrict Teams external access. Test your wiper response playbook. Brief your leadership. The silence before the storm is not peace — it is preparation. Anomali CTI Desk | 9 May 2026 | Intelligence cutoff: 9 May 2026 0600 UTC

FEATURED RESOURCES

May 15, 2026

Anomali Cyber Watch

The Loudest Signal in Iranian Cyber Operations Is Silence — And That Should Worry You

May 14, 2026

Anomali Cyber Watch

Iranian Cyber Operations at Week 11: Active PLC Exploitation, Destructive Wiper Attacks, and the Silent Threat of Dormant Access

May 13, 2026

Anomali Cyber Watch

The 10-Week Silence Before the Storm: Iran's Cyber Retaliation Gap Demands Immediate Action

Explore All