Iranian Cyber Operations at Week 11: Active PLC Exploitation, Destructive Wiper Attacks, and the Silent Threat of Dormant Access

Anomali Threat Research

Published on

May 14, 2026

Table of Contents

Threat Assessment Level: HIGH The Iran-U.S. military conflict that began on 28 February 2026 has now entered its 75th day with no ceasefire in sight — and Iranian cyber operations are running at sustained wartime tempo. In April 2026, U.S. intelligence agencies issued urgent public warnings confirming what defenders have been tracking for weeks: Iranian state actors are actively exploiting Internet-exposed programmable logic controllers (PLCs) and disrupting U.S. critical infrastructure. Meanwhile, the largest Iranian destructive cyber operation on record — a wiper attack that destroyed over 200,000 endpoints at medical device manufacturer Stryker — has been formally attributed to IRGC-affiliated operators. And a freshly KEV-listed Ivanti vulnerability is being exploited by IRGC-affiliated actors to establish persistent access in enterprise environments. This is not a theoretical threat. This is active warfare in cyberspace, and every critical infrastructure operator needs to understand what's happening and what to do about it. <h2> What Changed </h2> The past week has surfaced six significant developments that collectively paint a picture of sustained, multi-vector Iranian cyber aggression: <ul> <li> U.S. government publicly confirms active Iranian PLC exploitation across multiple critical infrastructure sectors (April 2026 reporting, corroborated by CISA, FBI, and multiple OSINT sources) </li> </ul> <ul> <li> CVE-2026-6973 (Ivanti EPMM) added to CISA's Known Exploited Vulnerabilities catalog on 7 May — confirmed in-the-wild exploitation linked to Pioneer Kitten (IRGC-affiliated) </li> </ul> <ul> <li> DOJ unseals full operational details of the Handala/BANISHED KITTEN attack on Stryker — revealing Microsoft Intune was weaponized as the wipe vector, requiring no malware deployment </li> </ul> <ul> <li> Three critical CISA ICS advisories published for ABB AC500 V3 PLCs (ICSA-26-132-03/05/06) — widely deployed in energy, manufacturing, and water treatment </li> </ul> <ul> <li> Iran-DPRK infrastructure convergence detected on 9 May — first IOC-level evidence of MuddyWater (MOIS) and North Korean Silent Chollima infrastructure sharing, complicating attribution across both threat actors </li> </ul> <ul> <li> Fresh Iranian proxy infrastructure identified on Tehran-based ASNs — active SSH brute-force and SOCKS4 anonymization nodes </li> </ul> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 28 Feb 2026 </td> <td> Iran-U.S. military conflict begins </td> <td> Kinetic operations trigger cyber retaliation cycle </td> </tr> <tr> <td> 11 Mar 2026 </td> <td> Handala/BANISHED KITTEN deploys Stryker wiper </td> <td> 200,000+ endpoints destroyed via Microsoft Intune abuse — largest Iranian destructive cyber operation on record </td> </tr> <tr> <td> 19 Mar 2026 </td> <td> DOJ seizes four IRGC-affiliated domains </td> <td> Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, Handala-Redwanted[.]to taken down </td> </tr> <tr> <td> 7–8 Apr 2026 </td> <td> Russia-Iran satellite and cyber intelligence sharing confirmed </td> <td> Fundamentally expands cooperative threat model </td> </tr> <tr> <td> 8 Apr 2026 </td> <td> CISA issues urgent warnings on Iranian CI exploitation </td> <td> Public confirmation of active PLC disruption across U.S. infrastructure </td> </tr> <tr> <td> 7 May 2026 </td> <td> CVE-2026-6973 added to CISA KEV </td> <td> Pioneer Kitten (UNC757) confirmed exploiting Ivanti EPMM </td> </tr> <tr> <td> 9 May 2026 </td> <td> MuddyWater-Silent Chollima IOC convergence detected </td> <td> First IOC-level evidence of Iran-DPRK infrastructure sharing </td> </tr> <tr> <td> 12 May 2026 </td> <td> CISA publishes triple ABB AC500 V3 advisories </td> <td> New ICS attack surface in sectors targeted by Iranian proxies </td> </tr> <tr> <td> 14 May 2026 </td> <td> 20 Iranian actor profiles refreshed in threat intelligence platforms </td> <td> Indicates active tracking of ongoing Iranian operations </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Active PLC Exploitation — The Quiet Disruption Campaign </h3> Multiple U.S. government agencies have confirmed that Iranian actors are conducting exploitation activity against Internet-exposed PLCs, resulting in disruptions across several critical infrastructure sectors. This campaign is notable for what it lacks : public claims of responsibility. Named Actors: Cyber Av3ngers (IRGC-CEC), HYDRO KITTEN (IRGC-CEC), Ababil of Minab Relevant Malware: ZionSiphon (OT malware targeting water systems), IOCONTROL (PLC manipulation framework) Key Techniques: <ul> <li> T1190 — Exploit Public-Facing Application </li> <li> T1078 — Valid Accounts (default PLC credentials) </li> <li> T0816 — Device Restart/Shutdown (ICS) </li> <li> T0826 — Loss of Availability (ICS) </li> </ul> The bifurcation is critical to understand: Iranian proxy groups are simultaneously running loud information operations (doxxing, death threats, leak sites) and quiet infrastructure disruption (PLC exploitation without attribution claims). The quiet track is far more dangerous. <h3> 2. The Stryker/Intune Paradigm Shift — Destruction Without Malware </h3> The DOJ's unsealed details on the Handala attack against Stryker reveal a paradigm-shifting attack vector: Microsoft Intune was weaponized as the destructive payload . No malware was deployed. Legitimate mobile device management (MDM) administrative functions — device wipe, retire, and reset — were used to destroy 200,000+ endpoints simultaneously. Actor: UNC5203 / Cotton Sandstorm / Haywire Kitten / BANISHED KITTEN (IRGC-affiliated) Key Techniques: <ul> <li> T1531 — Account Access Removal </li> <li> T1485 — Data Destruction </li> <li> T1078.004 — Cloud Accounts (legitimate Intune admin access) </li> <li> T1072 — Software Deployment Tools (Intune as wipe vector) </li> </ul> This attack bypasses every traditional malware detection capability. EDR, antivirus, sandboxing — none of it matters when the attacker uses your own management tools against you. The only defense is behavioral analytics on bulk administrative actions and strict access controls on MDM platforms. <h3> 3. CVE-2026-6973 — Pioneer Kitten's Edge Access Play </h3> CVE-2026-6973 affects Ivanti Endpoint Manager Mobile (EPMM) — an improper input validation flaw (CVSS 7.2) allowing authenticated administrators to achieve remote code execution. Its addition to CISA's KEV catalog on 7 May confirms active exploitation in the wild. Actor: Pioneer Kitten / Fox Kitten / UNC757 (IRGC-affiliated) Pioneer Kitten has a well-documented pattern of exploiting edge infrastructure (Fortinet, Citrix, Ivanti, Pulse Secure) to establish initial access, then selling or leveraging that access for follow-on operations. Their profile was refreshed on 14 May 2026, indicating active tracking of ongoing operations. Key Techniques: <ul> <li> T1190 — Exploit Public-Facing Application </li> <li> T1059 — Command and Scripting Interpreter (post-exploitation) </li> <li> T1078 — Valid Accounts (credential theft precursor) </li> </ul> <h3> 4. Iran-DPRK Infrastructure Convergence </h3> On 9 May 2026, IOCs associated with MuddyWater (MOIS) were found dual-tagged with North Korean Silent Chollima infrastructure — the first IOC-level evidence of Iran-DPRK cyber cooperation. This convergence means that indicators previously attributed to a single nation-state may now serve multiple adversaries, complicating attribution and expanding the threat surface. <h3> 5. The ABB AC500 Attack Surface Expansion </h3> Three CISA ICS advisories (ICSA-26-132-03/05/06) published on 12 May 2026 disclose critical vulnerabilities in ABB AC500 V3 PLCs — including stack buffer overflows and SNMP card vulnerabilities. ABB AC500 controllers are widely deployed in energy generation, water treatment, and manufacturing — precisely the sectors under active Iranian targeting. <h2> Predictive Analysis </h2> Based on current intelligence, operational patterns, and the sustained wartime tempo with no de-escalation signals: <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Iranian PLC exploitation continues at current tempo without public claims </td> <td> 70% </td> <td> Next 7 days </td> <td> Established pattern of quiet disruption; no incentive to claim while effective </td> </tr> <tr> <td> Pioneer Kitten activates dormant access in defense industrial base networks </td> <td> 40% </td> <td> Next 14 days </td> <td> 31+ days of silence on DIB targeting during active conflict is anomalous; actor profile freshly updated </td> </tr> <tr> <td> New Handala-attributed destructive operation against U.S. target </td> <td> 25% </td> <td> Next 14 days </td> <td> DOJ domain seizure may trigger retaliatory escalation; IRGC has demonstrated willingness </td> </tr> <tr> <td> Iran-DPRK joint or coordinated cyber operation surfaces </td> <td> 20% </td> <td> Next 30 days </td> <td> Infrastructure convergence confirmed; operational coordination is logical next step </td> </tr> <tr> <td> Ceasefire negotiations emerge, triggering pre-positioning surge </td> <td> 15% </td> <td> Next 30 days </td> <td> No diplomatic signals currently; if they emerge, expect actors to accelerate operations before stand-down </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> What to Monitor </h3> <table> <thead> <tr> <th> Focus Area </th> <th> ATT&CK Techniques </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> MDM/Intune bulk actions </td> <td> T1531 , T1485 , T1072 , T1078.004 </td> <td> Alert on >10 device wipe/retire/reset commands within 60 minutes from any single admin account </td> </tr> <tr> <td> Edge infrastructure exploitation </td> <td> T1190 , T1059 , T1078 </td> <td> Monitor Ivanti EPMM, Fortinet, Citrix, Cisco ASA for anomalous admin authentication and post-auth command execution </td> </tr> <tr> <td> PLC/ICS anomalies </td> <td> T0816 , T0826 , T1190 </td> <td> Alert on unexpected PLC restarts, firmware modifications, or configuration changes — especially ABB AC500, Unitronics, Siemens </td> </tr> <tr> <td> SSH brute-force from Iranian ASNs </td> <td> T1110 </td> <td> Correlate failed SSH authentication attempts against known Iranian infrastructure (ASN 215930, ASN 213790) </td> </tr> <tr> <td> SOCKS4 proxy traffic </td> <td> T1090 </td> <td> Detect outbound connections to ports 4111, 4221, 18644, 10749 on known proxy infrastructure </td> </tr> <tr> <td> Webshell deployment on DMZ </td> <td> T1505.003 </td> <td> Hunt for ASPXSPY, ANTAK, TUNNA, REGEORG, PHPsert across web-accessible servers </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ul> <li> Hypothesis: Pioneer Kitten has established dormant webshell access on edge infrastructure. Hunt for PHP/ASPX files with anomalous creation dates on Ivanti, Fortinet, or Citrix appliances. Check for scheduled tasks or cron jobs that beacon to external infrastructure on non-standard ports. </li> </ul> <ul> <li> Hypothesis: Intune/Entra ID admin accounts have been compromised for future destructive use. Audit all Global Administrator and Intune Administrator role assignments. Look for recently added accounts, accounts without MFA, or service principals with excessive device management permissions. </li> </ul> <ul> <li> Hypothesis: Iranian proxy infrastructure is being used as an anonymization layer for credential stuffing. Correlate authentication failures across VPN, OWA, and cloud services against the SOCKS4 proxy IPs identified in this cycle. Look for low-and-slow patterns (1–2 attempts per hour) designed to evade lockout thresholds. </li> </ul> <ul> <li> Hypothesis: ABB AC500 PLCs are network-accessible and unpatched. Conduct asset discovery for ABB AC500 V3 controllers. Verify network segmentation — these devices should NOT be reachable from corporate networks or the Internet. </li> </ul> <h3> What to Block </h3> <table> <thead> <tr> <th> IOC </th> <th> Type </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> 62.60.130[.]237 </td> <td> IPv4 </td> <td> SSH brute-force (ASN 215930, confidence 95) </td> </tr> <tr> <td> 206.123.156[.]197 </td> <td> IPv4 </td> <td> SOCKS4 proxy (ASN 213790, port 4111) </td> </tr> <tr> <td> 206.123.156[.]188 </td> <td> IPv4 </td> <td> SOCKS4 proxy (ASN 213790, port 4221) </td> </tr> <tr> <td> 206.123.156[.]231 </td> <td> IPv4 </td> <td> SOCKS4 proxy (ASN 213790, port 18644) </td> </tr> <tr> <td> 206.123.156[.]187 </td> <td> IPv4 </td> <td> SOCKS4 proxy (ASN 213790, port 10749) </td> </tr> <tr> <td> Justicehomeland[.]org </td> <td> Domain </td> <td> IRGC-affiliated, DOJ-seized </td> </tr> <tr> <td> Handala-Hack[.]to </td> <td> Domain </td> <td> IRGC-affiliated, DOJ-seized </td> </tr> <tr> <td> Karmabelow80[.]org </td> <td> Domain </td> <td> IRGC-affiliated, DOJ-seized </td> </tr> <tr> <td> Handala-Redwanted[.]to </td> <td> Domain </td> <td> IRGC-affiliated, DOJ-seized </td> </tr> </tbody> </table> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> Primary Risk: Credential theft via Iranian proxy infrastructure enabling account takeover; potential for destructive operations against payment processing systems. <ul> <li> Implement IP reputation blocking for identified Iranian SOCKS4 proxy ranges at WAF and authentication gateways </li> <li> Enable conditional access policies requiring compliant devices and MFA for all privileged access to core banking systems </li> <li> Review SWIFT/payment system access controls for single points of failure that mirror the Intune single-admin-wipe vulnerability </li> <li> Monitor for anomalous bulk transaction reversals or account modifications ( T1531 financial equivalent) </li> </ul> <h3> Energy </h3> Primary Risk: Active PLC exploitation targeting generation, transmission, and distribution systems; ABB AC500 vulnerabilities directly relevant. <ul> <li> Immediate: Inventory all ABB AC500 V3 deployments; verify firmware versions against ICSA-26-132-03/05/06 </li> <li> Validate network segmentation between IT and OT — no PLC should be reachable from corporate network or Internet </li> <li> Deploy OT-specific anomaly detection on SCADA communications (Modbus, DNP3, IEC 61850) </li> <li> Establish manual override procedures for critical generation/distribution systems in case of PLC compromise </li> <li> Coordinate with E-ISAC on shared Iranian targeting indicators </li> </ul> <h3> Healthcare </h3> Primary Risk: Demonstrated willingness to target healthcare (Stryker attack); MDM/Intune weaponization directly threatens hospital device fleets. <ul> <li> Critical: Implement dual-admin approval for ALL bulk MDM actions (wipe, retire, reset) — this is the single most important control post-Stryker </li> <li> Audit Intune/SCCM administrator accounts: remove unnecessary privileges, enforce phishing-resistant MFA (FIDO2) </li> <li> Segment biomedical devices from MDM-managed endpoints to prevent cascade destruction </li> <li> Pre-position offline device images for rapid reconstitution if wipe attack occurs </li> <li> Coordinate with H-ISAC on Handala/BANISHED KITTEN targeting indicators </li> </ul> <h3> Government </h3> Primary Risk: Espionage, pre-positioning for destructive operations, and information operations (PII doxxing of personnel). <ul> <li> Audit all edge infrastructure (Ivanti EPMM, Fortinet, Cisco) for CVE-2026-6973 and related vulnerabilities — patch within 72 hours per BOD 22-01 </li> <li> Implement enhanced monitoring on .mil and .gov Entra ID tenants for anomalous admin role assignments </li> <li> Review personnel security: Iranian actors have demonstrated willingness to dox and threaten individuals — brief staff on OPSEC for personal information </li> <li> Validate continuity of operations (COOP) plans account for simultaneous cyber-kinetic disruption scenarios </li> <li> Monitor for Pioneer Kitten webshell indicators across DMZ infrastructure </li> </ul> <h3> Aviation / Logistics </h3> Primary Risk: Supply chain disruption through IT/OT convergence points; targeting of logistics systems supporting military operations. <ul> <li> Audit building management systems (Honeywell BMS) and airport OT infrastructure for Internet exposure </li> <li> Review GitHub repositories and CI/CD pipelines for supply chain injection indicators (Pioneer Kitten has used code repository access) </li> <li> Implement enhanced monitoring on Windchill PLM and similar engineering data management systems </li> <li> Validate that cargo/logistics management systems have offline operational capability </li> <li> Coordinate with A-ISAC on Iranian targeting of aviation supply chains </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Block Iranian proxy IPs (62.60.130[.]237, 206.123.156[.]197/.188/.231/.187) at perimeter firewall and SIEM watchlists </td> </tr> <tr> <td> 2 </td> <td> IT Ops </td> <td> Verify ALL Ivanti EPMM instances patched to ≥12.8.0.1 addressing CVE-2026-6973 — confirmed active exploitation </td> </tr> <tr> <td> 3 </td> <td> IT Ops </td> <td> Audit Microsoft Intune/Entra ID: identify all accounts with device wipe permissions; enforce MFA on every one </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Deploy detection rule: alert on >10 Intune device wipe/retire/reset actions within 60 minutes from single account </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> IT Ops </td> <td> Implement dual-admin approval for Microsoft Intune bulk device actions (wipe, retire, reset) per CISA/FBI post-Stryker guidance </td> </tr> <tr> <td> 6 </td> <td> OT/ICS Team </td> <td> Audit ABB AC500 V3 PLC firmware versions and network exposure; apply patches per ICSA-26-132-03/05/06; validate segmentation </td> </tr> <tr> <td> 7 </td> <td> SOC </td> <td> Conduct threat hunt for Pioneer Kitten webshell indicators (ASPXSPY, ANTAK, TUNNA, REGEORG, PHPsert) across all DMZ and edge infrastructure </td> </tr> <tr> <td> 8 </td> <td> SOC </td> <td> Implement behavioral analytics on Entra ID privileged role assignments — alert on new Global Admin or Intune Admin grants </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 9 </td> <td> CISO </td> <td> Commission proactive threat hunt across DIB contractor VPN logs and code repositories for dormant Pioneer Kitten/Fox Kitten access </td> </tr> <tr> <td> 10 </td> <td> CISO </td> <td> Validate incident response playbook covers "legitimate tool weaponization" scenarios (MDM wipe, cloud admin abuse) — tabletop exercise recommended </td> </tr> <tr> <td> 11 </td> <td> CISO </td> <td> Establish or strengthen information-sharing relationship with relevant ISAC (DIB-ISAC, E-ISAC, H-ISAC) for Iranian threat indicators </td> </tr> <tr> <td> 12 </td> <td> Executive </td> <td> Brief board/leadership on Iranian cyber-kinetic convergence risk — ensure business continuity plans account for simultaneous physical and cyber disruption </td> </tr> <tr> <td> 13 </td> <td> IT Ops </td> <td> Implement network segmentation review for all OT/ICS environments — validate that no PLC, RTU, or HMI is directly Internet-accessible </td> </tr> </tbody> </table> <h2> The Bottom Line </h2> We are 75 days into an active military conflict with a nation-state that has demonstrated both the capability and willingness to destroy hundreds of thousands of endpoints in a single operation, disrupt critical infrastructure through PLC exploitation, and threaten individuals with physical violence. Iranian cyber operations show no signs of de-escalation. Three realities demand immediate executive attention: First , the Stryker attack proved that your MDM platform is a weapon. If a single compromised admin account can wipe your entire device fleet, you have a single point of catastrophic failure. Fix it this week. Second , the 31-day silence on defense industrial base targeting is not reassurance — it is a warning. Pioneer Kitten's profile was refreshed this week. Their access may already be inside your network, waiting. If you are in the DIB, you need a proactive hunt, not passive monitoring. Third , Iranian actors are bifurcating into loud and quiet tracks. The loud track (Handala doxxing, death threats, leak sites) gets the headlines. The quiet track (PLC exploitation without claims, edge infrastructure compromise, dormant access maintenance) is where the real damage will come from. Your detection strategy must account for both. The absence of a spectacular attack since March is not evidence of reduced capability. It may be evidence of patience. Act accordingly. Published by Anomali CTI Desk | 14 May 2026 Assessment based on intelligence collected through 14 May 2026 | Next assessment cycle: 15 May 2026

FEATURED RESOURCES

May 15, 2026

Anomali Cyber Watch

The Loudest Signal in Iranian Cyber Operations Is Silence — And That Should Worry You

May 14, 2026

Anomali Cyber Watch

Iranian Cyber Operations at Week 11: Active PLC Exploitation, Destructive Wiper Attacks, and the Silent Threat of Dormant Access

May 13, 2026

Anomali Cyber Watch

The 10-Week Silence Before the Storm: Iran's Cyber Retaliation Gap Demands Immediate Action

Explore All