Iranian Cyber Operations Enter Critical Retaliation Window Following Khamenei Funeral

Anomali Threat Research

Published on

July 7, 2026

Table of Contents

Threat Assessment Level: HIGH — ESCALATING The 130-day US-Israeli military campaign against Iran has entered its most dangerous cyber phase. Supreme Leader Khamenei's funeral ceremonies concluded in Qom on July 6–7, 2026, and the intelligence picture is unambiguous: Iran's cyber apparatus — now under direct IRGC control — is pre-positioned for retaliatory strikes against critical infrastructure, defense contractors, and energy sector targets. Israeli National Cyber Directorate chief Yossi Karadi confirmed on June 29 that hostile cyber incidents tripled year-over-year to approximately 4,800 attacks in June 2026 alone . Active command-and-control infrastructure was confirmed as recently as July 1. Seven fresh malware samples shared across four Iranian threat groups confirm the operational pipeline from espionage to destruction is loaded and ready. This is not a forecast. This is a status report on a weapon that is armed. <h2> What Changed </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> Apr 8 </td> <td> H-ISAC shares 7 malware samples co-tagged across 4 Iranian groups </td> <td> Pioneer Kitten → Handala destruction pipeline operationally confirmed </td> </tr> <tr> <td> Jun 29 </td> <td> Israel INCD confirms 3x cyber surge (4,800 incidents/month) </td> <td> Official validation of escalation tempo </td> </tr> <tr> <td> Jul 1 </td> <td> MuddyWater DinDoor C2 server confirmed active, targeting Oil & Gas (Oman) </td> <td> MOIS espionage operations expanding to Gulf energy </td> </tr> <tr> <td> Jul 1 </td> <td> CVE-2026-45659 (SharePoint RCE) added to CISA KEV catalog </td> <td> Active exploitation across 10,000+ servers; Iranian actors historically target SharePoint </td> </tr> <tr> <td> Jul 2 </td> <td> CISA publishes 9 ICS advisories including satellite kinetic control, RTUs, and storage systems </td> <td> Novel attack surface: satellite attitude control (reaction wheels) </td> </tr> <tr> <td> Jul 6–7 </td> <td> Khamenei funeral in Qom </td> <td> 48–72hr retaliatory window now active; nationalist fervor at peak </td> </tr> <tr> <td> Jul 7 </td> <td> FM Araghchi: "No talks if threats continue" </td> <td> Diplomatic off-ramp closing; increases probability of cyber retaliation </td> </tr> <tr> <td> Jul 7 </td> <td> MuddyWater actor profile updated in threat intelligence feeds </td> <td> Indicates active campaign retooling </td> </tr> <tr> <td> Ongoing </td> <td> Cyber Av3ngers (HYDRO KITTEN/IRGC-CEC) conspicuously silent during 3x surge </td> <td> Absence consistent with holding IOCONTROL capability in reserve for high-impact strike </td> </tr> </tbody> </table> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Cyber Dimension </th> </tr> </thead> <tbody> <tr> <td> Feb 28 </td> <td> Assassination of Supreme Leader Khamenei </td> <td> IRGC assumes state control; cyber operations centralized </td> </tr> <tr> <td> Mar 12 </td> <td> Check Point attributes Handala to Void Manticore (IRGC) </td> <td> Confirms state sponsorship of "hacktivist" destruction ops </td> </tr> <tr> <td> Apr 8 </td> <td> H-ISAC shares 7 malware hashes co-tagged across 4 Iranian groups </td> <td> Pioneer Kitten → Handala destruction pipeline confirmed </td> </tr> <tr> <td> Jun 12 </td> <td> Handala claims FBI drone hack, threatens World Cup disruption </td> <td> IO expansion beyond Israel to US targets </td> </tr> <tr> <td> Jun 24 </td> <td> Israel reportedly attacks 4 Iranian banks (counter-cyber) </td> <td> Escalation of bilateral cyber conflict </td> </tr> <tr> <td> Jun 29 </td> <td> INCD chief confirms 4,800 hostile incidents in June </td> <td> 3x year-over-year increase officially validated </td> </tr> <tr> <td> Jun 30–Jul 2 </td> <td> CISA ICS advisory batch (9 advisories) </td> <td> Satellite, RTU, IoT, supply chain vulnerabilities disclosed </td> </tr> <tr> <td> Jul 1 </td> <td> CVE-2026-45659 added to KEV; MuddyWater C2 active </td> <td> Dual-threat: mass exploitation + targeted espionage </td> </tr> <tr> <td> Jul 6–7 </td> <td> Khamenei funeral ceremonies </td> <td> Retaliatory window opens </td> </tr> <tr> <td> Jul 7 </td> <td> Iran FM threatens to halt negotiations </td> <td> Diplomatic trigger for escalation </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. MuddyWater (MOIS) — Active C2, Expanding Targeting </h3> Aliases: TEMP.Zagros, Seedworm, Static Kitten, Mango Sandstorm, TA450, MERCURY MuddyWater's DinDoor backdoor — built on the Deno JavaScript runtime — is actively communicating with C2 infrastructure hosted on US-based Vultr VPS (IP: 140.82.18[.]48 ). The targeting has expanded to Oil & Gas operations in Oman , signaling Gulf energy sector campaigns are live. The group's updated toolset relies on legitimate remote management software — SimpleHelp, ScreenConnect, and Atera Agent — making detection challenging because these tools are commonly whitelisted in enterprise environments. Delivery occurs via Microsoft Teams lures and spearphishing with MSI/EXE payloads hosted on file-sharing platforms. Key TTPs: Spearphishing ( T1566.001 ), Remote Access Software abuse ( T1219 ), PowerShell execution ( T1059.001 ), Web Protocol C2 ( T1071.001 ) <h3> 2. Pioneer Kitten → Handala Destruction Pipeline </h3> Actors: Pioneer Kitten (UNC757/Fox Kitten), Handala (Void Manticore/BANISHED KITTEN), Helix Kitten (APT34), Refined Kitten Seven malware samples shared by H-ISAC are co-attributed to four Iranian threat groups simultaneously — confirming an operational handoff pipeline where: <ol> <li> Pioneer Kitten gains initial access via exploitation of Fortinet, Citrix, and Ivanti edge devices </li> <li> Access is transferred to Handala/Void Manticore for destructive operations (wipers, data destruction) </li> <li> Ransomware is deployed as cover for state-directed destruction </li> </ol> This is not theoretical. The samples are tagged, shared, and active. Organizations with Fortinet or Citrix edge devices should assume they are targets. <h3> 3. Cyber Av3ngers (IRGC-CEC) — The Silent Threat </h3> Aliases: HYDRO KITTEN (IRGC Cyber-Electronic Command) The dedicated ICS destruction group behind IOCONTROL malware has been conspicuously silent during the 3x surge in overall Iranian cyber activity. This absence is not reassuring — it is consistent with Iranian operational doctrine of holding high-impact capabilities in reserve for maximum-effect retaliatory strikes. Assessment: IOCONTROL implants may already be pre-positioned in water and energy SCADA networks, awaiting an activation signal. The collapse of diplomatic negotiations (signaled by FM Araghchi's July 7 statement) is the most likely trigger. <h3> 4. CVE-2026-45659 — SharePoint Deserialization RCE </h3> CVSS 8.8 | Added to CISA KEV July 1 | Active exploitation confirmed across 10,000+ servers This SharePoint vulnerability allows authenticated users to achieve remote code execution via deserialization. Iranian APT groups — particularly MuddyWater and APT34 — have historically targeted SharePoint for initial access and lateral movement. With active exploitation in the wild and Iranian actors retooling, this CVE demands immediate patching. <h3> 5. Multi-Actor C2 Infrastructure on Iranian ASNs </h3> A cluster of IP addresses on ASN 213790 ("Limited Network", Tehran) serves as shared command-and-control infrastructure tagged to multiple threat actors — including both APT and ransomware operations (LockBit, Pinchy-Spider). A new node ( 171.22.27[.]16 ) on ASN 60631 was activated June 6. This infrastructure convergence supports the hypothesis that Iranian state actors are leveraging ransomware-as-a-service ecosystems as cover for espionage and destruction — blurring attribution and complicating incident response. <h3> 6. Satellite Kinetic Control — Novel Attack Surface </h3> CISA advisory ICSA-26-183-02 discloses arbitrary firmware upload to CubeSpace CW0057 Reaction Wheels — the components that control satellite orientation in space. Combined with vulnerabilities in ST Engineering iDirect satellite terminals (ground segment), this creates a dual-layer satellite attack surface spanning ground-to-space. A compromised reaction wheel could cause loss of satellite pointing — effectively a kinetic denial-of-service in orbit. For organizations dependent on satellite communications, ISR, or GPS augmentation during the active conflict, this represents a qualitative escalation from data-plane to physical-effect attacks. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Trigger Indicator </th> </tr> </thead> <tbody> <tr> <td> Handala/hacktivist destructive operations with IO amplification </td> <td> 70% </td> <td> 48 hours </td> <td> Funeral nationalist fervor + established pattern </td> </tr> <tr> <td> MuddyWater intensified spearphishing against Gulf energy sector </td> <td> 50% </td> <td> 7 days </td> <td> DinDoor C2 active + Oman targeting confirmed </td> </tr> <tr> <td> Cyber Av3ngers activate dormant IOCONTROL in water/energy SCADA </td> <td> 30% </td> <td> 14 days </td> <td> Negotiation collapse (Araghchi statement is precursor) </td> </tr> <tr> <td> Pioneer Kitten dormant DIB access activates for exfiltration </td> <td> 20% </td> <td> 14 days </td> <td> Watch for Rclone/Wasabi patterns from aerospace contractors </td> </tr> <tr> <td> Coordinated multi-group retaliatory strike (espionage + destruction + IO) </td> <td> 40% </td> <td> 7 days </td> <td> Convergence of funeral window + diplomatic failure + pre-positioned access </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK ID </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> SimpleHelp, ScreenConnect, Atera connections from non-IT endpoints </td> <td> T1219 </td> <td> Alert on RMM tool processes spawned outside IT admin groups </td> </tr> <tr> <td> CRITICAL </td> <td> Outbound connections to 140.82.18[.]48 </td> <td> T1071.001 </td> <td> Firewall/proxy logs — DinDoor C2 over HTTPS </td> </tr> <tr> <td> HIGH </td> <td> Connections to ASN 213790 (192.253.248.0/24) and ASN 60631 </td> <td> T1571 </td> <td> Netflow analysis for any traffic to Tehran-hosted infrastructure </td> </tr> <tr> <td> HIGH </td> <td> SharePoint deserialization exploitation attempts </td> <td> T1190 </td> <td> WAF rules for CVE-2026-45659 payload patterns </td> </tr> <tr> <td> HIGH </td> <td> PowerShell execution chains with encoded commands </td> <td> T1059.001 </td> <td> POWERSTATS-pattern detection (base64 + IEX) </td> </tr> <tr> <td> MEDIUM </td> <td> Fortinet/Citrix/Ivanti VPN anomalous admin sessions </td> <td> T1190 </td> <td> Off-hours authentication, new admin accounts, config changes </td> </tr> <tr> <td> MEDIUM </td> <td> Rclone or Wasabi S3 exfiltration from engineering workstations </td> <td> T1567.002 </td> <td> Process creation monitoring for cloud storage CLI tools </td> </tr> <tr> <td> MEDIUM </td> <td> Microsoft Teams delivering MSI/EXE payloads </td> <td> T1566.001 </td> <td> File download monitoring from Teams external senders </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> Dormant VPN Access: Search Fortinet and Citrix appliance logs for authentication events from previously unseen source IPs in the past 72 hours — Pioneer Kitten activates dormant credentials during high-tempo periods. </li> <li> DinDoor Deno Runtime: Hunt for deno.exe or Deno-related processes on endpoints that are not developer workstations — DinDoor abuses the Deno JavaScript runtime for C2. </li> <li> RMM Tool Proliferation: Baseline which endpoints legitimately run SimpleHelp, ScreenConnect, or Atera. Any new installations outside this baseline in the past 14 days warrant immediate investigation. </li> <li> IOCONTROL Beaconing: For OT/ICS environments, monitor for periodic low-volume HTTPS beacons from PLCs, RTUs, or HMIs to external IPs — IOCONTROL uses minimal C2 traffic to avoid detection. </li> <li> Satellite Ground Station Reconnaissance: If operating satellite terminals (ST Engineering iDirect), audit management interface access logs for unauthorized connections or firmware query commands. </li> </ol> <h3> Blocking Guidance </h3> Deploy the following IOCs to perimeter defenses, EDR, and SIEM: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 140.82.18[.]48 </td> <td> MuddyWater DinDoor C2 (Vultr US) </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]55 </td> <td> Iranian APT C2 (ASN 213790, Tehran) </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]169 </td> <td> Multi-actor C2 (ASN 213790, Tehran) </td> </tr> <tr> <td> IPv4 </td> <td> 77.90.185[.]253 </td> <td> Scanner/C2 (ASN 213790, Tehran) </td> </tr> <tr> <td> IPv4 </td> <td> 171.22.27[.]16 </td> <td> APT C2 (ASN 60631, Tehran) — new Jun 6 </td> </tr> <tr> <td> SHA256 </td> <td> 0a5cf97e699c8bfacee7f89ebfaa851ff03dd004a58ffde9c609fcc2cd27f250 </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> SHA256 </td> <td> 7540bed5efd55f75271bb4b5a5afb28f343ebe64a816f74f0edba8527dc5e181 </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> SHA256 </td> <td> 2417738503887374dae9891d26ea7033eb7b44656a14b84f15d4e8fa63e4e830 </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> SHA256 </td> <td> 2a432edfba8a28854b9e3e34be513e96e1dc3426b1bd0976cda71ecfc5a2427c </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> SHA256 </td> <td> ff5f7d414c6e701be02ec546c56fac589902896fe29fa0ef1e3a96d904a65134 </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> SHA256 </td> <td> 9f0ac7fa30e86b4015de6f77fe219cced164f317799fdc3faaf35af730a48700 </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> SHA1 </td> <td> 48e75d6e2bdb2b00ecbf4801a98f96732e397858 </td> <td> MuddyWater tooling </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen and H-ISAC partner feeds. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> Iranian actors targeted Israeli law firms and accounting firms during the June surge. Expect expansion to financial services in allied nations. <ul> <li> Immediate: Patch SharePoint (CVE-2026-45659) — financial institutions are high-value targets for data destruction disguised as ransomware </li> <li> 7-Day: Audit all RMM tools (SimpleHelp, ScreenConnect, Atera) across the environment; MuddyWater uses these for persistent access in financial targets </li> <li> Monitor: Wire transfer systems and SWIFT interfaces for anomalous access patterns during the retaliation window </li> <li> ATT&CK Focus: T1219 (Remote Access Software), T1486 (Data Encrypted for Impact), T1485 (Data Destruction) </li> </ul> <h3> Energy </h3> MuddyWater is actively targeting Oil & Gas in Oman. Cyber Av3ngers' IOCONTROL malware targets water and energy SCADA. <ul> <li> Immediate: Segment OT networks from IT; verify no RMM tools are installed on OT-adjacent systems </li> <li> 7-Day: Hunt for IOCONTROL beaconing patterns on PLCs and RTUs (periodic low-volume HTTPS to external IPs) </li> <li> 30-Day: Conduct firmware integrity verification on Schneider EasyLogic T150 and Saitel DP RTUs per CISA ICSA-26-181-04 </li> <li> ATT&CK Focus: T0826 (Loss of Availability), T1071.001 (Web Protocols for C2), T0839 (Module Firmware) </li> </ul> <h3> Healthcare </h3> CISA advisory ICSMA-26-181-01 (OFFIS DCMTK) affects medical imaging systems. Iranian actors have targeted healthcare organizations in the broader campaign. <ul> <li> Immediate: Identify all DCMTK-based medical imaging systems and restrict network access to clinical VLANs only </li> <li> 7-Day: Verify that no SimpleHelp or ScreenConnect agents are running on clinical systems — these are MuddyWater C2 channels </li> <li> Monitor: Patient data repositories for bulk access or exfiltration — Handala has used stolen data for IO amplification </li> <li> ATT&CK Focus: T1219 (Remote Access Software), T1005 (Data from Local System), T1491.002 (External Defacement for IO) </li> </ul> <h3> Government </h3> SharePoint RCE (CVE-2026-45659) is actively exploited across 10,000+ servers. Government SharePoint instances are priority targets for Iranian espionage. <ul> <li> Immediate: Emergency patch CVE-2026-45659 on all SharePoint instances; if patching requires downtime, implement WAF rules as interim mitigation </li> <li> 7-Day: Audit SharePoint access logs for anomalous deserialization patterns or new web shells since June 1 </li> <li> 30-Day: Implement conditional access policies requiring compliant devices for SharePoint authentication — reduces exploitation surface for authorized-user attacks </li> <li> ATT&CK Focus: T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1059.001 (PowerShell) </li> </ul> <h3> Aviation / Logistics / Defense Industrial Base </h3> Pioneer Kitten historically targets DIB contractors via Fortinet and Citrix VPN exploitation. The funeral retaliation window may trigger dormant access activation. <ul> <li> Immediate: Review Fortinet and Citrix VPN authentication logs for the past 7 days — flag any new source IPs or off-hours admin sessions </li> <li> 7-Day: Hunt for Rclone, Wasabi S3 CLI, or MEGAsync on engineering workstations — these are Pioneer Kitten exfiltration tools </li> <li> 30-Day: Commission external assessment of VPN appliance configurations; verify all Fortinet/Ivanti/Citrix devices are patched to current firmware </li> <li> Monitor: PTC Windchill and engineering data repositories for bulk download patterns </li> <li> ATT&CK Focus: T1190 (Exploit Public-Facing Application), T1199 (Trusted Relationship), T1567.002 (Exfiltration to Cloud Storage) </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> Block IP 140.82.18[.]48 at perimeter and add to SIEM correlation — active MuddyWater DinDoor C2 </td> <td> SOC </td> </tr> <tr> <td> 2 </td> <td> Deploy 6 confirmed SHA256 hashes (Pioneer Kitten/Handala convergence samples) to EDR block lists </td> <td> SOC </td> </tr> <tr> <td> 3 </td> <td> Patch CVE-2026-45659 (SharePoint deserialization RCE, CVSS 8.8) on all internet-facing instances </td> <td> IT Ops </td> </tr> <tr> <td> 4 </td> <td> Block outbound traffic to ASN 213790 ( 192.253.248[.]0/24 ) and monitor ASN 60631 ( 171.22.27[.]0/24 ) </td> <td> SOC / Network </td> </tr> <tr> <td> 5 </td> <td> Activate enhanced monitoring posture for 72-hour funeral retaliation window — reduce alert thresholds </td> <td> SOC Manager </td> </tr> <tr> <td> 6 </td> <td> Brief executive leadership on elevated threat level and potential for retaliatory destructive attack </td> <td> CISO </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 7 </td> <td> Create detection rules for SimpleHelp, ScreenConnect, and Atera on non-IT-admin endpoints </td> <td> Detection Engineering </td> </tr> <tr> <td> 8 </td> <td> Audit ST Engineering iDirect satellite terminal firmware and restrict management interfaces </td> <td> IT Ops / OT Security </td> </tr> <tr> <td> 9 </td> <td> Hunt for Deno runtime processes ( deno.exe ) on non-developer endpoints (DinDoor indicator) </td> <td> Threat Hunting </td> </tr> <tr> <td> 10 </td> <td> Review Fortinet/Citrix/Ivanti VPN logs for anomalous authentication since June 1 </td> <td> IT Security </td> </tr> <tr> <td> 11 </td> <td> Validate OT/IT network segmentation — confirm no RMM tools present on OT-adjacent systems </td> <td> OT Security </td> </tr> <tr> <td> 12 </td> <td> Update incident response playbooks with Iranian wiper scenario (Handala/Void Manticore TTPs) </td> <td> IR Team </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 13 </td> <td> Commission threat hunt for dormant Pioneer Kitten access in all edge appliances (Fortinet, Citrix, Ivanti) </td> <td> CISO / Threat Hunting </td> </tr> <tr> <td> 14 </td> <td> Assess satellite ground station security posture including CubeSpace reaction wheel firmware integrity </td> <td> OT Security / Space Ops </td> </tr> <tr> <td> 15 </td> <td> Implement conditional access policies requiring device compliance for SharePoint and M365 </td> <td> Identity & Access </td> </tr> <tr> <td> 16 </td> <td> Conduct tabletop exercise: coordinated Iranian retaliatory cyber attack (wiper + ransomware + IO) </td> <td> CISO / IR / Legal </td> </tr> <tr> <td> 17 </td> <td> Evaluate adding secondary structured threat intelligence feed (Recorded Future or Mandiant Advantage) </td> <td> CTI Team </td> </tr> <tr> <td> 18 </td> <td> Establish Telegram monitoring for Handala and Iranian hacktivist IO channels </td> <td> CTI Team </td> </tr> </tbody> </table> <h2> The Bottom Line </h2> We are now 130 days into the Iran conflict and inside the highest-risk window for retaliatory cyber operations since the campaign began. The intelligence is clear: <ul> <li> The capability exists: 4,800 attacks per month, active C2 infrastructure, fresh malware shared across four coordinated groups </li> <li> The intent is stated: "No talks if threats continue" — diplomatic off-ramps are closing </li> <li> The timing is optimal: Funeral nationalism provides both motivation and IO cover for destructive operations </li> <li> The silence is the signal: Cyber Av3ngers and IOCONTROL have been quiet during a 3x surge — capabilities held in reserve are capabilities about to be used </li> </ul> The Pioneer Kitten → Handala pipeline means that initial access already achieved weeks or months ago can be weaponized for destruction within hours. If your organization runs Fortinet, Citrix, or Ivanti edge devices, the question is not whether you are targeted — it is whether dormant access already exists in your environment. The next 72 hours demand heightened vigilance, accelerated patching, and executive-level awareness that a destructive cyber event against allied critical infrastructure is not a hypothetical — it is an assessed probability. Act now. Patch CVE-2026-45659. Block the IOCs. Hunt for dormant access. Brief your board. Published by the Anomali CTI Desk | July 7, 2026 Intelligence sources: ThreatStream Next-Gen, CISA ICS-CERT, H-ISAC, Israel INCD, Google Threat Intelligence, Hunt.io, CyberProof, Check Point Research For IOC feeds and STIX packages: Contact your Anomali representative or access via ThreatStream Next-Gen platform

FEATURED RESOURCES

July 7, 2026

Anomali Cyber Watch