Iranian Cyber Operations Expand Multi-Tool Staging Infrastructure as Conflict Enters Fourth Month

Anomali Threat Research

Published on

May 27, 2026

Table of Contents

Threat Assessment Level: ELEVATED Nearly three months into the Iran-Israel conflict (Day 88 since February 28, 2026), Iranian state-affiliated cyber operations continue to expand offensive infrastructure capacity despite the nominal ceasefire declared on April 8. Today's intelligence reveals a troubling convergence: multiple offensive frameworks, APT-attributed infrastructure, and botnet command-and-control servers are consolidating on a single Tehran-based network — while a European Central Bank warning signals that the conflict's economic shockwaves are now reaching European policymakers. For CISOs, the message is clear: the ceasefire has not reduced cyber risk. It has shifted it below the threshold of kinetic conflict, exactly where Iranian doctrine says it should operate. <h2> What Changed </h2> Since our last assessment (2026-05-26): <ul> <li> ASN 213790 ("Limited Network," Tehran) confirmed as multi-actor staging ground — now hosting APT28-attributed IPs, Mirai botnet C2, Cactus ransomware infrastructure, AND Iranian SOCKS4 proxy relays on the same network block. This is no longer a single-actor concern; it's an operational ecosystem. </li> <li> Three offensive frameworks confirmed co-located on Iranian research infrastructure — Cobalt Strike, Remcos RAT, and Sliver C2 are simultaneously active on Iranian academic/research ISPs, suggesting either a bulletproof hosting service or a sophisticated operator maintaining tool diversity. </li> <li> ECB publicly warned that the Iran war is "amplifying Europe's financial vulnerabilities" — a geopolitical escalation signal that may expand pro-Iran hacktivist targeting from Israel/US to European financial institutions. </li> <li> Seven new ICS advisories from CISA covering ABB AC500 V2, Terra AC, Zenon, and other industrial systems — expanding the attack surface relevant to Iranian ICS/OT targeting capabilities. </li> <li> Defense Industrial Base (DIB) pre-positioning intelligence has been quiet for 10 consecutive days — approaching the threshold for mandatory proactive hunting. Absence is not safety. </li> <li> MuddyWater (MOIS) remains operationally silent since December 2025 — now approaching six months of quiet, consistent with a wartime retooling cycle. When they resurface, expect evolved TTPs that bypass current detection signatures. </li> <li> Nimbus Manticore (UNC1549) conducted three MiniFast backdoor waves against US aviation and aerospace between February and April 2026 via SEO poisoning — a novel delivery technique for Iranian APTs, with AI-assisted malware development confirmed. </li> <li> Threat level remains ELEVATED (unchanged from Day 87). No de-escalation signals detected. Infrastructure expansion continues to accumulate offensive capacity. </li> </ul> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 2026-02-28 </td> <td> Iran-Israel conflict escalation begins </td> <td> Day 0 — cyber operations surge </td> </tr> <tr> <td> 2026-03-13 </td> <td> Stryker wiper attack (Void Manticore/Handala) </td> <td> 20+ defense-sector systems destroyed </td> </tr> <tr> <td> 2026-02 – 2026-04 </td> <td> Three MiniFast backdoor waves (Nimbus Manticore/UNC1549) </td> <td> US aviation/aerospace targeted via SEO poisoning — first for Iranian APTs </td> </tr> <tr> <td> 2026-04-08 </td> <td> Nominal ceasefire declared </td> <td> Cyber operations intensify rather than decrease </td> </tr> <tr> <td> 2026-05-25 </td> <td> IRGC-directed PLC manipulation at food plant </td> <td> Three compressors destroyed using valid credentials alone — no malware </td> </tr> <tr> <td> 2026-05-26 </td> <td> CISA publishes 7 ICS advisories (ABB products) </td> <td> Expanded ICS/OT attack surface </td> </tr> <tr> <td> 2026-05-27 </td> <td> ASN 213790 multi-actor convergence confirmed </td> <td> APT28, Mirai, Cactus ransomware, SOCKS4 proxies on single Tehran ASN </td> </tr> <tr> <td> 2026-05-27 </td> <td> ECB warns of Iran-war financial contagion to Europe </td> <td> Potential expansion of hacktivist target aperture </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. ASN 213790: A Multi-Actor Staging Ecosystem </h3> A single Tehran-based autonomous system — ASN 213790, operated by "Limited Network" — has become the most significant convergence point for Iranian-nexus offensive infrastructure we track. In a single network block, we now observe: <ul> <li> SOCKS4 proxy relays (ports 9734, 10088, 10693, 10694) providing anonymization for outbound operations </li> <li> APT28-attributed command-and-control using non-standard ports with T1059 (Command and Scripting Interpreter) and T1071 (Application Layer Protocol) techniques </li> <li> Mirai botnet HTTP loader (confidence 100) for DDoS amplification </li> <li> Cactus ransomware staging (confidence 96) </li> </ul> This density of multi-actor tooling on a single network is operationally unsustainable without eventual exposure — but until that exposure occurs, any new indicator on ASN 213790 should be treated as high-priority regardless of initial classification. <h3> 2. Multi-Framework C2 on Iranian Research Infrastructure </h3> Three distinct post-exploitation frameworks are simultaneously active on Iranian academic and research ISPs: <table> <thead> <tr> <th> Framework </th> <th> IP </th> <th> Port </th> <th> Active Since </th> <th> Hosting </th> </tr> </thead> <tbody> <tr> <td> Cobalt Strike BEACON </td> <td> 217.60.241.17 </td> <td> 443 </td> <td> Recent </td> <td> Pfcloud UG (ASN 51396) </td> </tr> <tr> <td> Remcos RAT </td> <td> 62.60.226.42 </td> <td> 43155 </td> <td> Feb 2025 (15+ months) </td> <td> Iranian Research Org for Science & Technology </td> </tr> <tr> <td> Sliver </td> <td> 45.147.77.210 </td> <td> 5900 </td> <td> Sep 2025 </td> <td> Gostaresh Pardazesh Dana Negar (ASN 51889) </td> </tr> </tbody> </table> The Remcos RAT instance has maintained persistence for over 15 months — an extraordinary dwell time that suggests either domestic surveillance operations or a long-term staging platform for outbound campaigns. The addition of Sliver (an increasingly popular open-source alternative to Cobalt Strike) complicates detection: no single signature or behavioral rule catches all three frameworks. <h3> 3. ICS/OT Attack Surface Expansion </h3> CISA's batch of seven ICS advisories (ICSA-26-146-01 through -06 plus one additional) covering ABB AC500 V2 PLCs, Terra AC wallboxes, Zenon Remote Transport, and Eppendorf BioFlo 320 bioreactors arrives in a context where: <ul> <li> On May 25, IRGC-directed operators destroyed physical infrastructure (food plant compressors) by manipulating PLC setpoints using valid credentials alone — no malware deployed </li> <li> HYDRO KITTEN (IRGC-CEC) / Cyber Av3ngers have demonstrated willingness to target water, energy, and food production ICS </li> <li> ABB PLCs share architectural similarities with previously targeted Rockwell systems </li> </ul> The credential-only destruction technique (T0831 — Manipulation of Control) renders traditional malware-based detection irrelevant for ICS environments. <h3> 4. MuddyWater (MOIS) Operational Silence </h3> MuddyWater (also tracked as UNC5667, TEMP.Zagros, Static Kitten), affiliated with Iran's Ministry of Intelligence and Security (MOIS), has been operationally silent since December 2025 — now approaching six months. Their Anomali ThreatStream Next-Gen profile was updated on 2026-05-27, but no associated IOCs or campaigns surfaced. This silence, coinciding with Iran's domestic internet shutdown, strongly indicates wartime retooling. When MuddyWater resurfaces, expect evolved TTPs that bypass current detection signatures. <h3> 5. European Financial Sector Enters the Target Aperture </h3> The ECB's public warning that the Iran war is amplifying European financial vulnerabilities is a leading indicator. Historically, pro-Iran hacktivist groups (Cyber Toufan, Handala) have expanded targeting when geopolitical narratives provide justification. European banks, payment processors, and financial market infrastructure should anticipate: <ul> <li> DDoS campaigns (T1498) against public-facing services </li> <li> Defacement operations (T1491.002) for propaganda value </li> <li> Potential credential harvesting campaigns against financial sector employees </li> </ul> <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> HYDRO KITTEN/Cyber Av3ngers resume public claims </td> <td> 60% </td> <td> Within 5 days </td> <td> Operational silence typically precedes new campaign announcements </td> </tr> <tr> <td> ASN 213790 infrastructure linked to named campaign </td> <td> 40% </td> <td> Within 2 weeks </td> <td> Multi-actor tool density is unsustainable without operational exposure </td> </tr> <tr> <td> New Iranian exploitation of internet-facing assets </td> <td> 25% </td> <td> Within 7 days </td> <td> Expected once intelligence collection feeds recover from weekend gap </td> </tr> <tr> <td> Pro-Iran hacktivists expand targeting to European financial institutions </td> <td> 35% </td> <td> Within 30 days </td> <td> ECB warning provides narrative justification; conflict spillover pattern </td> </tr> <tr> <td> MuddyWater resurfaces with evolved tooling </td> <td> 30% </td> <td> Within 60 days </td> <td> Six months of silence = retooling cycle consistent with prior patterns </td> </tr> <tr> <td> Dormant Iranian access in DIB networks activates </td> <td> 20% </td> <td> Escalation-dependent </td> <td> Pioneer Kitten/UNC6446 historical pattern of pre-positioned webshells </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> Hunt Hypothesis 1: ASN 213790 Communications <ul> <li> What to look for: Any outbound connections to the 192.253.248.0/24 and 206.123.156.0/24 ranges </li> <li> ATT&CK techniques: T1090.002 (External Proxy), T1071 (Application Layer Protocol), T1571 (Non-Standard Port) </li> <li> Detection logic: Alert on connections to ports 9734, 10088, 10693, 10694 (SOCKS4 proxy) and any traffic to 192.253.248[.]169, 192.253.248[.]52, 192.253.248[.]55, 185.93.89[.]43 </li> <li> Investigation: If hits found, correlate with authentication logs — Iranian operators increasingly use valid credentials (T1078) </li> </ul> Hunt Hypothesis 2: Cobalt Strike BEACON on Port 443 <ul> <li> What to look for: HTTPS connections to 217.60.241[.]17 with Cobalt Strike JA3/JA3S fingerprints </li> <li> ATT&CK techniques: T1071.001 (Web Protocols), T1573.001 (Encrypted Channel), T1105 (Ingress Tool Transfer) </li> <li> Detection logic: Review 30 days of firewall/proxy logs for any historical connection to this IP; deploy CS malleable C2 profile detection on NDR platforms </li> <li> Investigation: If beacon detected, assume full compromise — Cobalt Strike enables lateral movement within minutes </li> </ul> Hunt Hypothesis 3: Sliver Framework Masquerading <ul> <li> What to look for: Traffic to 45.147.77[.]210 on port 5900 (VNC port masquerading) </li> <li> ATT&CK techniques: T1219 (Remote Access Software), T1571 (Non-Standard Port), T1071.001 (Web Protocols) </li> <li> Detection logic: Port 5900 traffic that does NOT match VNC protocol headers = likely Sliver C2; deploy Sliver-specific JA3 fingerprints to NDR/IDS </li> <li> Investigation: Cross-reference with any Remcos RAT indicators — operators may maintain multiple implants </li> </ul> Hunt Hypothesis 4: ICS/OT Credential-Based Manipulation <ul> <li> What to look for: Anomalous PLC setpoint changes, especially outside maintenance windows, using valid engineering workstation credentials </li> <li> ATT&CK techniques (ICS): T0831 (Manipulation of Control), T0859 (Valid Accounts), T0821 (Modify Controller Tasking) </li> <li> Detection logic: This attack uses NO malware — monitor for setpoint changes exceeding normal operational parameters; alert on engineering workstation logins from unexpected source IPs </li> <li> Investigation: Correlate with physical process anomalies (pressure, temperature, flow rate deviations) </li> </ul> <h3> Blocking Recommendations </h3> Add the following to network IOC blocklists immediately: <table> <thead> <tr> <th> Type </th> <th> Indicator </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 192.253.248[.]169 </td> <td> Mirai C2, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]52 </td> <td> APT28-attributed, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]55 </td> <td> APT28-attributed, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 185.93.89[.]43 </td> <td> Cactus ransomware, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 217.60.241[.]17 </td> <td> Cobalt Strike BEACON </td> </tr> <tr> <td> IPv4 </td> <td> 62.60.226[.]42 </td> <td> Remcos RAT C2 (15+ months active) </td> </tr> <tr> <td> IPv4 </td> <td> 45.147.77[.]210 </td> <td> Sliver C2 </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]220 </td> <td> SOCKS4 proxy, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]230 </td> <td> SOCKS4 proxy, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]231 </td> <td> SOCKS4 proxy, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]238 </td> <td> SOCKS4 proxy, ASN 213790 </td> </tr> </tbody> </table> Additional IOCs available via ThreatStream Next-Gen <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> The ECB's Iran-war financial contagion warning elevates this sector's risk profile. Pro-Iran hacktivists have historically targeted financial institutions for propaganda value during escalation periods. <ul> <li> Immediate: Increase DDoS mitigation readiness for public-facing banking portals and payment APIs; pre-stage scrubbing center capacity </li> <li> 7-Day: Review OAuth token lifecycle management — supply chain compromises have demonstrated that OAuth abuse enables persistent access to CI/CD pipelines used by fintech partners; audit long-lived tokens and enforce short-lived credential policies </li> <li> 30-Day: Conduct tabletop exercise simulating coordinated hacktivist DDoS + credential harvesting campaign against customer-facing systems </li> <li> Monitor for: T1498 (Network DoS), T1491.002 (External Defacement), T1078 (Valid Accounts via credential stuffing) </li> </ul> <h3> Energy </h3> Iranian ICS/OT capabilities have escalated to physical destruction without malware. The May 25 food plant compressor attack demonstrates that valid credentials + PLC access = kinetic damage. <ul> <li> Immediate: Audit all engineering workstation access credentials; enforce MFA on all HMI/SCADA login paths; verify PLC setpoint change alerting is functional </li> <li> 7-Day: Patch ABB AC500 V2 and Terra AC systems per CISA ICSA-26-146 advisories; segment OT networks to prevent IT-to-OT lateral movement </li> <li> 30-Day: Deploy OT-specific anomaly detection (e.g., Claroty, Dragos, Nozomi) focused on setpoint manipulation rather than malware signatures </li> <li> Monitor for: T0831 (Manipulation of Control), T0859 (Valid Accounts in ICS), T0821 (Modify Controller Tasking), anomalous process variable deviations </li> </ul> <h3> Healthcare </h3> Eppendorf BioFlo 320 bioreactor advisory (CISA) directly impacts pharmaceutical manufacturing and research facilities. Iranian actors have not historically targeted healthcare, but the credential-only attack model lowers the barrier. <ul> <li> Immediate: Identify all BioFlo 320 deployments and apply vendor patches; isolate bioreactor control systems from general IT networks </li> <li> 7-Day: Audit remote access to laboratory automation systems; disable default credentials on all bioprocess controllers </li> <li> 30-Day: Establish baseline process parameters for critical bioreactors to enable anomaly detection of unauthorized setpoint changes </li> <li> Monitor for: T1190 (Exploit Public-Facing Application), unauthorized remote access to lab automation, process deviations in fermentation/cell culture parameters </li> </ul> <h3> Government / Defense Industrial Base </h3> PIR-007 (DIB pre-positioning) has been quiet for 10 consecutive days. Historical precedent shows Iranian actors (Pioneer Kitten/UNC6446) maintain dormant access for months before activation during kinetic escalation windows. <ul> <li> Immediate: Review VPN concentrator logs for webshell indicators (DVSL.aspx patterns, CVE-2024-3400 exploitation remnants); check for unauthorized SSH keys on edge devices </li> <li> 7-Day: Commission proactive threat hunt across DIB contractor networks focusing on Cisco ASA/FTD, Ivanti EPMM, Fortinet, and PAN-OS devices — all historically targeted by Iranian actors </li> <li> 30-Day: Implement zero-trust network segmentation for contractor access; require continuous authentication for privileged sessions </li> <li> Monitor for: T1133 (External Remote Services), T1505.003 (Web Shell), T1078 (Valid Accounts), dormant scheduled tasks or cron jobs on edge infrastructure </li> </ul> <h3> Aviation / Logistics </h3> Nimbus Manticore (UNC1549/Imperial Kitten/Smoke Sandstorm/TA455) conducted three MiniFast backdoor waves against US aviation and aerospace between February and April 2026 using SEO poisoning — a novel delivery technique for Iranian APTs, with AI-assisted malware development confirmed. <ul> <li> Immediate: Block known MiniFast C2 infrastructure; deploy browser isolation for employees conducting job-related web searches (SEO poisoning vector) </li> <li> 7-Day: Audit all recently installed browser extensions and downloaded executables from search engine results; scan for MiniFast persistence mechanisms </li> <li> 30-Day: Implement application allowlisting on engineering workstations; conduct awareness training on SEO poisoning threats targeting aviation professionals </li> <li> Monitor for: T1608.006 (SEO Poisoning), T1204.001 (User Execution: Malicious Link), T1547 (Boot or Logon Autostart Execution), connections to Iranian ASN ranges from aviation network segments </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Block all 11 ASN 213790 IPs listed above at perimeter firewall and hunt for historical connections in 30-day logs </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Add Cobalt Strike beacon IP 217.60.241[.]17:443 to blocklist; hunt for JA3 fingerprint matches in TLS inspection logs </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Deploy alerting for Remcos RAT C2 (62.60.226[.]42:43155) and Sliver (45.147.77[.]210:5900) </td> </tr> <tr> <td> 4 </td> <td> OT Security </td> <td> Verify PLC setpoint change alerting is active and functional — the May 25 attack used NO malware; only credential-based manipulation </td> </tr> <tr> <td> 5 </td> <td> IT Ops </td> <td> Confirm ABB ICS advisory patches are in the deployment queue (ICSA-26-146-01 through -06) </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC/CTI </td> <td> Initiate proactive hunt for Pioneer Kitten webshell artifacts across DIB contractor VPN concentrators (10 days quiet — approaching mandatory hunt threshold) </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Deploy Sliver C2 detection signatures — JA3 fingerprints + port 5900 non-VNC protocol detection — to NDR/IDS platforms </td> </tr> <tr> <td> 3 </td> <td> IT Ops </td> <td> Complete ABB AC500 V2, Terra AC, and Zenon patching per CISA advisories </td> </tr> <tr> <td> 4 </td> <td> Security Engineering </td> <td> Audit OAuth token configurations across all CI/CD pipelines; revoke long-lived tokens; implement short-lived credentials </td> </tr> <tr> <td> 5 </td> <td> CTI </td> <td> Verify OSINT feed connectivity — zero returns across 12 queries is anomalous and represents a collection single-point-of-failure </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> CISO </td> <td> Assess European financial sector partner exposure to Iran-conflict spillover; review shared infrastructure with entities on hacktivist target lists </td> </tr> <tr> <td> 2 </td> <td> CISO </td> <td> Commission red team assessment of ICS/OT environments focusing on credential-only attack paths (no malware, valid credentials + PLC manipulation) </td> </tr> <tr> <td> 3 </td> <td> Security Architecture </td> <td> Add secondary OSINT collection source to eliminate single-point-of-failure in intelligence feeds </td> </tr> <tr> <td> 4 </td> <td> IR Team </td> <td> Update incident response playbooks to include "credential-only ICS destruction" scenario — traditional malware forensics will find nothing </td> </tr> <tr> <td> 5 </td> <td> Executive </td> <td> Conduct tabletop exercise simulating coordinated Iranian cyber-kinetic escalation: simultaneous DDoS + ICS manipulation + hacktivist IO campaign </td> </tr> </tbody> </table> <h2> The Bottom Line </h2> The Iran conflict is 88 days old. The ceasefire has not reduced cyber risk — it has formalized the "war between wars" doctrine that keeps operations below the threshold of kinetic response while accumulating offensive capacity. Today's intelligence shows that capacity growing: a Tehran-based ASN hosting an entire ecosystem of offensive tools, three distinct C2 frameworks staged on research infrastructure, and a European central bank publicly acknowledging the conflict's financial contagion. The most dangerous development remains the May 25 credential-only PLC destruction. This technique leaves no malware artifacts, no signatures to detect, no hashes to block. It requires defenders to shift from "find the malware" to "monitor the physics" — watching for process anomalies that indicate unauthorized manipulation of industrial control systems. Your adversaries are patient. MuddyWater (MOIS) has been silent for six months — retooling. Pioneer Kitten's dormant access in DIB networks hasn't been confirmed cleared. HYDRO KITTEN's (IRGC-CEC) operational pause likely precedes their next campaign announcement. Don't wait for the next wiper. Hunt now. Anomali CTI Desk | 2026-05-27 | TLP:GREEN Intelligence sources: ThreatStream Next-Gen, CISA ICS-CERT, Reuters/ECB, open-source collection

FEATURED RESOURCES

July 10, 2026

Anomali Cyber Watch

Iranian Cyber Operations Reach Inflection Point: FortiBleed Pipeline Weaponized, Multi-Actor Convergence Accelerates

July 10, 2026

Anomali Cyber Watch

Public Sector

Critical ColdFusion Vulnerability, New Phishing-as-a-Service Platform, and Russian Infrastructure Refresh Demand Immediate State Government Action

July 8, 2026

Anomali Cyber Watch

Public Sector

Critical Vulnerabilities and Novel Attack Techniques Threaten State Government Networks

Explore All