Iranian Cyber Operations Expand Multi-Tool Staging Infrastructure as Conflict Enters Fourth Month

Anomali Threat Research

Published on

May 27, 2026

Table of Contents

Threat Assessment Level: ELEVATED Nearly three months into the Iran-Israel conflict (Day 88 since February 28, 2026), Iranian state-affiliated cyber operations continue to expand offensive infrastructure capacity despite the nominal ceasefire declared on April 8. Today's intelligence reveals a troubling convergence: multiple offensive frameworks, APT-attributed infrastructure, and botnet command-and-control servers are consolidating on a single Tehran-based network — while a European Central Bank warning signals that the conflict's economic shockwaves are now reaching European policymakers. For CISOs, the message is clear: the ceasefire has not reduced cyber risk. It has shifted it below the threshold of kinetic conflict, exactly where Iranian doctrine says it should operate. <h2> What Changed </h2> Since our last assessment (2026-05-26): <ul> <li> ASN 213790 ("Limited Network," Tehran) confirmed as multi-actor staging ground — now hosting APT28-attributed IPs, Mirai botnet C2, Cactus ransomware infrastructure, AND Iranian SOCKS4 proxy relays on the same network block. This is no longer a single-actor concern; it's an operational ecosystem. </li> <li> Three offensive frameworks confirmed co-located on Iranian research infrastructure — Cobalt Strike, Remcos RAT, and Sliver C2 are simultaneously active on Iranian academic/research ISPs, suggesting either a bulletproof hosting service or a sophisticated operator maintaining tool diversity. </li> <li> ECB publicly warned that the Iran war is "amplifying Europe's financial vulnerabilities" — a geopolitical escalation signal that may expand pro-Iran hacktivist targeting from Israel/US to European financial institutions. </li> <li> Seven new ICS advisories from CISA covering ABB AC500 V2, Terra AC, Zenon, and other industrial systems — expanding the attack surface relevant to Iranian ICS/OT targeting capabilities. </li> <li> Defense Industrial Base (DIB) pre-positioning intelligence has been quiet for 10 consecutive days — approaching the threshold for mandatory proactive hunting. Absence is not safety. </li> <li> MuddyWater (MOIS) remains operationally silent since December 2025 — now approaching six months of quiet, consistent with a wartime retooling cycle. When they resurface, expect evolved TTPs that bypass current detection signatures. </li> <li> Nimbus Manticore (UNC1549) conducted three MiniFast backdoor waves against US aviation and aerospace between February and April 2026 via SEO poisoning — a novel delivery technique for Iranian APTs, with AI-assisted malware development confirmed. </li> <li> Threat level remains ELEVATED (unchanged from Day 87). No de-escalation signals detected. Infrastructure expansion continues to accumulate offensive capacity. </li> </ul> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 2026-02-28 </td> <td> Iran-Israel conflict escalation begins </td> <td> Day 0 — cyber operations surge </td> </tr> <tr> <td> 2026-03-13 </td> <td> Stryker wiper attack (Void Manticore/Handala) </td> <td> 20+ defense-sector systems destroyed </td> </tr> <tr> <td> 2026-02 – 2026-04 </td> <td> Three MiniFast backdoor waves (Nimbus Manticore/UNC1549) </td> <td> US aviation/aerospace targeted via SEO poisoning — first for Iranian APTs </td> </tr> <tr> <td> 2026-04-08 </td> <td> Nominal ceasefire declared </td> <td> Cyber operations intensify rather than decrease </td> </tr> <tr> <td> 2026-05-25 </td> <td> IRGC-directed PLC manipulation at food plant </td> <td> Three compressors destroyed using valid credentials alone — no malware </td> </tr> <tr> <td> 2026-05-26 </td> <td> CISA publishes 7 ICS advisories (ABB products) </td> <td> Expanded ICS/OT attack surface </td> </tr> <tr> <td> 2026-05-27 </td> <td> ASN 213790 multi-actor convergence confirmed </td> <td> APT28, Mirai, Cactus ransomware, SOCKS4 proxies on single Tehran ASN </td> </tr> <tr> <td> 2026-05-27 </td> <td> ECB warns of Iran-war financial contagion to Europe </td> <td> Potential expansion of hacktivist target aperture </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. ASN 213790: A Multi-Actor Staging Ecosystem </h3> A single Tehran-based autonomous system — ASN 213790, operated by "Limited Network" — has become the most significant convergence point for Iranian-nexus offensive infrastructure we track. In a single network block, we now observe: <ul> <li> SOCKS4 proxy relays (ports 9734, 10088, 10693, 10694) providing anonymization for outbound operations </li> <li> APT28-attributed command-and-control using non-standard ports with T1059 (Command and Scripting Interpreter) and T1071 (Application Layer Protocol) techniques </li> <li> Mirai botnet HTTP loader (confidence 100) for DDoS amplification </li> <li> Cactus ransomware staging (confidence 96) </li> </ul> This density of multi-actor tooling on a single network is operationally unsustainable without eventual exposure — but until that exposure occurs, any new indicator on ASN 213790 should be treated as high-priority regardless of initial classification. <h3> 2. Multi-Framework C2 on Iranian Research Infrastructure </h3> Three distinct post-exploitation frameworks are simultaneously active on Iranian academic and research ISPs: <table> <thead> <tr> <th> Framework </th> <th> IP </th> <th> Port </th> <th> Active Since </th> <th> Hosting </th> </tr> </thead> <tbody> <tr> <td> Cobalt Strike BEACON </td> <td> 217.60.241.17 </td> <td> 443 </td> <td> Recent </td> <td> Pfcloud UG (ASN 51396) </td> </tr> <tr> <td> Remcos RAT </td> <td> 62.60.226.42 </td> <td> 43155 </td> <td> Feb 2025 (15+ months) </td> <td> Iranian Research Org for Science & Technology </td> </tr> <tr> <td> Sliver </td> <td> 45.147.77.210 </td> <td> 5900 </td> <td> Sep 2025 </td> <td> Gostaresh Pardazesh Dana Negar (ASN 51889) </td> </tr> </tbody> </table> The Remcos RAT instance has maintained persistence for over 15 months — an extraordinary dwell time that suggests either domestic surveillance operations or a long-term staging platform for outbound campaigns. The addition of Sliver (an increasingly popular open-source alternative to Cobalt Strike) complicates detection: no single signature or behavioral rule catches all three frameworks. <h3> 3. ICS/OT Attack Surface Expansion </h3> CISA's batch of seven ICS advisories (ICSA-26-146-01 through -06 plus one additional) covering ABB AC500 V2 PLCs, Terra AC wallboxes, Zenon Remote Transport, and Eppendorf BioFlo 320 bioreactors arrives in a context where: <ul> <li> On May 25, IRGC-directed operators destroyed physical infrastructure (food plant compressors) by manipulating PLC setpoints using valid credentials alone — no malware deployed </li> <li> HYDRO KITTEN (IRGC-CEC) / Cyber Av3ngers have demonstrated willingness to target water, energy, and food production ICS </li> <li> ABB PLCs share architectural similarities with previously targeted Rockwell systems </li> </ul> The credential-only destruction technique (T0831 — Manipulation of Control) renders traditional malware-based detection irrelevant for ICS environments. <h3> 4. MuddyWater (MOIS) Operational Silence </h3> MuddyWater (also tracked as UNC5667, TEMP.Zagros, Static Kitten), affiliated with Iran's Ministry of Intelligence and Security (MOIS), has been operationally silent since December 2025 — now approaching six months. Their Anomali ThreatStream Next-Gen profile was updated on 2026-05-27, but no associated IOCs or campaigns surfaced. This silence, coinciding with Iran's domestic internet shutdown, strongly indicates wartime retooling. When MuddyWater resurfaces, expect evolved TTPs that bypass current detection signatures. <h3> 5. European Financial Sector Enters the Target Aperture </h3> The ECB's public warning that the Iran war is amplifying European financial vulnerabilities is a leading indicator. Historically, pro-Iran hacktivist groups (Cyber Toufan, Handala) have expanded targeting when geopolitical narratives provide justification. European banks, payment processors, and financial market infrastructure should anticipate: <ul> <li> DDoS campaigns (T1498) against public-facing services </li> <li> Defacement operations (T1491.002) for propaganda value </li> <li> Potential credential harvesting campaigns against financial sector employees </li> </ul> <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> HYDRO KITTEN/Cyber Av3ngers resume public claims </td> <td> 60% </td> <td> Within 5 days </td> <td> Operational silence typically precedes new campaign announcements </td> </tr> <tr> <td> ASN 213790 infrastructure linked to named campaign </td> <td> 40% </td> <td> Within 2 weeks </td> <td> Multi-actor tool density is unsustainable without operational exposure </td> </tr> <tr> <td> New Iranian exploitation of internet-facing assets </td> <td> 25% </td> <td> Within 7 days </td> <td> Expected once intelligence collection feeds recover from weekend gap </td> </tr> <tr> <td> Pro-Iran hacktivists expand targeting to European financial institutions </td> <td> 35% </td> <td> Within 30 days </td> <td> ECB warning provides narrative justification; conflict spillover pattern </td> </tr> <tr> <td> MuddyWater resurfaces with evolved tooling </td> <td> 30% </td> <td> Within 60 days </td> <td> Six months of silence = retooling cycle consistent with prior patterns </td> </tr> <tr> <td> Dormant Iranian access in DIB networks activates </td> <td> 20% </td> <td> Escalation-dependent </td> <td> Pioneer Kitten/UNC6446 historical pattern of pre-positioned webshells </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> Hunt Hypothesis 1: ASN 213790 Communications <ul> <li> What to look for: Any outbound connections to the 192.253.248.0/24 and 206.123.156.0/24 ranges </li> <li> ATT&CK techniques: T1090.002 (External Proxy), T1071 (Application Layer Protocol), T1571 (Non-Standard Port) </li> <li> Detection logic: Alert on connections to ports 9734, 10088, 10693, 10694 (SOCKS4 proxy) and any traffic to 192.253.248[.]169, 192.253.248[.]52, 192.253.248[.]55, 185.93.89[.]43 </li> <li> Investigation: If hits found, correlate with authentication logs — Iranian operators increasingly use valid credentials (T1078) </li> </ul> Hunt Hypothesis 2: Cobalt Strike BEACON on Port 443 <ul> <li> What to look for: HTTPS connections to 217.60.241[.]17 with Cobalt Strike JA3/JA3S fingerprints </li> <li> ATT&CK techniques: T1071.001 (Web Protocols), T1573.001 (Encrypted Channel), T1105 (Ingress Tool Transfer) </li> <li> Detection logic: Review 30 days of firewall/proxy logs for any historical connection to this IP; deploy CS malleable C2 profile detection on NDR platforms </li> <li> Investigation: If beacon detected, assume full compromise — Cobalt Strike enables lateral movement within minutes </li> </ul> Hunt Hypothesis 3: Sliver Framework Masquerading <ul> <li> What to look for: Traffic to 45.147.77[.]210 on port 5900 (VNC port masquerading) </li> <li> ATT&CK techniques: T1219 (Remote Access Software), T1571 (Non-Standard Port), T1071.001 (Web Protocols) </li> <li> Detection logic: Port 5900 traffic that does NOT match VNC protocol headers = likely Sliver C2; deploy Sliver-specific JA3 fingerprints to NDR/IDS </li> <li> Investigation: Cross-reference with any Remcos RAT indicators — operators may maintain multiple implants </li> </ul> Hunt Hypothesis 4: ICS/OT Credential-Based Manipulation <ul> <li> What to look for: Anomalous PLC setpoint changes, especially outside maintenance windows, using valid engineering workstation credentials </li> <li> ATT&CK techniques (ICS): T0831 (Manipulation of Control), T0859 (Valid Accounts), T0821 (Modify Controller Tasking) </li> <li> Detection logic: This attack uses NO malware — monitor for setpoint changes exceeding normal operational parameters; alert on engineering workstation logins from unexpected source IPs </li> <li> Investigation: Correlate with physical process anomalies (pressure, temperature, flow rate deviations) </li> </ul> <h3> Blocking Recommendations </h3> Add the following to network IOC blocklists immediately: <table> <thead> <tr> <th> Type </th> <th> Indicator </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 192.253.248[.]169 </td> <td> Mirai C2, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]52 </td> <td> APT28-attributed, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]55 </td> <td> APT28-attributed, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 185.93.89[.]43 </td> <td> Cactus ransomware, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 217.60.241[.]17 </td> <td> Cobalt Strike BEACON </td> </tr> <tr> <td> IPv4 </td> <td> 62.60.226[.]42 </td> <td> Remcos RAT C2 (15+ months active) </td> </tr> <tr> <td> IPv4 </td> <td> 45.147.77[.]210 </td> <td> Sliver C2 </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]220 </td> <td> SOCKS4 proxy, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]230 </td> <td> SOCKS4 proxy, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]231 </td> <td> SOCKS4 proxy, ASN 213790 </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]238 </td> <td> SOCKS4 proxy, ASN 213790 </td> </tr> </tbody> </table> Additional IOCs available via ThreatStream Next-Gen <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> The ECB's Iran-war financial contagion warning elevates this sector's risk profile. Pro-Iran hacktivists have historically targeted financial institutions for propaganda value during escalation periods. <ul> <li> Immediate: Increase DDoS mitigation readiness for public-facing banking portals and payment APIs; pre-stage scrubbing center capacity </li> <li> 7-Day: Review OAuth token lifecycle management — supply chain compromises have demonstrated that OAuth abuse enables persistent access to CI/CD pipelines used by fintech partners; audit long-lived tokens and enforce short-lived credential policies </li> <li> 30-Day: Conduct tabletop exercise simulating coordinated hacktivist DDoS + credential harvesting campaign against customer-facing systems </li> <li> Monitor for: T1498 (Network DoS), T1491.002 (External Defacement), T1078 (Valid Accounts via credential stuffing) </li> </ul> <h3> Energy </h3> Iranian ICS/OT capabilities have escalated to physical destruction without malware. The May 25 food plant compressor attack demonstrates that valid credentials + PLC access = kinetic damage. <ul> <li> Immediate: Audit all engineering workstation access credentials; enforce MFA on all HMI/SCADA login paths; verify PLC setpoint change alerting is functional </li> <li> 7-Day: Patch ABB AC500 V2 and Terra AC systems per CISA ICSA-26-146 advisories; segment OT networks to prevent IT-to-OT lateral movement </li> <li> 30-Day: Deploy OT-specific anomaly detection (e.g., Claroty, Dragos, Nozomi) focused on setpoint manipulation rather than malware signatures </li> <li> Monitor for: T0831 (Manipulation of Control), T0859 (Valid Accounts in ICS), T0821 (Modify Controller Tasking), anomalous process variable deviations </li> </ul> <h3> Healthcare </h3> Eppendorf BioFlo 320 bioreactor advisory (CISA) directly impacts pharmaceutical manufacturing and research facilities. Iranian actors have not historically targeted healthcare, but the credential-only attack model lowers the barrier. <ul> <li> Immediate: Identify all BioFlo 320 deployments and apply vendor patches; isolate bioreactor control systems from general IT networks </li> <li> 7-Day: Audit remote access to laboratory automation systems; disable default credentials on all bioprocess controllers </li> <li> 30-Day: Establish baseline process parameters for critical bioreactors to enable anomaly detection of unauthorized setpoint changes </li> <li> Monitor for: T1190 (Exploit Public-Facing Application), unauthorized remote access to lab automation, process deviations in fermentation/cell culture parameters </li> </ul> <h3> Government / Defense Industrial Base </h3> PIR-007 (DIB pre-positioning) has been quiet for 10 consecutive days. Historical precedent shows Iranian actors (Pioneer Kitten/UNC6446) maintain dormant access for months before activation during kinetic escalation windows. <ul> <li> Immediate: Review VPN concentrator logs for webshell indicators (DVSL.aspx patterns, CVE-2024-3400 exploitation remnants); check for unauthorized SSH keys on edge devices </li> <li> 7-Day: Commission proactive threat hunt across DIB contractor networks focusing on Cisco ASA/FTD, Ivanti EPMM, Fortinet, and PAN-OS devices — all historically targeted by Iranian actors </li> <li> 30-Day: Implement zero-trust network segmentation for contractor access; require continuous authentication for privileged sessions </li> <li> Monitor for: T1133 (External Remote Services), T1505.003 (Web Shell), T1078 (Valid Accounts), dormant scheduled tasks or cron jobs on edge infrastructure </li> </ul> <h3> Aviation / Logistics </h3> Nimbus Manticore (UNC1549/Imperial Kitten/Smoke Sandstorm/TA455) conducted three MiniFast backdoor waves against US aviation and aerospace between February and April 2026 using SEO poisoning — a novel delivery technique for Iranian APTs, with AI-assisted malware development confirmed. <ul> <li> Immediate: Block known MiniFast C2 infrastructure; deploy browser isolation for employees conducting job-related web searches (SEO poisoning vector) </li> <li> 7-Day: Audit all recently installed browser extensions and downloaded executables from search engine results; scan for MiniFast persistence mechanisms </li> <li> 30-Day: Implement application allowlisting on engineering workstations; conduct awareness training on SEO poisoning threats targeting aviation professionals </li> <li> Monitor for: T1608.006 (SEO Poisoning), T1204.001 (User Execution: Malicious Link), T1547 (Boot or Logon Autostart Execution), connections to Iranian ASN ranges from aviation network segments </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Block all 11 ASN 213790 IPs listed above at perimeter firewall and hunt for historical connections in 30-day logs </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Add Cobalt Strike beacon IP 217.60.241[.]17:443 to blocklist; hunt for JA3 fingerprint matches in TLS inspection logs </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Deploy alerting for Remcos RAT C2 (62.60.226[.]42:43155) and Sliver (45.147.77[.]210:5900) </td> </tr> <tr> <td> 4 </td> <td> OT Security </td> <td> Verify PLC setpoint change alerting is active and functional — the May 25 attack used NO malware; only credential-based manipulation </td> </tr> <tr> <td> 5 </td> <td> IT Ops </td> <td> Confirm ABB ICS advisory patches are in the deployment queue (ICSA-26-146-01 through -06) </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC/CTI </td> <td> Initiate proactive hunt for Pioneer Kitten webshell artifacts across DIB contractor VPN concentrators (10 days quiet — approaching mandatory hunt threshold) </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Deploy Sliver C2 detection signatures — JA3 fingerprints + port 5900 non-VNC protocol detection — to NDR/IDS platforms </td> </tr> <tr> <td> 3 </td> <td> IT Ops </td> <td> Complete ABB AC500 V2, Terra AC, and Zenon patching per CISA advisories </td> </tr> <tr> <td> 4 </td> <td> Security Engineering </td> <td> Audit OAuth token configurations across all CI/CD pipelines; revoke long-lived tokens; implement short-lived credentials </td> </tr> <tr> <td> 5 </td> <td> CTI </td> <td> Verify OSINT feed connectivity — zero returns across 12 queries is anomalous and represents a collection single-point-of-failure </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> CISO </td> <td> Assess European financial sector partner exposure to Iran-conflict spillover; review shared infrastructure with entities on hacktivist target lists </td> </tr> <tr> <td> 2 </td> <td> CISO </td> <td> Commission red team assessment of ICS/OT environments focusing on credential-only attack paths (no malware, valid credentials + PLC manipulation) </td> </tr> <tr> <td> 3 </td> <td> Security Architecture </td> <td> Add secondary OSINT collection source to eliminate single-point-of-failure in intelligence feeds </td> </tr> <tr> <td> 4 </td> <td> IR Team </td> <td> Update incident response playbooks to include "credential-only ICS destruction" scenario — traditional malware forensics will find nothing </td> </tr> <tr> <td> 5 </td> <td> Executive </td> <td> Conduct tabletop exercise simulating coordinated Iranian cyber-kinetic escalation: simultaneous DDoS + ICS manipulation + hacktivist IO campaign </td> </tr> </tbody> </table> <h2> The Bottom Line </h2> The Iran conflict is 88 days old. The ceasefire has not reduced cyber risk — it has formalized the "war between wars" doctrine that keeps operations below the threshold of kinetic response while accumulating offensive capacity. Today's intelligence shows that capacity growing: a Tehran-based ASN hosting an entire ecosystem of offensive tools, three distinct C2 frameworks staged on research infrastructure, and a European central bank publicly acknowledging the conflict's financial contagion. The most dangerous development remains the May 25 credential-only PLC destruction. This technique leaves no malware artifacts, no signatures to detect, no hashes to block. It requires defenders to shift from "find the malware" to "monitor the physics" — watching for process anomalies that indicate unauthorized manipulation of industrial control systems. Your adversaries are patient. MuddyWater (MOIS) has been silent for six months — retooling. Pioneer Kitten's dormant access in DIB networks hasn't been confirmed cleared. HYDRO KITTEN's (IRGC-CEC) operational pause likely precedes their next campaign announcement. Don't wait for the next wiper. Hunt now. Anomali CTI Desk | 2026-05-27 | TLP:GREEN Intelligence sources: ThreatStream Next-Gen, CISA ICS-CERT, Reuters/ECB, open-source collection

FEATURED RESOURCES

May 27, 2026

Anomali Cyber Watch