Iranian Cyber Operations Intensify: New Backdoor, Ransomware Pipelines, and the Silence Before the Storm

Anomali Threat Research

Published on

July 13, 2026

Table of Contents

Threat Assessment Level: HIGH The Iran-West cyber confrontation — now in its 135th day since the February 28 escalation — continues to produce new capabilities, confirmed operational pipelines, and ominous silences that demand executive attention. This week's intelligence cycle surfaced a previously unreported Iranian-linked backdoor targeting the United States, confirmed the operational merger between mass credential theft and ransomware deployment affecting 430,000 firewalls, and documented the continued expansion of Iranian command-and-control infrastructure. Meanwhile, the extended silence from Iran's most destructive hacktivist proxies matches historical patterns observed before major wiper deployments. CISOs overseeing critical infrastructure, defense industrial base contractors, and enterprises running FortiGate, Adobe ColdFusion, or Schneider Electric OT systems should treat this as an action-forcing moment. <h2> What Changed This Week </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> Jul 7, 2026 </td> <td> U.S. strikes on Iran open active retaliation window </td> <td> Kinetic trigger for cyber escalation </td> </tr> <tr> <td> Jul 7, 2026 </td> <td> CVE-2026-48282 (Adobe ColdFusion, CVSS 10.0) added to CISA KEV </td> <td> Pre-auth RCE, actively exploited, no user interaction </td> </tr> <tr> <td> Jul 8, 2026 </td> <td> DHS HSIN intrusion disclosed — moderate-confidence Iranian attribution </td> <td> Government network compromise </td> </tr> <tr> <td> Jul 9, 2026 </td> <td> Iranian GitHub resume lure campaign updated — targeting aerospace/DIB </td> <td> Social engineering evolution for pre-positioning </td> </tr> <tr> <td> Jul 9, 2026 </td> <td> CISA ICS advisories: Schneider Electric Easergy MiCOM Px40 + OpenPLC v3 </td> <td> Grid protection relays and PLC platforms vulnerable </td> </tr> <tr> <td> Jul 10, 2026 </td> <td> CVE-2026-48282 exploitation confirmed in the wild </td> <td> ColdFusion under active attack </td> </tr> <tr> <td> Jul 12, 2026 </td> <td> New Stealc infostealer C2 on Tehran ASN; "Agentemis" Cobalt Strike beacons persist </td> <td> Iranian offensive infrastructure expanding </td> </tr> <tr> <td> Jul 13, 2026 </td> <td> "Salgorea" backdoor discovered — new Iranian-linked malware, US-targeting </td> <td> Novel capability with no prior public reporting </td> </tr> <tr> <td> Jul 13, 2026 </td> <td> Progress ShareFile emergency server shutdown — potential zero-day </td> <td> File transfer appliance threat (MOVEit precedent) </td> </tr> <tr> <td> Jul 2–3, 2026 </td> <td> FortiBleed → INC/Lynx ransomware pipeline confirmed by 4 independent sources </td> <td> 430,000 firewalls compromised; credential-to-ransomware chain validated </td> </tr> <tr> <td> Ongoing </td> <td> Banished Kitten / Handala operationally silent during peak escalation </td> <td> Absence matches pre-wiper preparation patterns; assessed as pre-operational pause </td> </tr> </tbody> </table> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Phase </th> <th> Timeframe </th> <th> Cyber Activity </th> </tr> </thead> <tbody> <tr> <td> Pre-escalation </td> <td> Before Feb 28 </td> <td> Baseline Iranian espionage (APT34, MuddyWater, Pioneer Kitten) </td> </tr> <tr> <td> Initial escalation </td> <td> Feb 28 – Mar 2026 </td> <td> Stryker wiper deployment by Handala/Banished Kitten </td> </tr> <tr> <td> Sustained operations </td> <td> Apr – Jun 2026 </td> <td> Infrastructure build-out, credential harvesting, ICS reconnaissance </td> </tr> <tr> <td> Active retaliation window </td> <td> Jul 7 – present </td> <td> U.S. strikes trigger acceleration: new malware, C2 expansion, ransomware pipeline activation </td> </tr> <tr> <td> Current (Day 135) </td> <td> Jul 13, 2026 </td> <td> Novel backdoor (Salgorea), confirmed ransomware pipelines, proxy silence </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Salgorea: A Previously Unknown Iranian-Linked Backdoor </h3> A new malware family designated "Salgorea" was identified on July 13 with no prior public reporting from any vendor or research team. This PE32 backdoor targets the United States and employs T1614.001 (System Language Discovery) — a technique Iranian actors commonly use to avoid executing on Persian-language systems, ensuring the malware only activates on intended Western targets. With 14 out of 18 antivirus engines detecting it and a unique import hash, Salgorea represents fresh tooling investment by Iranian operators. Its discovery before any public disclosure demonstrates that adversaries are actively developing new capabilities during this escalation window. Why it matters: Novel malware families indicate that Iranian actors are not relying solely on known tools. They are investing in capabilities designed to evade detection signatures built around previously catalogued families like Shamoon, ZeroCleare, or IOCONTROL. <h3> 2. FortiBleed → Ransomware: The Pipeline Is Real </h3> Four independent sources have now confirmed what was previously assessed as probable: operators exploiting the FortiBleed vulnerability are directly feeding stolen credentials to INC Ransom and Lynx ransomware groups. One operator was observed logged into both INC and Lynx negotiation panels using FortiBleed-sourced infrastructure. The scale is staggering: 430,000 FortiGate firewalls compromised and 110 million credentials stolen . This creates a dual-use threat where Iranian access brokers — particularly Pioneer Kitten (IRGC-affiliated) — can simultaneously serve state espionage objectives and monetize access through criminal ransomware partnerships. Why it matters: Your FortiGate VPN credentials may already be in an adversary's hands. The time between credential theft and ransomware deployment is compressing. Organizations that haven't rotated credentials are operating on borrowed time. <h3> 3. The Iranian Actor Ecosystem: Four Groups, One Kill Chain </h3> Intelligence continues to validate a coordinated espionage-to-destruction handoff chain across four formally attributed Iranian threat actors: <table> <thead> <tr> <th> Actor </th> <th> Affiliation </th> <th> Role in Kill Chain </th> <th> Current Status </th> </tr> </thead> <tbody> <tr> <td> Pioneer Kitten (Fox Kitten, UNC757) </td> <td> IRGC </td> <td> Initial access brokering via VPN exploitation </td> <td> Active — FortiBleed pipeline confirmed </td> </tr> <tr> <td> Banished Kitten / Handala </td> <td> IRGC </td> <td> Destructive operations, wiper deployment </td> <td> Silent — assessed as pre-operational pause </td> </tr> <tr> <td> APT34 / OilRig </td> <td> MOIS </td> <td> Espionage, credential harvesting, lateral movement </td> <td> Active — updated Jul 12 </td> </tr> <tr> <td> MuddyWater / TEMP.Zagros </td> <td> MOIS </td> <td> Spearphishing, backdoor deployment, telecom targeting </td> <td> Active — updated Jul 12 </td> </tr> </tbody> </table> Additional actors of note: UNC1860 (updated Jul 11), UNC6085 , and UNC5187 all show recent activity updates. <h3> 4. Agentemis Cobalt Strike Infrastructure: Persistent and Growing </h3> Four command-and-control IPs on ASN 138415 bearing the "Agentemis" operator signature remain active as of July 13, all communicating on port 29541. These Cobalt Strike BEACON servers have persisted across multiple intelligence cycles, indicating established operational infrastructure rather than ephemeral testing. The co-location of Stealc infostealers, Remcos RAT, and Cobalt Strike beacons on overlapping Iranian ISP infrastructure suggests a shared operational environment — potentially a cyber operations unit maintaining multiple capability sets for different mission types. <h3> 5. CVE-2026-48282: Adobe ColdFusion CVSS 10.0 — Actively Exploited </h3> This maximum-severity vulnerability (pre-authentication remote code execution via path traversal) affects ColdFusion 2025.9 and 2023.20 and earlier. It requires no user interaction, has changed scope, and is confirmed exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on July 7. Iranian actors have historically exploited ColdFusion vulnerabilities for initial access. Any unpatched instance is an open door. <h3> 6. ICS/OT: Schneider Electric and OpenPLC Under the Microscope </h3> Two ICS advisories published July 9 directly align with known Iranian targeting profiles: <ul> <li> Schneider Electric Easergy MiCOM Px40 : Protection relays used in electrical grid substations — the exact equipment Cyber Av3ngers has previously targeted </li> <li> OpenPLC v3 : Authenticated file write leading to privilege escalation on programmable logic controllers </li> </ul> While no confirmed Iranian exploitation of these specific vulnerabilities has been observed, the alignment with known adversary interests (IOCONTROL campaign, Cyber Av3ngers' water/energy targeting) makes these high-priority for OT defenders. <h3> 7. GitHub Resume Lures: Social Engineering the Defense Industrial Base </h3> An Iranian espionage campaign using fake resume and portfolio lures hosted on GitHub continues to evolve, with updates as recent as July 9. The campaign targets aerospace and defense industrial base personnel — consistent with Pioneer Kitten's documented role as an access broker for Iranian intelligence services. A related campaign uses "GitHub-Resilient Implants" against government and telecom targets in the Middle East. The use of GitHub as a delivery platform exploits trust relationships — security tools are less likely to block downloads from github.com. <h3> 8. The Silence of Handala: Absence as Signal </h3> Banished Kitten / Handala — the IRGC-affiliated group responsible for the March 2026 Stryker wiper attack — has been operationally silent for an extended period during peak escalation. This pattern matches pre-deployment behavior observed before previous destructive operations. Assessment: This is not cessation. It is preparation. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Indicators to Watch </th> </tr> </thead> <tbody> <tr> <td> Salgorea publicly reported by a vendor with additional samples/C2 </td> <td> 70% </td> <td> 14 days </td> <td> Vendor blog posts, new VirusTotal submissions </td> </tr> <tr> <td> Handala resurfaces with new persona or campaign targeting Israeli/US infrastructure </td> <td> 60% </td> <td> 14–30 days </td> <td> New Telegram channels, infrastructure overlap with known Handala IOCs </td> </tr> <tr> <td> Destructive wiper operation by Handala/Banished Kitten </td> <td> 60% </td> <td> 30 days </td> <td> Pre-wiper reconnaissance, credential harvesting spikes </td> </tr> <tr> <td> FortiBleed credentials used in high-profile ransomware incident against critical infrastructure </td> <td> 50% </td> <td> 14 days </td> <td> INC/Lynx victim announcements, CI sector targeting </td> </tr> <tr> <td> Progress ShareFile vulnerability receives CVE and KEV addition </td> <td> 40% </td> <td> 7 days </td> <td> CVE assignment, CISA advisory </td> </tr> <tr> <td> Iranian exploitation of Schneider Easergy or OpenPLC vulnerabilities </td> <td> 30% </td> <td> 30 days </td> <td> ICS-CERT incident reports, Cyber Av3ngers claims </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> Hunt for Agentemis C2 Communications <ul> <li> Monitor for outbound connections to port 29541 on the four identified C2 IPs </li> <li> ATT&CK: T1071.001 (Web Protocols), T1573.002 (Asymmetric Cryptography), T1105 (Ingress Tool Transfer) </li> <li> Hunting hypothesis: "Are any internal hosts communicating with ASN 138415 infrastructure on non-standard ports?" </li> <li> Detection: Firewall logs, netflow data, DNS resolution attempts for these IPs </li> </ul> Hunt for Salgorea Backdoor <ul> <li> Search EDR telemetry for imphash 6dca3e9fb3928bbdb54dbce669943ec8 </li> <li> Search for SHA-256: 5338ea423aff0dd6e383c695788e9b1842b2a185ab345c118d2f5480e4dbd522 </li> <li> ATT&CK: T1614.001 (System Language Discovery) — alert on processes querying system locale/language settings before execution </li> <li> Hunting hypothesis: "Are there PE32 executables in our environment that check system language before executing their primary payload?" </li> </ul> Hunt for FortiBleed Credential Abuse <ul> <li> ATT&CK: T1078 (Valid Accounts), T1133 (External Remote Services) </li> <li> Monitor for VPN authentications from unusual geolocations or at unusual times using credentials associated with FortiGate infrastructure </li> <li> Hunting hypothesis: "Have any VPN accounts authenticated from new ASNs or countries in the past 30 days?" </li> <li> Check for passive sniffer implants on FortiGate devices (memory forensics) </li> </ul> Hunt for ColdFusion Exploitation (CVE-2026-48282) <ul> <li> ATT&CK: T1190 (Exploit Public-Facing Application), T1083 (File and Directory Discovery) </li> <li> Monitor ColdFusion access logs for path traversal patterns (../ sequences, encoded variants) </li> <li> Hunting hypothesis: "Are there ColdFusion instances in our environment that are unpatched and internet-facing?" </li> </ul> Hunt for GitHub-Based Social Engineering <ul> <li> ATT&CK: T1566.002 (Spearphishing Link), T1204.001 (Malicious Link) </li> <li> Monitor email gateway for messages containing github.com links with /resume, /portfolio, /cv path patterns delivering executables (.exe, .scr, .msi) </li> <li> Hunting hypothesis: "Have aerospace/engineering personnel received emails with GitHub links to downloadable executables in the past 30 days?" </li> </ul> <h3> Detection Rules to Deploy </h3> <table> <thead> <tr> <th> Rule </th> <th> ATT&CK </th> <th> Data Source </th> <th> Priority </th> </tr> </thead> <tbody> <tr> <td> Outbound to 23.226.58[.]116, 43.240.239[.]234, 43.240.239[.]254, 23.226.58[.]106 on port 29541 </td> <td> T1071.001 </td> <td> Firewall/Netflow </td> <td> CRITICAL </td> </tr> <tr> <td> PE32 with imphash 6dca3e9fb3928bbdb54dbce669943ec8 </td> <td> T1614.001 </td> <td> EDR </td> <td> CRITICAL </td> </tr> <tr> <td> ColdFusion path traversal in URI </td> <td> T1190 </td> <td> WAF/Web logs </td> <td> HIGH </td> </tr> <tr> <td> VPN auth from new ASN + credential age > 90 days </td> <td> T1078 </td> <td> VPN/IAM </td> <td> HIGH </td> </tr> <tr> <td> GitHub .exe/.scr download via email link </td> <td> T1566.002 </td> <td> Email gateway </td> <td> MEDIUM </td> </tr> <tr> <td> System language enumeration before payload execution </td> <td> T1614.001 </td> <td> EDR/Sysmon </td> <td> MEDIUM </td> </tr> </tbody> </table> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> Primary threats: FortiBleed credential abuse for unauthorized access; ransomware deployment via INC/Lynx; Cobalt Strike BEACON for lateral movement to payment systems. Actions: <ul> <li> Immediately audit and rotate all FortiGate VPN credentials; enforce MFA on all remote access </li> <li> Deploy behavioral analytics for anomalous transaction system access following VPN authentication </li> <li> Ensure SWIFT/payment infrastructure is segmented from general VPN-accessible networks </li> <li> Monitor for Cobalt Strike BEACON indicators (port 29541, Agentemis watermark) in network telemetry </li> </ul> <h3> Energy </h3> Primary threats: Schneider Electric Easergy MiCOM Px40 vulnerabilities in grid protection relays; OpenPLC exploitation for OT access; Iranian ICS targeting (Cyber Av3ngers, IOCONTROL precedent). Actions: <ul> <li> Inventory all Schneider Easergy MiCOM Px40 deployments in substations; apply CSAF icsa-26-190-03 mitigations </li> <li> Audit OpenPLC v3 instances for unauthorized file writes; restrict authenticated access to known maintenance accounts only </li> <li> Ensure IT/OT segmentation prevents lateral movement from compromised ColdFusion/FortiGate systems to SCADA networks </li> <li> Establish out-of-band monitoring for protection relay configuration changes </li> </ul> <h3> Healthcare </h3> Primary threats: Ransomware via FortiBleed pipeline (INC/Lynx); ColdFusion exploitation of patient portal systems; credential theft enabling PHI exfiltration. Actions: <ul> <li> Prioritize ColdFusion patching for patient-facing portals (CVE-2026-48282 requires no user interaction) </li> <li> Validate backup integrity and test restoration procedures — ransomware deployment probability is elevated </li> <li> Audit FortiGate VPN credentials used by remote clinicians and third-party vendors </li> <li> Monitor for data staging (T1074) in systems adjacent to EHR databases </li> </ul> <h3> Government </h3> Primary threats: Iranian espionage operations (APT34, MuddyWater); DHS HSIN intrusion precedent; Salgorea backdoor targeting US government systems; GitHub social engineering of cleared personnel. Actions: <ul> <li> Deploy Salgorea indicators across all endpoint detection platforms immediately </li> <li> Brief cleared personnel on GitHub-based social engineering lures — particularly those in aerospace and defense roles </li> <li> Audit ColdFusion deployments in .gov environments (historically prevalent in government web applications) </li> <li> Review authentication logs for indicators of credential reuse from previously compromised FortiGate infrastructure </li> <li> Monitor for T1614.001 (language check) as a behavioral indicator of Iranian-origin malware </li> </ul> <h3> Aviation / Logistics </h3> Primary threats: GitHub resume lure campaign specifically targeting aerospace; Pioneer Kitten access brokering into DIB contractor networks; Progress ShareFile potential zero-day affecting file transfer workflows. Actions: <ul> <li> Alert HR and recruiting teams to fake resume/portfolio lures hosted on GitHub — verify all candidate-submitted links before execution on corporate systems </li> <li> Audit ShareFile on-premises deployments; consider emergency isolation pending CVE disclosure from Progress </li> <li> Monitor for unauthorized access to PLM systems (PTC Windchill) and engineering data repositories </li> <li> Implement application allowlisting on engineering workstations to prevent execution of downloaded executables from GitHub </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Block Agentemis C2 IPs at perimeter: 23.226.58[.]116, 43.240.239[.]234, 43.240.239[.]254, 23.226.58[.]106 (port 29541). Hunt for historical connections in 90-day netflow. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Deploy Salgorea detection: hunt for imphash 6dca3e9fb3928bbdb54dbce669943ec8 and SHA-256 5338ea423aff0dd6e383c695788e9b1842b2a185ab345c118d2f5480e4dbd522 across all endpoints. </td> </tr> <tr> <td> 3 </td> <td> IT Ops </td> <td> Verify ALL Adobe ColdFusion instances are patched beyond versions 2025.9 / 2023.20. CVE-2026-48282 is CVSS 10.0, pre-auth RCE, actively exploited, in CISA KEV. No exceptions. </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Enable enhanced logging on FortiGate VPN infrastructure — capture all authentication events with source IP, ASN, and geolocation for anomaly detection. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> IT Ops </td> <td> Rotate ALL FortiGate VPN credentials. Enforce MFA. Check for passive sniffer implants on firewall memory. Assume credentials are compromised if running affected firmware. </td> </tr> <tr> <td> 6 </td> <td> SOC </td> <td> Create detection rule for GitHub-hosted lures: emails containing github.com/*/resume or github.com/*/portfolio paths delivering executables to aerospace/DIB personnel. </td> </tr> <tr> <td> 7 </td> <td> OT Security </td> <td> Assess Schneider Electric Easergy MiCOM Px40 deployment footprint. Apply CSAF icsa-26-190-03 mitigations. Audit OpenPLC v3 for unauthorized file writes. </td> </tr> <tr> <td> 8 </td> <td> HR / Security Awareness </td> <td> Brief recruiting and HR teams on Iranian fake resume/interview TTPs — verify all candidate-submitted code repositories and portfolio links before execution on corporate systems. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 9 </td> <td> CISO </td> <td> Commission assessment of Progress ShareFile on-premises exposure. Emergency shutdown signals potential zero-day with MOVEit-scale implications. Evaluate migration alternatives. </td> </tr> <tr> <td> 10 </td> <td> CISO </td> <td> Review and test incident response playbook for destructive wiper scenarios. Handala's operational silence during peak escalation matches pre-Stryker-wiper patterns. Ensure offline backups are verified. </td> </tr> <tr> <td> 11 </td> <td> CISO </td> <td> Validate IT/OT segmentation through red team exercise — specifically test whether compromise of internet-facing systems (ColdFusion, FortiGate) enables lateral movement to ICS/SCADA networks. </td> </tr> <tr> <td> 12 </td> <td> IR Team </td> <td> Conduct tabletop exercise for simultaneous ransomware + wiper scenario — Iranian actors have demonstrated willingness to deploy both in parallel through different operational units. </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> <th> Confidence </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 23.226.58[.]116 </td> <td> Agentemis Cobalt Strike C2, port 29541 </td> <td> High </td> </tr> <tr> <td> IPv4 </td> <td> 43.240.239[.]234 </td> <td> Agentemis Cobalt Strike C2, port 29541 </td> <td> High </td> </tr> <tr> <td> IPv4 </td> <td> 43.240.239[.]254 </td> <td> Agentemis Cobalt Strike C2, port 29541 </td> <td> High </td> </tr> <tr> <td> IPv4 </td> <td> 23.226.58[.]106 </td> <td> Agentemis Cobalt Strike C2, port 29541 </td> <td> High </td> </tr> <tr> <td> SHA-256 </td> <td> 5338ea423aff0dd6e383c695788e9b1842b2a185ab345c118d2f5480e4dbd522 </td> <td> Salgorea backdoor </td> <td> High </td> </tr> <tr> <td> SHA-1 </td> <td> e0f6941f37b0ea6015185c922e6b35cdfacb4e1e </td> <td> Salgorea backdoor </td> <td> High </td> </tr> <tr> <td> MD5 </td> <td> 2b0383674e54467a1ccde0bf9f53be93 </td> <td> Salgorea backdoor </td> <td> High </td> </tr> <tr> <td> Imphash </td> <td> 6dca3e9fb3928bbdb54dbce669943ec8 </td> <td> Salgorea backdoor (PE32) </td> <td> High </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. <h2> The Bottom Line </h2> We are 135 days into an active cyber conflict with Iran. The adversary is not standing still — they are deploying new malware families, confirming ransomware partnerships, maintaining persistent C2 infrastructure, and positioning for access to aerospace and defense networks through social engineering. The silence from their most destructive units is not reassurance. It is preparation. The convergence of a CVSS 10.0 actively exploited vulnerability (CVE-2026-48282), 430,000 compromised firewalls feeding ransomware operators, novel backdoor capabilities, and ICS vulnerabilities in grid protection equipment creates a threat surface that demands immediate action — not next quarter's planning cycle. Three questions every CISO should answer today: <ol> <li> Are your FortiGate credentials rotated? If not, assume they are in adversary hands. </li> <li> Is your ColdFusion patched? A CVSS 10.0 pre-auth RCE with no user interaction is as bad as it gets. </li> <li> Do you have a wiper response plan? The group that deployed Stryker in March is quiet. That should concern you more than if they were loud. </li> </ol> The window between intelligence warning and operational impact is narrowing. Act now. Published by Anomali CTI Desk — July 13, 2026 For questions or additional indicators, contact your Anomali representative or access ThreatStream Next-Gen for full IOC packages.

FEATURED RESOURCES

July 13, 2026

Anomali Cyber Watch