Iranian Cyber Operations Intensify: Seven Cisco SD-WAN Exploits, AI-Generated Attack Code, and Fresh C2 Infrastructure Signal Imminent Escalation

Anomali Threat Research

Published on

June 16, 2026

Table of Contents

Threat Assessment Level: HIGH The Iran-Israel conflict — now in its 109th day since hostilities began on February 28, 2026 — continues to generate an accelerating tempo of Iranian state-sponsored cyber operations. Despite active ceasefire negotiations, IRGC and MOIS-affiliated threat actors are not standing down. They are pre-positioning, staging fresh command-and-control infrastructure, and systematically dismantling the security of network management platforms used by governments and militaries worldwide. This week's convergence of three signals should command every CISO's attention: a seventh exploited vulnerability in Cisco's SD-WAN platform, a CVSS 10.0 Ivanti Sentry flaw with a public proof-of-concept, and the first confirmed AI-generated exploit code observed in the Iranian threat landscape. The adversary is getting faster, more methodical, and more capable. If your organization operates Cisco SD-WAN, Ivanti Sentry, or Fortinet FortiSandbox — or if you serve the defense industrial base, energy, healthcare, or government sectors — this report demands immediate action. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-20262 added to CISA KEV (June 15) — the 7th Cisco SD-WAN Manager vulnerability exploited since January 2026 </td> <td> A single determined adversary is systematically compromising government/military WAN management planes. This is not opportunistic — it is architectural targeting. </td> </tr> <tr> <td> CVE-2026-10520 (Ivanti Sentry, CVSS 10.0) — public PoC now available for 7 days </td> <td> Pioneer Kitten (Fox Kitten/UNC757) historically weaponizes Ivanti PoCs within 72 hours. The exploitation window is wide open. </td> </tr> <tr> <td> Fresh Cobalt Strike C2 stood up on Iranian ISP Aria Shatel (June 15) </td> <td> Iranian operators are actively staging infrastructure for imminent campaign launches. </td> </tr> <tr> <td> AI-generated exploit code confirmed for FortiSandbox CVE-2026-25089 </td> <td> A capability threshold has been crossed — exploit development timelines will compress from days to hours. </td> </tr> <tr> <td> MuddyWater goes silent after active credential harvesting campaign </td> <td> Silence after collection typically means transition to exploitation. Expect anomalous authentications from harvested credentials. </td> </tr> <tr> <td> Cyber Av3ngers — 47+ days without new campaign activity </td> <td> Anomalous silence for an active conflict. Profile updated June 16 but no new indicators — possible infrastructure refresh or target reconnaissance. </td> </tr> <tr> <td> APT42 (Charming Kitten) conducting active credential harvesting against diplomatic entities during peace talks </td> <td> IRGC-IO collection operations are accelerating in parallel with negotiations — intelligence gathering on negotiating positions is a priority target. </td> </tr> <tr> <td> DIB/GitHub fake-resume lure campaign goes quiet after active targeting of aerospace engineers </td> <td> Operational silence after active reconnaissance is consistent with transition to internal operations against already-compromised targets. </td> </tr> </tbody> </table> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 2026-02-28 </td> <td> Iran-Israel conflict begins </td> <td> Kinetic and cyber operations commence simultaneously </td> </tr> <tr> <td> 2026-03-05 </td> <td> CVE-2026-20122, CVE-2026-20128 exploited </td> <td> First Cisco SD-WAN Manager vulnerabilities in chain </td> </tr> <tr> <td> 2026-03-11 </td> <td> Handala/Void Manticore wipes 200,000 endpoints at Stryker </td> <td> Largest destructive attack of the conflict </td> </tr> <tr> <td> 2026-04-21 </td> <td> CVE-2026-20133 exploited </td> <td> Fourth SD-WAN vulnerability; CISA flags exploitation </td> </tr> <tr> <td> 2026-05-15 </td> <td> CVE-2026-20182 zero-day exploited </td> <td> Fifth in chain — zero-day indicates dedicated reverse engineering </td> </tr> <tr> <td> 2026-06-05 </td> <td> CVE-2026-20245 zero-day exploited </td> <td> Sixth vulnerability; campaign cadence accelerating </td> </tr> <tr> <td> 2026-06-09 </td> <td> WatchTowr publishes Ivanti Sentry PoC </td> <td> Exploitation clock starts for CVE-2026-10520 </td> </tr> <tr> <td> 2026-06-11 </td> <td> CVE-2026-10520 added to CISA KEV </td> <td> Confirmed in-the-wild exploitation </td> </tr> <tr> <td> 2026-06-12 </td> <td> DIB aerospace GitHub lure campaign goes quiet </td> <td> Possible transition from reconnaissance to internal operations </td> </tr> <tr> <td> 2026-06-13 </td> <td> Wiper campaign (masquerading as ESET) last updated </td> <td> Handala-linked destructive capability remains active </td> </tr> <tr> <td> 2026-06-15 </td> <td> CVE-2026-20262 added to CISA KEV; fresh C2 on 151.239.24[.]160 </td> <td> Seventh SD-WAN exploit + active Iranian C2 staging </td> </tr> <tr> <td> 2026-06-16 </td> <td> FortiSandbox triple exploitation confirmed; AI-generated exploit identified </td> <td> Capability evolution — AI-assisted offensive development now operational </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> The Cisco SD-WAN Systematic Campaign: A Nation-State at Work </h3> Seven vulnerabilities in one platform exploited over six months is not opportunistic scanning. This is a dedicated reverse-engineering effort by an adversary with deep architectural knowledge of Cisco's Catalyst SD-WAN Manager. The chain: CVE-2026-20122 → CVE-2026-20127 → CVE-2026-20128 → CVE-2026-20133 → CVE-2026-20182 → CVE-2026-20245 → CVE-2026-20262 The attack pattern is consistent: crafted HTTP POST requests to API endpoints enable file creation/overwrite via the WildFly Java application server, escalating to root-level access. The adversary deploys malicious .war files to achieve persistent control of the management plane. Why this matters strategically: SD-WAN management planes control routing for entire enterprise and government WANs. Persistent access here enables traffic interception, route manipulation, and — critically — the ability to disrupt communications during a kinetic escalation. This maps directly to pre-positioning for destructive action. No specific actor attribution has been confirmed, but the sustained cadence, zero-day capability (CVE-2026-20182, CVE-2026-20245), and targeting of government networks are consistent with IRGC-affiliated operations. <h3> Pioneer Kitten and the Ivanti Sentry Window </h3> CVE-2026-10520 is an unauthenticated OS command injection vulnerability in Ivanti Sentry that grants root-level remote code execution. CVSS 10.0. The WatchTowr Labs proof-of-concept has been public since June 9. Pioneer Kitten (also tracked as Fox Kitten, UNC757, Refined Kitten, and RUBIDIUM) has a documented pattern of weaponizing Ivanti vulnerabilities within 72 hours of PoC availability. This actor operates at the intersection of MOIS espionage and ransomware monetization — they sell initial access to ransomware affiliates while simultaneously conducting espionage for Iranian intelligence. We are now at Day 7 post-PoC with no public reporting of Pioneer Kitten exploitation. This does not mean it isn't happening — it may mean exploitation is occurring but has not yet been detected or disclosed. Related Ivanti exposure: CVE-2026-5787 (Ivanti EPMM certificate validation bypass, CVSS 8.9) was disclosed in May 2026, expanding the Ivanti attack surface for organizations using mobile device management for classified communications. <h3> Fresh Iranian C2 Infrastructure: Active Staging </h3> On June 15, a new Cobalt Strike beacon server was validated at 151.239.24[.]160 on ASN 31549 (Aria Shatel, Tehran), listening on port 9090. This joins an expanding constellation of Iranian C2 infrastructure: <ul> <li> 79.175.189[.]207 (ASN 25184, Afranet, Iran) — Cobalt Strike + Mythic framework, high confidence </li> <li> 195.181.36[.]124 (ASN 58224, Iran Telecom) — QuasarRAT C2 </li> </ul> The refresh cadence is accelerating — new beacons appearing every 7-10 days on residential Iranian ISPs. This pattern is consistent with MuddyWater and Pioneer Kitten operational tradecraft and indicates imminent campaign launches. <h3> FortiSandbox Triple Exploitation and the AI Threshold </h3> Three FortiSandbox vulnerabilities — CVE-2026-39813 , CVE-2026-39808 , and CVE-2026-25089 (all CVSS 9.1) — are now actively exploited. All enable unauthenticated command injection or authentication bypass. The critical signal: CVE-2026-25089's exploit shows signatures of AI-assisted development. While reportedly imperfect in its current form, this represents a capability threshold crossing. The implication is clear — exploit development timelines will compress as AI tools mature, reducing the window between vulnerability disclosure and weaponization from days to potentially hours. Pioneer Kitten and UNC757 have historically targeted Fortinet appliances (documented in CISA Advisory AA24-241A), making this exploitation cluster directly relevant to the Iranian threat landscape. <h3> Named Threat Actors: Current Status </h3> <table> <thead> <tr> <th> Actor </th> <th> Affiliation </th> <th> Current Assessment </th> </tr> </thead> <tbody> <tr> <td> Pioneer Kitten (Fox Kitten, UNC757, Refined Kitten) </td> <td> MOIS-adjacent </td> <td> Expected to exploit CVE-2026-10520 imminently; historically targets Ivanti and Fortinet </td> </tr> <tr> <td> MuddyWater (TEMP.Zagros) </td> <td> MOIS (Ministry of Intelligence and Security) </td> <td> Silent after credential harvesting campaign — likely transitioning to exploitation phase </td> </tr> <tr> <td> Handala / Void Manticore (UNC5203, BANISHED KITTEN) </td> <td> IRGC-affiliated </td> <td> Responsible for Stryker wiper (200K endpoints); wiper campaign last updated June 13 </td> </tr> <tr> <td> Cyber Av3ngers </td> <td> IRGC-affiliated </td> <td> 47+ days silent — anomalous for active conflict; profile updated June 16 with no new campaigns </td> </tr> <tr> <td> APT42 / Charming Kitten </td> <td> IRGC-IO </td> <td> Active credential harvesting targeting diplomatic entities during peace talks </td> </tr> <tr> <td> UNC6077 / Berry Sandstorm </td> <td> Suspected MOIS </td> <td> Active in DIB targeting via GitHub fake-resume lures </td> </tr> </tbody> </table> <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Pioneer Kitten weaponizes CVE-2026-10520 (Ivanti Sentry) </td> <td> 70% </td> <td> Within 72 hours </td> <td> Historical pattern of Ivanti exploitation within 72h of PoC; 7 days elapsed increases urgency </td> </tr> <tr> <td> Cisco SD-WAN campaign yields 8th exploited CVE </td> <td> 60% </td> <td> Within 14 days </td> <td> Sustained 7-vuln cadence over 6 months; dedicated RE capability demonstrated </td> </tr> <tr> <td> MuddyWater transitions from credential harvesting to exploitation </td> <td> 50% </td> <td> Within 7 days </td> <td> Operational silence after active collection phase is consistent with credential weaponization </td> </tr> <tr> <td> AI-generated exploits become routine in Iranian operations </td> <td> 65% </td> <td> Within 90 days </td> <td> Capability demonstrated; iteration will improve quality; low barrier to adoption </td> </tr> <tr> <td> Destructive attack on critical infrastructure during ceasefire talks </td> <td> 40% </td> <td> Within 30 days </td> <td> Historical pattern: Iranian actors escalate cyber operations as diplomatic leverage during negotiations </td> </tr> <tr> <td> Cyber Av3ngers resurface with ICS/OT targeting </td> <td> 55% </td> <td> Within 21 days </td> <td> Extended silence during active conflict is anomalous; infrastructure refresh likely underway </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> <ol> <li> Cisco SD-WAN Management Plane Monitoring </li> </ol> <ul> <li> Hunt hypothesis: Adversary has deployed malicious .war files via crafted HTTP POST requests to SD-WAN Manager API endpoints, achieving root-level persistence. </li> <li> ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts), T1485 (Data Destruction), T1068 (Privilege Escalation) </li> <li> Detection guidance: </li> <ul> <li> Alert on any .war file creation on SD-WAN Manager hosts outside scheduled deployments </li> <li> Monitor WildFly Java application server logs for anomalous POST requests to API endpoints </li> <li> Search for unexpected processes spawned by the WildFly service account </li> <li> Baseline normal API call patterns and alert on deviations </li> </ul> </ul> <ol start="2"> <li> Ivanti Sentry Exploitation </li> </ol> <ul> <li> Hunt hypothesis: Unauthenticated OS command injection via CVE-2026-10520 grants root shell; adversary establishes persistence and pivots to managed mobile devices. </li> <li> ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1059.004 (Unix Shell), T1068 (Privilege Escalation) </li> <li> Detection guidance: </li> <ul> <li> Monitor Ivanti Sentry access logs for unauthenticated requests to vulnerable endpoints </li> <li> Alert on shell process spawns (bash, sh) from Sentry application processes </li> <li> Network-level: detect outbound connections from Sentry appliances to non-standard ports </li> <li> If unpatched: implement WAF rules to block exploitation patterns or take offline </li> </ul> </ul> <ol start="3"> <li> Iranian C2 Communication </li> </ol> <ul> <li> Hunt hypothesis: Compromised hosts are beaconing to Cobalt Strike/Mythic/QuasarRAT C2 servers on Iranian ISPs. </li> <li> ATT&CK techniques: T1071.001 (Web Protocols), T1573.001 (Encrypted Channel), T1105 (Ingress Tool Transfer), T1571 (Non-Standard Port) </li> <li> Detection guidance: </li> <ul> <li> Block and alert on traffic to ASN 31549 (Aria Shatel), ASN 25184 (Afranet), ASN 58224 (Iran Telecom), ASN 213790 (Limited Network) </li> <li> Specifically monitor port 9090 for Cobalt Strike beacon patterns </li> <li> Implement JA3/JA3S fingerprint detection for known Cobalt Strike profiles </li> <li> Historical search: query 90 days of netflow for any connections to the IOCs listed below </li> </ul> </ul> <ol start="4"> <li> Fortinet FortiSandbox Exploitation </li> </ol> <ul> <li> Hunt hypothesis: Unauthenticated attackers are exploiting JRPC API endpoints to achieve command injection on FortiSandbox appliances. </li> <li> ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter), T1553.002 (Code Signing bypass) </li> <li> Detection guidance: </li> <ul> <li> Audit FortiSandbox logs for unauthenticated HTTP requests to JRPC API </li> <li> Monitor for unexpected process execution on FortiSandbox hosts </li> <li> Network segmentation: ensure FortiSandbox management interfaces are not internet-exposed </li> </ul> </ul> <ol start="5"> <li> Credential Abuse from MuddyWater Harvesting </li> </ol> <ul> <li> Hunt hypothesis: MuddyWater (MOIS) harvested credentials during recent phishing campaign and is now using them for initial access to M365/Azure tenants. </li> <li> ATT&CK techniques: T1078 (Valid Accounts), T1021 (Remote Services), T1114 (Email Collection) </li> <li> Detection guidance: </li> <ul> <li> Alert on authentications from Iranian IP ranges (ASNs above) to cloud tenants </li> <li> Monitor for impossible travel or anomalous login patterns on privileged accounts </li> <li> Review conditional access policies — enforce MFA and block legacy authentication </li> <li> Search for new mail forwarding rules or OAuth app registrations in the past 14 days </li> </ul> </ul> <h3> Hunting Hypotheses Summary </h3> <table> <thead> <tr> <th> Hypothesis </th> <th> Priority </th> <th> Data Sources </th> <th> Key Indicators </th> </tr> </thead> <tbody> <tr> <td> SD-WAN management plane compromise via .war file deployment </td> <td> CRITICAL </td> <td> SD-WAN Manager logs, WildFly logs, file integrity monitoring </td> <td> Unexpected .war files, anomalous API POSTs, root-level process spawns </td> </tr> <tr> <td> Ivanti Sentry root shell via CVE-2026-10520 </td> <td> CRITICAL </td> <td> Sentry access logs, process monitoring, netflow </td> <td> Unauthenticated requests to vulnerable endpoints, shell spawns </td> </tr> <tr> <td> Cobalt Strike beaconing to Iranian ASNs </td> <td> HIGH </td> <td> Firewall logs, DNS logs, netflow, proxy logs </td> <td> Connections to port 9090, JA3 fingerprints, periodic beaconing patterns </td> </tr> <tr> <td> Credential stuffing from MuddyWater harvest </td> <td> HIGH </td> <td> Azure AD sign-in logs, M365 UAL, CASB </td> <td> Iranian IP logins, impossible travel, new OAuth apps, mail rules </td> </tr> <tr> <td> FortiSandbox command injection </td> <td> HIGH </td> <td> FortiSandbox logs, network IDS </td> <td> Unauthenticated JRPC requests, unexpected child processes </td> </tr> <tr> <td> DIB GitHub lure code execution </td> <td> MEDIUM </td> <td> Endpoint EDR, Git logs, process trees </td> <td> Code cloned from unknown repos, unexpected compilation/execution </td> </tr> </tbody> </table> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> Primary threat: Iranian actors targeting SWIFT-connected systems and payment infrastructure for both espionage and potential destructive disruption as economic leverage during negotiations. <ul> <li> Immediate: Audit all Cisco SD-WAN deployments in branch connectivity; financial institutions heavily rely on SD-WAN for branch-to-datacenter communication. Verify patching for all seven CVEs in the chain. </li> <li> 7-day: Review Fortinet FortiSandbox deployments used for transaction file analysis — exploitation could allow malware to bypass sandbox detection entirely, enabling downstream payload delivery. </li> <li> 30-day: Conduct tabletop exercise simulating simultaneous SD-WAN disruption and wiper deployment during peak trading hours. Validate out-of-band communication plans. </li> </ul> <h3> Energy </h3> Primary threat: ICS/OT pre-positioning for destructive attack. Cyber Av3ngers previously targeted water/energy infrastructure; their extended silence may precede a major operation. <ul> <li> Immediate: Verify network segmentation between IT SD-WAN management planes and OT networks. If SD-WAN is used for SCADA backhaul, implement emergency out-of-band monitoring. </li> <li> 7-day: Review CISA ICS advisories for Schneider Electric EcoStruxure and Siemens KACO inverter vulnerabilities — patch or isolate affected systems. Audit Brickcom/Dahua surveillance cameras for default credentials. </li> <li> 30-day: Implement Iranian ASN blocking at OT network perimeters (not just IT). Deploy passive OT network monitoring to detect lateral movement from compromised IT systems. </li> </ul> <h3> Healthcare </h3> Primary threat: Ransomware via Pioneer Kitten initial access brokering, and wiper attacks disguised as ransomware (Handala pattern). <ul> <li> Immediate: Patch Ivanti Sentry/EPMM deployments used for clinician mobile device management — CVE-2026-10520 grants root access to MDM infrastructure, enabling mass device compromise. </li> <li> 7-day: Audit for Pioneer Kitten IOCs (SHA-256 hashes listed below) across endpoint fleet. Pioneer Kitten sells access to ransomware affiliates — healthcare is a preferred monetization target. </li> <li> 30-day: Validate backup integrity and test restoration procedures. The Stryker wiper attack (200,000 endpoints) demonstrates Iranian willingness to conduct destructive operations against healthcare-adjacent targets. </li> </ul> <h3> Government </h3> Primary threat: Systematic SD-WAN compromise enabling persistent access to government WAN management planes for espionage and pre-positioning for communications disruption. <ul> <li> Immediate: Treat Cisco SD-WAN Manager patching as a national security priority. Seven exploited vulnerabilities in six months means the adversary has persistent reverse-engineering capability against this platform. Assume compromise if any patch was delayed. </li> <li> 7-day: Implement out-of-band management for all critical network infrastructure. SD-WAN management interfaces must not be reachable from the general internet or standard user networks. </li> <li> 30-day: Commission red team assessment of SD-WAN management plane isolation. Evaluate migration to zero-trust network architecture that does not depend on a single management platform. </li> </ul> <h3> Aviation & Logistics </h3> Primary threat: DIB supply chain compromise via GitHub fake-resume lures targeting aerospace engineers, and potential disruption of logistics/maritime systems. <ul> <li> Immediate: Brief engineering and recruiting teams on the GitHub fake-resume lure campaign (TEMP.Jafar/UNC6077 pattern) — verify all code repositories before execution in development environments. </li> <li> 7-day: Audit all code cloned from external GitHub repositories in the past 30 days. Search for execution of unfamiliar binaries or scripts sourced from interview/assessment repositories. </li> <li> 30-day: Implement code execution sandboxing for all externally-sourced repositories. Review NAVTOR and maritime logistics system patching — Iranian actors have demonstrated interest in maritime chokepoint disruption. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops </td> <td> Patch Ivanti Sentry to R10.5.2/R10.6.2/R10.7.1 addressing CVE-2026-10520 (CVSS 10.0). If patching is impossible within 24h, take the appliance offline or implement WAF blocking rules. </td> </tr> <tr> <td> 2 </td> <td> IT Ops </td> <td> Verify Cisco Catalyst SD-WAN Manager is patched against CVE-2026-20262 and all six prior CVEs. Search WildFly logs for .war file deployments and anomalous API POST requests. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Block Iranian C2 IPs at perimeter: 151.239.24[.]160, 79.175.189[.]207, 195.181.36[.]124. Run 90-day historical search for any connections to these addresses. </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Add ASN-based alerting for ASN 31549, 25184, 58224, and 213790 — any traffic to/from these Iranian networks should trigger investigation. </td> </tr> <tr> <td> 5 </td> <td> Executive/IR </td> <td> Confirm incident response retainer is active and IR team is briefed on Iranian wiper TTPs. Validate out-of-band communication plan if primary WAN is disrupted. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops </td> <td> Patch Fortinet FortiSandbox against CVE-2026-39813, CVE-2026-39808, CVE-2026-25089. Audit logs for unauthenticated JRPC API requests. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Deploy Cobalt Strike beacon detection for port 9090 communications from Iranian ASN ranges. Implement JA3/JA3S fingerprinting for known Cobalt Strike profiles. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Review Azure AD/M365 sign-in logs for authentications from Iranian IP ranges. Audit OAuth app registrations and mail forwarding rules created in the past 14 days. </td> </tr> <tr> <td> 4 </td> <td> DevOps/HR </td> <td> Brief aerospace and defense teams on GitHub fake-resume lure campaign. Audit code repositories cloned from unknown sources in past 30 days. </td> </tr> <tr> <td> 5 </td> <td> IT Ops </td> <td> Review and patch Ivanti EPMM (CVE-2026-5787, CVSS 8.9) and Arista EOS per recent security advisories. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> CISO </td> <td> Commission architectural review of SD-WAN management plane isolation. Seven exploited CVEs in six months demands network segmentation of management interfaces and evaluation of platform alternatives. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Implement behavioral analysis for ASN 213790 traffic to resolve actor-tag conflicts (APT28 signatures on Iranian infrastructure indicate misattribution — likely Iranian actors using similar tooling). </td> </tr> <tr> <td> 3 </td> <td> CISO </td> <td> Evaluate AI-accelerated patching workflows — if adversaries are using AI to generate exploits faster, defensive patch timelines must compress accordingly. </td> </tr> <tr> <td> 4 </td> <td> IR </td> <td> Conduct tabletop exercise: simultaneous SD-WAN management plane compromise + wiper deployment during ceasefire negotiation breakdown. Test backup communications and recovery procedures. </td> </tr> <tr> <td> 5 </td> <td> Executive </td> <td> Authorize procurement of additional threat intelligence sources (Shodan/Censys infrastructure scanning, Google Threat Intelligence API) to close collection gaps identified in current monitoring. </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> The following IOCs have been validated through intelligence collection and should be implemented in blocking and detection rules: <h3> Network Indicators </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> <th> Confidence </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 151.239.24[.]160 </td> <td> Cobalt Strike C2, ASN 31549 Aria Shatel, Tehran — port 9090 </td> <td> High </td> </tr> <tr> <td> IPv4 </td> <td> 79.175.189[.]207 </td> <td> Cobalt Strike + Mythic C2, ASN 25184 Afranet, Iran </td> <td> High </td> </tr> <tr> <td> IPv4 </td> <td> 195.181.36[.]124 </td> <td> QuasarRAT C2, ASN 58224 Iran Telecom </td> <td> Moderate </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]169 </td> <td> APT infrastructure, ASN 213790, targets gov/healthcare/telecom </td> <td> High </td> </tr> <tr> <td> IPv4 </td> <td> 77.90.185[.]253 </td> <td> Cryptominer/APT infrastructure, ASN 213790 </td> <td> High </td> </tr> <tr> <td> IPv4 </td> <td> 185.93.89[.]147 </td> <td> Mirage malware C2, ASN 213790 </td> <td> High </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]180 </td> <td> APT infrastructure, ASN 213790, targets retail/telecom </td> <td> High </td> </tr> <tr> <td> IPv4 </td> <td> 171.22.27[.]16 </td> <td> Iranian threat infrastructure </td> <td> Moderate </td> </tr> </tbody> </table> <h3> File Hashes (Pioneer Kitten / Handala Associated) </h3> <table> <thead> <tr> <th> SHA-256 </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> f4092b6a32484d9132e926b19193182bebec5ffba09de94acd193f581df4490f </td> <td> Pioneer Kitten / Banished Kitten tooling </td> </tr> <tr> <td> 2d523823c8e1b72ecf485016290af57887cde1000e7c56dbced3757b3ad8bb5a </td> <td> Pioneer Kitten / Banished Kitten tooling </td> </tr> <tr> <td> df7a86eaf45a7c3ba2f70321e75b90f77f3b4bb8a49714e694e8769b7b97e6e5 </td> <td> Pioneer Kitten / Banished Kitten tooling </td> </tr> <tr> <td> 997ffae5b43a3bbda8657816cc8389e87109d7539074b71552bf7479f8e83363 </td> <td> Pioneer Kitten / Banished Kitten tooling </td> </tr> <tr> <td> 7233f291c350fa1510ca73a0b72c2a477031d16efebb6237ef75ff14ead999c0 </td> <td> Pioneer Kitten / Banished Kitten tooling </td> </tr> <tr> <td> 028d3de0f0709a18c9928526519e761a08f6766d1eca386e908588f995f44e7f </td> <td> Pioneer Kitten / Banished Kitten tooling </td> </tr> <tr> <td> 0a5cf97e699c8bfacee7f89ebfaa851ff03dd004a58ffde9c609fcc2cd27f250 </td> <td> Pioneer Kitten / Banished Kitten tooling </td> </tr> </tbody> </table> Note: All IOCs should be cross-referenced against Anomali ThreatStream Next-Gen prior to deployment in production blocking rules. Additional indicators and STIX packages are available via your Anomali representative. <h2> Bottom Line </h2> The Iranian cyber threat is not pausing for diplomacy. While ceasefire negotiations continue, IRGC and MOIS-affiliated operators are exploiting every available vulnerability, staging fresh infrastructure, and — for the first time — leveraging AI to accelerate their offensive capabilities. The Cisco SD-WAN campaign is the clearest signal: a methodical, patient adversary is systematically compromising the management planes that control government and military communications. Seven vulnerabilities in six months is not a series of isolated incidents — it is a campaign with strategic intent. Your 24-hour priorities are clear: <ol> <li> Patch Ivanti Sentry (CVSS 10.0, PoC public, exploitation expected) </li> <li> Verify SD-WAN Manager patching (7th CVE exploited, CISA deadline June 29) </li> <li> Block Iranian C2 infrastructure and hunt for historical connections </li> </ol> The window between vulnerability disclosure and weaponization is closing. With AI-assisted exploit development now confirmed in this theater, that window will only get narrower. Act today. Published 2026-06-16 by the Anomali CTI Desk. Intelligence derived from Anomali ThreatStream Next-Gen. CISA advisories, and curated open-source feeds. For IOC feeds and STIX packages, contact your Anomali representative.

FEATURED RESOURCES

June 16, 2026

Anomali Cyber Watch