Iranian Cyber Operations Reach Inflection Point: FortiBleed Pipeline Weaponized, Multi-Actor Convergence Accelerates

Anomali Threat Research

Published on

July 10, 2026

Table of Contents

Threat Assessment Level: HIGH Over 130 days into the Iran conflict, Tehran's cyber apparatus is no longer merely pre-positioning — it is actively weaponizing stolen access at industrial scale. This week, multiple independent sources confirmed that credentials harvested from 430,000 compromised FortiGate firewalls are now feeding live ransomware operations. Simultaneously, fresh malware samples reveal an unprecedented convergence of five Iranian threat groups sharing tooling, while new ICS vulnerabilities expand the attack surface available to Iran's most destructive operators. For CISOs, the message is unambiguous: the boundary between Iranian state espionage and criminal ransomware has dissolved. If your organization runs FortiGate firewalls, Adobe ColdFusion, or Schneider Electric OT systems, you are in the blast radius. <h2> What Changed </h2> The threat level remains HIGH , consistent with the prior assessment period. Six developments justify sustained elevation: <ol> <li> FortiBleed-to-ransomware pipeline confirmed. Four independent sources validated that Pioneer Kitten (IRGC-affiliated) is brokering stolen FortiGate VPN credentials directly to INC Ransom and Lynx ransomware operators. Analyst teams identified the same individual logged into both ransomware panels using FortiBleed-derived infrastructure. This is no longer theoretical — it is an industrialized access-brokering operation affecting 430,000 firewalls globally. </li> <li> Five-actor malware convergence. Seven new malware samples (shared via H-ISAC at TLP:GREEN) carry simultaneous attribution tags for Pioneer Kitten, Handala, Banished Kitten, Refined Kitten, and Helix Kitten. This breadth of convergence — spanning both IRGC and MOIS organizational lines — suggests Iran is consolidating operational cells or sharing tooling at a level not previously observed. </li> <li> ICS attack surface expansion. Three CISA ICS advisories published July 9 affect Schneider Electric Easergy MiCOM Px40 protection relays (deployed in electrical substations), Schneider PowerChute UPS management, and OpenPLC v3. Each of these sits squarely within Cyber Av3ngers' demonstrated targeting preferences. </li> <li> MuddyWater retooling detected. MuddyWater's (MOIS) actor profile was refreshed on July 8 with updated tooling references — SimpleHelp, DarkBeatC2, and MuddyC2Go — following confirmed targeting of Oman Oil & Gas via DinDoor C2 on July 1. Operational silence consistent with pre-campaign retooling; a new campaign is assessed as likely within 14 days. </li> <li> DHS HSIN breach disclosed. A weeks-long adversary intrusion into the Department of Homeland Security's Homeland Security Information Network was disclosed July 8, compromising federal, state, and local emergency coordination infrastructure. Attribution to Iranian actors is assessed with moderate confidence based on TTPs and targeting pattern. </li> <li> ColdFusion CVE-2026-48282 added to CISA KEV. This unauthenticated RCE vulnerability (CVSS 10.0) was confirmed actively exploited on July 7, with an exploitation pattern precisely matching Pioneer Kitten's documented initial access methodology. Immediate patching or isolation is required. </li> </ol> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 2026-02-28 </td> <td> Iran conflict begins </td> <td> Kinetic and cyber operations commence </td> </tr> <tr> <td> 2026-07-01 </td> <td> MuddyWater DinDoor C2 confirmed targeting Oman Oil & Gas </td> <td> Active MOIS espionage against Gulf energy sector </td> </tr> <tr> <td> 2026-07-01 </td> <td> FortiBleed reporting emerges (Bleeping Computer) </td> <td> 430K firewalls compromised; credential theft at scale </td> </tr> <tr> <td> 2026-07-02 </td> <td> Multiple outlets confirm INC/Lynx ransomware link </td> <td> Operator overlap proven between ransomware panels </td> </tr> <tr> <td> 2026-07-07 </td> <td> CISA adds CVE-2026-48282 (ColdFusion, CVSS 10.0) to KEV </td> <td> Active exploitation confirmed; Pioneer Kitten pattern match </td> </tr> <tr> <td> 2026-07-07 </td> <td> 7 new Pioneer Kitten/Handala convergence samples appear </td> <td> 5-actor tag overlap on shared malware </td> </tr> <tr> <td> 2026-07-07 </td> <td> New Iranian IP on Arvan Cloud tagged Emotet </td> <td> Possible TTP evolution toward criminal delivery tradecraft </td> </tr> <tr> <td> 2026-07-08 </td> <td> DHS HSIN breach disclosed (weeks-long adversary access) </td> <td> Federal/state/local emergency coordination compromised </td> </tr> <tr> <td> 2026-07-08 </td> <td> MuddyWater actor profile refreshed (SimpleHelp, DarkBeatC2) </td> <td> Retooling indicators; operational silence may break soon </td> </tr> <tr> <td> 2026-07-09 </td> <td> 3 CISA ICS advisories (Schneider × 2, OpenPLC) </td> <td> Grid protection relays and UPS systems newly vulnerable </td> </tr> <tr> <td> 2026-07-09 </td> <td> ASN 213790 infrastructure reconfirmed active </td> <td> Pre-positioned C2 maintained through diplomatic window </td> </tr> <tr> <td> 2026-07-10 </td> <td> Intelligence collection cutoff </td> <td> Sustained HIGH threat posture; no de-escalation indicators </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> Pioneer Kitten / UNC757 — The IRGC's Access Broker </h3> Pioneer Kitten continues to operate as the critical bridge between Iranian state objectives and criminal ransomware ecosystems. Their playbook is now fully documented: <ol> <li> Exploit public-facing applications (T1190) — FortiGate VPN, Adobe ColdFusion, Citrix, Pulse Secure </li> <li> Harvest credentials (T1552.001) — FortiBleed extracts VPN configurations and user passwords at scale </li> <li> Broker access (T1078) — Sell or hand off valid credentials to INC Ransom and Lynx operators </li> <li> Maintain deniability — Ransomware deployment provides cover for potential destructive operations </li> </ol> The FBI/CISA advisory AA24-241A previously documented this pattern. What's new is the confirmed scale (430,000 firewalls) and operator identity overlap proving the same individuals manage both the state espionage and criminal monetization sides. <h3> Handala / UNC5203 — Destructive Operations </h3> Handala's presence on all seven convergence malware samples confirms their continued integration into the Pioneer Kitten access pipeline. Handala specializes in destructive operations — wipers, data destruction, and psychological operations through data leaks. Their co-tagging with Pioneer Kitten samples reinforces the espionage-to-destruction pipeline : IRGC gains access, destructive operators execute the follow-on payload. <h3> MuddyWater — MOIS, Retooling in Progress </h3> MuddyWater's actor profile was refreshed on July 8 with updated tooling references: SimpleHelp , DarkBeatC2 , and MuddyC2Go . Despite this maintenance activity, no new operational indicators were detected — a pattern consistent with retooling before a new campaign. MuddyWater's confirmed targeting of Oman Oil & Gas via DinDoor C2 (July 1) demonstrates their Gulf energy sector focus remains active. As an MOIS-affiliated group, MuddyWater's operations serve Iranian intelligence collection objectives distinct from IRGC-directed access brokering. <h3> Cyber Av3ngers / HYDRO KITTEN — IRGC-CEC ICS/OT Threat </h3> Three new ICS advisories directly expand Cyber Av3ngers' potential attack surface: <ul> <li> CVE in Schneider Electric Easergy MiCOM Px40 — protection relays in electrical substations; compromise enables loss of grid protection </li> <li> Schneider PowerChute Serial Shutdown — UPS management; file overwrite could cause physical damage during power events </li> <li> OpenPLC v3 — authenticated file write to privilege escalation; deployed in water/wastewater </li> </ul> Historical pattern analysis shows Cyber Av3ngers typically begin reconnaissance 7–21 days after advisory publication. <h3> CVE-2026-48282 — Adobe ColdFusion (CVSS 10.0) </h3> This unauthenticated remote code execution vulnerability via path traversal affects ColdFusion 2025.9 and 2023.20. Added to CISA's Known Exploited Vulnerabilities catalog on July 7, confirming active exploitation in the wild. The exploitation pattern (public-facing web application → webshell → lateral movement) precisely matches Pioneer Kitten's documented initial access methodology. <h3> CVE-2026-48908 — Joomla SP Page Builder </h3> Also added to KEV, this vulnerability in the SP Page Builder extension enables remote code execution via the uploadcustomicon function. Joomla instances running this extension are actively being exploited. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> FortiBleed credentials used in ransomware attack against healthcare or government target </td> <td> 70% </td> <td> 7 days </td> <td> Operator activity tempo; confirmed pipeline; healthcare targeting in H-ISAC distribution </td> </tr> <tr> <td> Cyber Av3ngers reconnaissance against Easergy Px40 grid relays or similar OT </td> <td> 50% </td> <td> 21 days </td> <td> Historical 7–21 day lag between advisory and exploitation; demonstrated ICS targeting intent </td> </tr> <tr> <td> MuddyWater launches new campaign using SimpleHelp or DarkBeatC2 variant </td> <td> 30% </td> <td> 14 days </td> <td> Profile refresh activity; operational silence consistent with retooling </td> </tr> <tr> <td> Pioneer Kitten exploits CVE-2026-48282 (ColdFusion) for initial access brokering </td> <td> 60% </td> <td> 14 days </td> <td> KEV confirmation + exact match to Pioneer Kitten's exploitation playbook </td> </tr> <tr> <td> Destructive operation (wiper/pseudo-ransomware) triggered by diplomatic breakdown </td> <td> 25% </td> <td> 30 days </td> <td> Pre-positioned infrastructure active; Handala convergence; dependent on geopolitical trigger </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> ATT&CK Technique </th> <th> What to Monitor </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> T1190 (Exploit Public-Facing Application) </td> <td> ColdFusion servers, FortiGate management interfaces, Joomla admin panels </td> <td> Alert on unexpected child processes from web server processes; monitor for webshell indicators (cmd.exe/powershell spawned by w3wp.exe or coldfusion.exe) </td> </tr> <tr> <td> T1078 (Valid Accounts) </td> <td> VPN authentication logs, especially FortiGate SSL-VPN </td> <td> Impossible travel, credential stuffing patterns, authentication from Iranian ASNs (213790, 202468, 58224) </td> </tr> <tr> <td> T1133 (External Remote Services) </td> <td> SSL-VPN connections, RDP gateways </td> <td> New VPN sessions from previously unseen geolocations; connections using credentials not reset since FortiBleed disclosure </td> </tr> <tr> <td> T1219 (Remote Access Software) </td> <td> SimpleHelp, Syncro, N-Able, Atera, DarkBeatC2 </td> <td> Any RMM tool not in your authorized software inventory; focus on SimpleHelp (MuddyWater's primary C2) </td> </tr> <tr> <td> T1071.001 (Web Protocols for C2) </td> <td> Outbound HTTPS to ASN 213790 (192.253.248.0/24), ASN 202468 </td> <td> Network telemetry for connections to identified C2 infrastructure </td> </tr> <tr> <td> T1486 (Data Encrypted for Impact) </td> <td> Volume shadow copy deletion, mass file encryption </td> <td> Canary files in network shares; monitor for vssadmin/wmic shadow copy deletion </td> </tr> <tr> <td> T0826 (Loss of Availability — ICS) </td> <td> Easergy Px40 relay communications, PowerChute management traffic </td> <td> Unexpected configuration changes to protection relay settings; UPS shutdown commands outside maintenance windows </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> Hypothesis: FortiBleed-derived access is active in our environment. </li> <ul> <li> Hunt: Query VPN logs for authentications using credentials that predate your last full rotation. Cross-reference with FortiGate firmware versions affected by FortiBleed. </li> <li> Indicators: Successful VPN auth → immediate lateral movement (RDP, SMB) to high-value targets within 30 minutes. </li> </ul> <li> Hypothesis: Unauthorized RMM tools indicate MuddyWater presence. </li> <ul> <li> Hunt: EDR query for SimpleHelp, Syncro, N-Able, Atera, or AnyDesk installations not deployed by IT. Check for DarkBeatC2 beaconing patterns (periodic HTTPS POST to non-standard paths). </li> <li> Indicators: RMM agent installed in non-standard directory; service running under unexpected user context. </li> </ul> <li> Hypothesis: ColdFusion webshells deployed via CVE-2026-48282. </li> <ul> <li> Hunt: File integrity monitoring on ColdFusion web roots. Search for .cfm/.jsp files created after July 1, 2026 that were not part of application deployments. </li> <li> Indicators: Path traversal strings in web logs (../ sequences); new files in upload directories with execution permissions. </li> </ul> <li> Hypothesis: ASN 213790 C2 communication from internal hosts. </li> <ul> <li> Hunt: Network flow data for any connection to 192.253.248.0/24. Include DNS queries resolving to this range. </li> <li> Indicators: Periodic beaconing (fixed intervals ± jitter); data exfiltration patterns (large outbound transfers during off-hours). </li> </ul> </ol> <h3> Blocking Guidance </h3> Deploy the following IOCs to perimeter controls, EDR, and SIEM: Network Indicators (Block/Alert): <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 192.253.248[.]180 </td> <td> ASN 213790 — Iranian APT C2 (confidence 91) </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]55 </td> <td> ASN 213790 — Iranian APT C2 (confidence 90) </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]169 </td> <td> ASN 213790 — Iranian APT C2 (confidence 97) </td> </tr> <tr> <td> IPv4 </td> <td> 95.38.162[.]107 </td> <td> ASN 202468 Arvan Cloud — Emotet/malware tagged (confidence 80) </td> </tr> <tr> <td> IPv4 </td> <td> 95.38.16[.]220 </td> <td> Iranian telecom — C2 associated </td> </tr> <tr> <td> IPv4 </td> <td> 78.38.18[.]210 </td> <td> Iranian infrastructure — threat tagged </td> </tr> <tr> <td> IPv4 </td> <td> 2.183.135[.]123 </td> <td> Iranian infrastructure — threat tagged </td> </tr> </tbody> </table> File Hashes (Block/Alert on EDR): <table> <thead> <tr> <th> SHA-256 </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> 028d3de0f0709a18c9928526519e761a08f6766d1eca386e908588f995f44e7f </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> 0a5cf97e699c8bfacee7f89ebfaa851ff03dd004a58ffde9c609fcc2cd27f250 </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> 7540bed5efd55f75271bb4b5a5afb28f343ebe64a816f74f0edba8527dc5e181 </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> 2417738503887374dae9891d26ea7033eb7b44656a14b84f15d4e8fa63e4e830 </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> 2a432edfba8a28854b9e3e34be513e96e1dc3426b1bd0976cda71ecfc5a2427c </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> ff5f7d414c6e701be02ec546c56fac589902896fe29fa0ef1e3a96d904a65134 </td> <td> Pioneer Kitten/Handala convergence </td> </tr> <tr> <td> 9f0ac7fa30e86b4015de6f77fe219cced164f317799fdc3faaf35af730a48700 </td> <td> Pioneer Kitten/Handala convergence </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds (H-ISAC, CISA). <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> Primary threat: FortiBleed credential theft enabling ransomware (INC/Lynx) deployment against banking infrastructure. <ul> <li> Immediate: Rotate all FortiGate VPN credentials. Implement certificate-based authentication for SSL-VPN where possible. </li> <li> Detection focus: Monitor for lateral movement patterns consistent with ransomware staging — reconnaissance (T1018 Remote System Discovery), credential dumping (T1003), and staging in ADMIN$ shares. </li> <li> Regulatory consideration: Prepare breach notification templates now. If FortiBleed-derived access is confirmed, assume PII exposure and engage legal counsel proactively. </li> </ul> <h3> Energy </h3> Primary threat: Cyber Av3ngers (HYDRO KITTEN / IRGC-CEC) targeting Schneider Electric Easergy MiCOM Px40 protection relays and PowerChute UPS systems. Compromise of grid protection relays could enable physical damage during fault conditions. <ul> <li> Immediate: Inventory all Easergy Px40 deployments in substations. Verify network segmentation between IT and OT. Apply ICSA-26-190-03 mitigations. </li> <li> Detection focus: Monitor for unauthorized access to relay configuration interfaces; unexpected firmware updates; PowerChute management commands outside maintenance windows (T0816 Device Restart/Shutdown). </li> <li> Resilience: Ensure manual override capability for protection relays. Test backup protection schemes independent of digital systems. </li> </ul> <h3> Healthcare </h3> Primary threat: Pioneer Kitten access brokering to ransomware operators with demonstrated healthcare targeting (H-ISAC distribution confirms sector focus). 70% probability of ransomware deployment within 7 days. <ul> <li> Immediate: Validate offline backup integrity for EHR systems. Confirm incident response retainer is active and current. </li> <li> Detection focus: FortiGate VPN logs for anomalous authentication; SimpleHelp/RMM tool installations on clinical systems; volume shadow copy deletion (T1490). </li> <li> Operational continuity: Ensure downtime procedures are documented and staff-trained for EHR unavailability. Pre-position communication templates for patient notification. </li> </ul> <h3> Government </h3> Primary threat: DHS HSIN breach demonstrates Iranian capability to maintain persistent access to emergency coordination systems. ColdFusion exploitation (CVE-2026-48282) targets government web infrastructure. <ul> <li> Immediate: Audit all ColdFusion instances — patch or isolate. Review HSIN access logs for anomalous activity. </li> <li> Detection focus: Webshell indicators on government web servers; authentication anomalies on inter-agency coordination platforms; data exfiltration to Iranian ASNs. </li> <li> Strategic concern: Pioneer Kitten's DIB pre-positioning (quiet for 31+ days) may indicate dormant access in defense contractor networks. Commission proactive threat hunt. </li> </ul> <h3> Aviation & Logistics </h3> Primary threat: Supply chain compromise via FortiGate VPN access to logistics networks. Iranian actors have historically targeted transportation for both espionage and disruption. <ul> <li> Immediate: Verify FortiGate firmware versions across all sites. Segment operational technology (baggage handling, flight management) from corporate VPN. </li> <li> Detection focus: Unusual VPN access patterns from logistics partner connections; lateral movement toward operational systems; unauthorized RMM tools on OT-adjacent systems. </li> <li> Supply chain: Assess third-party logistics partners' FortiGate exposure. Require attestation of credential rotation from critical vendors. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Block ASN 213790 IP range (192.253.248.0/24) at perimeter and add all 7 IPs above to SIEM watchlist with high-priority alerting </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Deploy all 7 Pioneer Kitten/Handala SHA-256 hashes to EDR block lists (CrowdStrike, Defender, SentinelOne) </td> </tr> <tr> <td> 3 </td> <td> IT Ops </td> <td> Verify Adobe ColdFusion patched beyond 2025.9/2023.20 — if unpatched, isolate from internet immediately (CVE-2026-48282, CVSS 10.0, actively exploited) </td> </tr> <tr> <td> 4 </td> <td> IT Ops </td> <td> Verify Joomla SP Page Builder patched against CVE-2026-48908 — remove or isolate if unpatched </td> </tr> <tr> <td> 5 </td> <td> IR Lead </td> <td> Pre-stage incident response playbook for ransomware scenario. Confirm backup restoration has been tested within last 30 days </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 6 </td> <td> IT Ops </td> <td> Emergency rotation of ALL FortiGate VPN credentials. Revoke stale SSL-VPN certificates. Assume compromise if running affected firmware </td> </tr> <tr> <td> 7 </td> <td> SOC </td> <td> Hunt for unauthorized RMM tools (SimpleHelp, Syncro, N-Able, Atera, DarkBeatC2) — MuddyWater's confirmed C2 channels </td> </tr> <tr> <td> 8 </td> <td> OT Security </td> <td> Assess exposure to Schneider Easergy MiCOM Px40 and PowerChute Serial Shutdown. Apply ICSA-26-190-02 and ICSA-26-190-03 mitigations </td> </tr> <tr> <td> 9 </td> <td> SOC </td> <td> Implement detection for ColdFusion webshell deployment — file integrity monitoring on all CF web roots </td> </tr> <tr> <td> 10 </td> <td> Network </td> <td> Audit firewall rules for any legacy allow-rules to Iranian ASNs (213790, 202468, 58224, 44244) </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 11 </td> <td> CISO </td> <td> Commission proactive threat hunt for dormant Pioneer Kitten/Fox Kitten access in VPN infrastructure (Fortinet, Pulse Secure, Citrix). 31+ days of silence on DIB targeting is a red flag, not an all-clear </td> </tr> <tr> <td> 12 </td> <td> CISO </td> <td> Evaluate migration from password-based VPN authentication to certificate + MFA for all remote access </td> </tr> <tr> <td> 13 </td> <td> OT Security </td> <td> Conduct tabletop exercise simulating Cyber Av3ngers attack on grid protection relays. Test manual override procedures </td> </tr> <tr> <td> 14 </td> <td> IR Lead </td> <td> Update IR playbook to address the espionage-to-destruction pipeline: assume any Iranian intrusion may pivot from data theft to wiper deployment </td> </tr> <tr> <td> 15 </td> <td> Executive </td> <td> Brief board on Iranian cyber threat posture. The criminal-state nexus means ransomware insurance assumptions may not hold — "ransomware" may actually be state-directed destruction with no decryption possible </td> </tr> </tbody> </table> <h2> The Bottom Line </h2> We are 132 days into this conflict, and Iran's cyber operations have matured from opportunistic exploitation to industrialized access brokering. The FortiBleed pipeline is not a vulnerability — it is a supply chain feeding both state espionage and criminal ransomware at scale. The convergence of five distinct threat groups on shared malware samples signals that traditional actor-based attribution is becoming unreliable; what matters now is the campaign , not the label. Three decisions require executive attention this week: <ol> <li> Authorize emergency FortiGate credential rotation. Every day of delay extends the window for ransomware operators holding valid credentials. </li> <li> Fund a proactive threat hunt for dormant access. Thirty-one days of silence on defense industrial base targeting means either the adversary has stopped — or they're already inside and don't need new infrastructure. </li> <li> Accept that ransomware may be destruction. When the same IRGC unit brokers access to both criminal ransomware operators and destructive teams, the distinction between "pay the ransom" and "wiper with a ransom note" becomes meaningless for planning purposes. </li> </ol> The diplomatic window in Geneva has not produced de-escalation in cyberspace. Iranian operators are staging, not standing down. Act accordingly. Anomali CTI Desk | 2026-07-10 | TLP:GREEN IOCs and enrichment data available through ThreatStream Next-Gen. Contact your account team for feed integration.

FEATURED RESOURCES

July 10, 2026

Anomali Cyber Watch