Iranian Cyber Operations Reach Sustained Pre-Positioning Tempo: What CISOs Must Know Now

Anomali Threat Research

Published on

July 3, 2026

Table of Contents

Threat Assessment Level: HIGH <h2> Executive Summary </h2> We are now approximately four months into what Israel's National Cyber Directorate has characterized as an unprecedented Iranian cyber offensive — approximately 4,800 incidents per month as of June 2026, triple the volume from one year prior. US officials have explicitly stated that preliminary diplomatic negotiations will not reduce Iranian cyber activity. Today's intelligence paints a picture of an adversary in active infrastructure refresh mode: six Iranian threat actor profiles updated between July 1–3, confirmed command-and-control nodes operating at high confidence on Tehran-based hosting, and an expanding ICS/OT attack surface that now includes satellite communications and space systems. The absence of destructive payloads this week is not reassurance — it is consistent with pre-positioning behavior ahead of a potential escalation trigger. This blog provides actionable intelligence for CISOs operating in financial services, energy, healthcare, government, and aviation/logistics sectors. <h2> What Changed (Last 72 Hours) </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 2026-07-03 </td> <td> Six Iranian APT actor profiles updated (MuddyWater, Pioneer Kitten/UNC757, APT34, APT42, UNC5855, UNC2428) across July 1–3 </td> <td> Coordinated infrastructure refresh consistent with pre-campaign preparation </td> </tr> <tr> <td> 2026-07-03 </td> <td> FBI warns of TeamPCP supply chain campaign targeting developer CI/CD pipelines and cloud credentials </td> <td> New credential theft vector; overlaps with Iranian access-brokering patterns </td> </tr> <tr> <td> 2026-07-03 </td> <td> UAE cybersecurity authority thwarts sophisticated attacks on financial sector (dual-sourced: Khaleej Times + Gulf News) </td> <td> Gulf state financial infrastructure remains actively targeted </td> </tr> <tr> <td> 2026-07-03 </td> <td> Two ransomware groups announce unprecedented joint campaign collaboration </td> <td> Potential escalation of Iranian access-broker → ransomware handoff model </td> </tr> <tr> <td> 2026-07-02 </td> <td> DHS confirms breach of Homeland Security Information Network (HSIN) </td> <td> Adversary access to US defensive posture data; BDA collection goldmine </td> </tr> <tr> <td> 2026-07-02 </td> <td> CISA publishes 10 ICS/OT advisories including Schneider Electric EasyLogic/Saitel RTU , satellite comms, and space systems </td> <td> Exact SCADA hardware previously targeted by Iranian proxy Cyber Av3ngers </td> </tr> <tr> <td> 2026-07-01 </td> <td> CVE-2026-45659 (SharePoint RCE) added to CISA KEV catalog; 10,000+ internet-facing servers exposed </td> <td> Active exploitation confirmed; Iranian actors historically exploit SharePoint </td> </tr> <tr> <td> 2026-07-01 </td> <td> 81 million+ Azure CLI password spray attempts against 78 Microsoft accounts </td> <td> Technique consistent with MuddyWater/APT33 credential harvesting </td> </tr> </tbody> </table> <h2> Conflict & Threat Timeline (February–July 2026) </h2> <table> <thead> <tr> <th> Period </th> <th> Phase </th> <th> Key Events </th> </tr> </thead> <tbody> <tr> <td> Late Feb 2026 </td> <td> Escalation trigger </td> <td> Iran-Israel conflict intensifies; cyber operations surge begins </td> </tr> <tr> <td> Mar–Apr 2026 </td> <td> Initial surge </td> <td> Iranian APT groups activate dormant infrastructure; wiper deployments (BiBiWiper, ZeroShred) </td> </tr> <tr> <td> May 2026 </td> <td> Access brokering </td> <td> Pioneer Kitten/UNC757 mass exploitation of Fortinet appliances (FortiBleed); 430,000 firewalls targeted </td> </tr> <tr> <td> Jun 2026 </td> <td> Convergence </td> <td> FortiBleed linked to INC Ransom/Lynx ransomware (354 intrusions, 12 ransomware deployments); Handala Hack Team establishes persistent C2 </td> </tr> <tr> <td> Late Jun–Jul 2026 </td> <td> Pre-positioning </td> <td> Infrastructure refresh on ASN 213790; 6 actor profiles updated in 72 hours; ICS attack surface expanding; operational pauses by destructive actors </td> </tr> </tbody> </table> We are now approximately 125 days into sustained elevated operations — with no indicators of de-escalation. <h2> Key Threat Analysis </h2> <h3> 1. Iranian APT C2 Infrastructure Refresh — ASN 213790 Cluster </h3> Three Tehran-based IPs on ASN 213790 ("Limited Network") are confirmed active at high confidence, alongside nodes on ASN 41881 ("Fanava Group") and ASN 60631 ("Vandad Vira Hooman"). This infrastructure pattern suggests a shared procurement unit — likely a single IRGC logistics element provisioning C2 for multiple operational teams. Named Actors: <ul> <li> MuddyWater (MOIS-affiliated) — Active daily POWERSTATS credential harvesting; C2 node corroborated across three independent sources </li> <li> Pioneer Kitten / UNC757 (IRGC-affiliated) — 80+ days of operational silence consistent with pre-positioning; updated July 1; linked to Citrix CVE-2023-3519 exploitation campaign </li> <li> APT34 (OilRig) — Profile updated July 3 </li> <li> APT42 (Charming Kitten, IRGC-IO-affiliated) — Profile updated July 3; BELLACIAO campaign listed as active </li> <li> UNC5855 — Updated July 3 </li> <li> UNC2428 — Updated July 1 </li> </ul> Proxy/Hacktivist Groups: <ul> <li> Handala Hack Team / BANISHED KITTEN (IRGC-affiliated) — C2 at handala[.]red active; intelligence indicates expansion to physical threats; currently in operational pause (no Telegram leaks for 5+ days) </li> <li> Cyber Av3ngers / HYDRO KITTEN (IRGC-CEC-affiliated) — IOCONTROL malware updated June 24; no deployment reports since </li> <li> DieNet, 313 Team — Monitored; no new activity this cycle </li> </ul> <h3> 2. FortiBleed → Ransomware Pipeline (Confirmed) </h3> The mass credential-harvesting campaign exploiting Fortinet appliances (430,000 targeted) has been formally linked to INC Ransom and Lynx ransomware operations. Pioneer Kitten/UNC757 operates as the access broker, selling initial access to ransomware operators — a model that now appears to be expanding with reports of unprecedented ransomware group collaboration. Key concern: This actor bridges espionage, destructive operations, and criminal monetization simultaneously, making intent assessment uniquely challenging. A single compromised Fortinet appliance could lead to espionage collection, ransomware deployment, or destructive wiper — depending on the geopolitical moment. <h3> 3. ICS/OT Attack Surface Expansion </h3> Ten new ICS advisories in three days represent an accelerating expansion of the operational technology attack surface: <table> <thead> <tr> <th> Advisory </th> <th> System </th> <th> Risk </th> </tr> </thead> <tbody> <tr> <td> Schneider Electric EasyLogic T150 </td> <td> Power distribution RTU </td> <td> Exact hardware targeted by Cyber Av3ngers </td> </tr> <tr> <td> Schneider Electric Saitel DP RTU </td> <td> SCADA remote terminal </td> <td> Water/energy infrastructure </td> </tr> <tr> <td> Mitsubishi MELSOFT Update Manager </td> <td> Industrial automation </td> <td> Local tampering/destruction </td> </tr> <tr> <td> StoneFly Storage Concentrator </td> <td> Industrial storage </td> <td> Arbitrary command execution </td> </tr> <tr> <td> ST Engineering iDirect iQ-Series </td> <td> Satellite communications </td> <td> Military C2 dependency </td> </tr> <tr> <td> CubeSpace CW0057 Reaction Wheel </td> <td> Space systems </td> <td> Arbitrary firmware upload </td> </tr> <tr> <td> XZ Utils / B&R Products </td> <td> Industrial automation </td> <td> Supply chain backdoor </td> </tr> <tr> <td> Schneider EcoStruxure IT </td> <td> Data center management </td> <td> Critical infrastructure </td> </tr> </tbody> </table> The inclusion of satellite communications and space systems represents a new attack surface category with direct relevance to military command-and-control in the Iran-Israel theater. <h3> 4. DHS HSIN Breach — Intelligence Exposure Risk </h3> The confirmed breach of the Homeland Security Information Network exposes law enforcement sensitive (LES) threat data shared across federal, state, and local agencies. If Iranian actors gained access — directly or through a third party — they could: <ul> <li> Map US defensive posture and identify intelligence gaps </li> <li> Conduct battle damage assessment on previous operations </li> <li> Identify underdefended critical infrastructure targets </li> <li> Understand which of their operations have been detected </li> </ul> <h3> 5. Supply Chain Credential Theft Campaigns </h3> Two parallel campaigns target developer environments for cloud credential theft: <ul> <li> TeamPCP (FBI warning, July 3): Compromised packages targeting CI/CD pipelines </li> <li> Mastra npm infostealer : Previously identified supply chain credential theft </li> </ul> Both campaigns align with Iranian actors' documented interest in cloud credential harvesting for pre-positioning and lateral movement into production environments. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Indicators to Watch </th> </tr> </thead> <tbody> <tr> <td> Iranian actor infrastructure refresh precedes new campaign launch </td> <td> 60% </td> <td> 7–14 days </td> <td> New domains registered on ASN 213790; spearphishing waves targeting government/defense </td> </tr> <tr> <td> Handala operational pause ends with IO dump targeting Israeli entities </td> <td> 40% </td> <td> 3–10 days </td> <td> Telegram channel activity; new persona creation; timed to diplomatic/military trigger </td> </tr> <tr> <td> Pioneer Kitten leverages ransomware collaboration for new DIB access-brokering operation </td> <td> 25% </td> <td> 14–30 days </td> <td> New Citrix/Fortinet exploitation; ransomware group claiming DIB victims </td> </tr> <tr> <td> Cyber Av3ngers weaponize Schneider RTU advisory for water/energy targeting </td> <td> 35% </td> <td> 14–30 days </td> <td> IOCONTROL deployment reports; Telegram claims; anomalous PLC communications </td> </tr> <tr> <td> HSIN breach data used for BDA-informed targeting of previously "safe" infrastructure </td> <td> 20% </td> <td> 30–60 days </td> <td> Targeting of entities that shared sensitive data via HSIN; unusually precise adversary knowledge </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> <ol> <li> Iranian C2 Communication ( T1071 — Application Layer Protocol, T1571 — Non-Standard Port) </li> </ol> Hunt for any egress traffic to ASN 213790 (Limited Network, Tehran), ASN 41881 (Fanava Group), or ASN 60631 (Vandad Vira Hooman). Any outbound connection from a Western enterprise to these ASN ranges is anomalous and warrants immediate investigation. Hunting hypothesis: If MuddyWater has established persistence via DLL side-loading (T1574.002), compromised hosts will beacon to C2 infrastructure on non-standard ports using encrypted channels (T1573). Look for periodic HTTPS connections to IPs in the 192.253.248.0/24 range with unusual certificate properties. <ol start="2"> <li> Credential Spray Detection ( T1110.003 — Password Spraying, T1078.004 — Cloud Accounts) </li> </ol> Filter Azure AD/Entra ID logs for: <ul> <li> \>100 failed authentication attempts from a single source IP within a 1-hour window </li> <li> Targeting of service principals and Azure CLI endpoints specifically </li> <li> Authentication attempts using legacy protocols (IMAP, SMTP, POP3) against cloud accounts </li> </ul> Hunting hypothesis: If the 81M-attempt spray campaign is Iranian-attributed, successful authentications will be followed by T1528 (Steal Application Access Token) and T1087.004 (Cloud Account Discovery) within 24 hours. <ol start="3"> <li> Supply Chain Compromise Indicators ( T1195.001 — Compromise Software Dependencies) </li> </ol> Monitor CI/CD pipelines for: <ul> <li> Unexpected package installations or dependency changes </li> <li> Outbound connections from build servers to unknown infrastructure </li> <li> Cloud credential access from build/dev environments to production resources </li> <li> GitHub Actions running unverified or unpinned third-party actions </li> </ul> Hunting hypothesis: TeamPCP compromised packages will attempt T1552.001 (Credentials in Files) — scanning environment variables, .env files, and cloud credential stores — followed by T1078.004 (Cloud Accounts) for persistence. <ol start="4"> <li> ICS/OT Anomaly Detection ( T1495 — Firmware Corruption, T1565.001 — Stored Data Manipulation) </li> </ol> For organizations with Schneider Electric EasyLogic/Saitel RTUs: <ul> <li> Monitor for unauthorized firmware update attempts </li> <li> Alert on configuration changes outside maintenance windows </li> <li> Baseline normal PLC communication patterns and alert on deviations </li> <li> Watch for reconnaissance scanning of SCADA management interfaces from IT network segments </li> </ul> Hunting hypothesis: Cyber Av3ngers' historical pattern is to exploit internet-exposed OT management interfaces (T1190), then modify PLC logic (T1565.001). Pre-attack reconnaissance will appear as authenticated access to HMI/SCADA web interfaces from unusual source IPs. <h3> Detection Rules to Implement </h3> <table> <thead> <tr> <th> Rule </th> <th> ATT&CK </th> <th> Priority </th> </tr> </thead> <tbody> <tr> <td> Egress to ASN 213790/41881/60631 </td> <td> T1071, T1571 </td> <td> Critical </td> </tr> <tr> <td> Azure CLI auth failures >100/hr from single source </td> <td> T1110.003 </td> <td> High </td> </tr> <tr> <td> DLL side-loading from non-standard paths </td> <td> T1574.002 </td> <td> High </td> </tr> <tr> <td> New package installations in CI/CD without approval </td> <td> T1195.001 </td> <td> High </td> </tr> <tr> <td> Schneider RTU firmware modification outside change window </td> <td> T1495 </td> <td> Critical (OT environments) </td> </tr> <tr> <td> Service principal token access from build environments </td> <td> T1528 </td> <td> Medium </td> </tr> </tbody> </table> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> Primary threat: UAE financial sector attacks confirmed (dual-sourced); Iranian proxies historically target SWIFT-connected institutions and payment processors in Gulf states and allied nations. Actions: <ul> <li> Review all SWIFT Alliance Lite2 and messaging interface access logs for anomalous authentication patterns </li> <li> Ensure transaction monitoring systems alert on bulk data staging (T1074) from core banking systems </li> <li> Validate that DDoS mitigation is active — Iranian hacktivists frequently combine data theft with disruptive DDoS as cover </li> <li> Audit third-party fintech integrations for supply chain credential exposure (TeamPCP relevance) </li> </ul> <h3> Energy </h3> Primary threat: Schneider Electric EasyLogic/Saitel RTU vulnerabilities directly affect power distribution and water treatment SCADA systems — the exact infrastructure Cyber Av3ngers have previously targeted with IOCONTROL malware. Actions: <ul> <li> Immediately inventory all Schneider EasyLogic T150 and Saitel DP RTU deployments </li> <li> Verify network segmentation between IT and OT — ensure no direct internet exposure of RTU management interfaces </li> <li> Deploy passive OT network monitoring (e.g., Claroty, Nozomi, Dragos) if not already in place </li> <li> Review and test incident response playbooks for OT/ICS scenarios specifically </li> <li> Coordinate with sector ISAC on Cyber Av3ngers indicator sharing </li> </ul> <h3> Healthcare </h3> Primary threat: OFFIS DCMTK medical imaging vulnerability (file write/info disclosure) in the current ICS advisory batch; ransomware group collaboration increases likelihood of healthcare targeting for maximum pressure. Actions: <ul> <li> Audit DCMTK/DICOM implementations across radiology and imaging systems </li> <li> Ensure medical device network segments cannot reach internet directly </li> <li> Validate offline backup integrity for electronic health records — ransomware groups increasingly target healthcare for rapid payment </li> <li> Review business associate agreements for supply chain credential exposure </li> </ul> <h3> Government </h3> Primary threat: DHS HSIN breach exposes interagency threat sharing data; MuddyWater (MOIS) actively targets government entities with POWERSTATS credential harvesting; Azure CLI spray campaign targets government cloud tenants. Actions: <ul> <li> Assess organizational exposure to HSIN — what information was shared via the platform that could inform adversary targeting? </li> <li> Implement phishing-resistant MFA (FIDO2/hardware keys) for all privileged accounts — password spray is ineffective against hardware tokens </li> <li> Hunt for POWERSTATS indicators: PowerShell execution with encoded commands (T1059.001) connecting to known MuddyWater C2 infrastructure </li> <li> Review and restrict Azure CLI access to named service principals with conditional access policies </li> </ul> <h3> Aviation / Logistics </h3> Primary threat: Pioneer Kitten/UNC757 fake resume lures on GitHub targeting aerospace sector (updated July 2); satellite communications vulnerabilities (iDirect terminals) affect aviation and maritime logistics C2 dependencies. Actions: <ul> <li> Brief HR/recruiting teams on fake resume lure TTPs — verify all candidate-provided GitHub repositories before execution in any environment </li> <li> Audit satellite communications terminal firmware (iDirect iQ-Series) if used for fleet tracking or logistics coordination </li> <li> Review Fortinet appliance patching status — FortiBleed campaign specifically targeted organizations in aerospace supply chain </li> <li> Ensure CI/CD pipelines used in avionics software development are hardened against TeamPCP-style supply chain attacks </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Block confirmed Iranian APT C2 IPs at perimeter: 192.253.248[.]55, 192.253.248[.]169, 171.22.27[.]16, 77.90.185[.]253, 95.38.16[.]220, 157.20.182[.]49 </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Hunt for Azure CLI password spray in Entra ID logs — filter for >100 failed auth from single source within 1hr targeting service principals </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Create network detection for any egress to ASN 213790 (Limited Network, Tehran) — any connection is anomalous for Western organizations </td> </tr> <tr> <td> 4 </td> <td> IT Ops </td> <td> Verify CVE-2026-45659 (SharePoint RCE) patching status — 10,000+ servers exposed; active exploitation confirmed via CISA KEV </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> IT Ops / OT </td> <td> Audit Schneider Electric EasyLogic T150 and Saitel DP RTU firmware in all SCADA environments; apply vendor patches per ICSA-26-181-04 </td> </tr> <tr> <td> 6 </td> <td> DevOps </td> <td> Audit CI/CD pipelines for TeamPCP indicators; pin all dependencies to verified hashes; enable GitHub Actions artifact verification </td> </tr> <tr> <td> 7 </td> <td> SOC </td> <td> Deploy detection for DLL side-loading (T1574.002) from non-standard paths — primary MuddyWater persistence mechanism </td> </tr> <tr> <td> 8 </td> <td> Identity </td> <td> Implement conditional access policies restricting Azure CLI authentication to managed devices and named service principals only </td> </tr> <tr> <td> 9 </td> <td> HR </td> <td> Brief recruiting teams on Iranian fake resume/GitHub lure campaign targeting aerospace — verify all candidate code repositories before execution </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 10 </td> <td> CISO </td> <td> Assess satellite communications dependencies (iDirect terminals) in supply chain; request vendor security assessment per ICSA-26-183-01 </td> </tr> <tr> <td> 11 </td> <td> CISO </td> <td> Commission review of HSIN exposure — assess what information was shared via the platform and potential adversary exploitation </td> </tr> <tr> <td> 12 </td> <td> CISO </td> <td> Conduct tabletop exercise simulating Pioneer Kitten access-brokering → ransomware deployment scenario against your environment </td> </tr> <tr> <td> 13 </td> <td> IR Team </td> <td> Update incident response playbooks to include OT/ICS wiper scenarios — ensure playbooks address Schneider RTU recovery procedures </td> </tr> <tr> <td> 14 </td> <td> CISO </td> <td> Evaluate OT network monitoring deployment (Claroty/Nozomi/Dragos) if passive monitoring is not currently in place for SCADA environments </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> The following IOCs are confirmed active Iranian APT infrastructure. Block at perimeter firewalls, add to threat intelligence platforms, and hunt for historical connections in network logs. <table> <thead> <tr> <th> IOC </th> <th> Type </th> <th> Attribution/Context </th> <th> Confidence </th> </tr> </thead> <tbody> <tr> <td> 192.253.248[.]55 </td> <td> IPv4 </td> <td> ASN 213790, Limited Network (Tehran); Scanner </td> <td> High </td> </tr> <tr> <td> 192.253.248[.]169 </td> <td> IPv4 </td> <td> ASN 213790; LockBit overlap; T1071/T1571 </td> <td> High </td> </tr> <tr> <td> 171.22.27[.]16 </td> <td> IPv4 </td> <td> ASN 60631, Vandad Vira Hooman </td> <td> Moderate </td> </tr> <tr> <td> 77.90.185[.]253 </td> <td> IPv4 </td> <td> ASN 213790; Scanner; chemical sector targeting </td> <td> High </td> </tr> <tr> <td> 95.38.16[.]220 </td> <td> IPv4 </td> <td> ASN 41881, Fanava Group; dropper/malware </td> <td> High </td> </tr> <tr> <td> 157.20.182[.]49 </td> <td> IPv4 </td> <td> MuddyWater C2; DLL side-loading campaign (May 2026); 3-source corroboration </td> <td> High </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. <h2> The Bottom Line </h2> Four months into this conflict, Iranian cyber operations show no signs of de-escalation. The current operational tempo — infrastructure refresh, actor profile updates, ICS vulnerability expansion, and supply chain targeting — is consistent with a force preparing for the next phase, not winding down. The convergence of Pioneer Kitten's access brokering, ransomware group collaboration, and expanding ICS/OT vulnerabilities creates a threat environment where a single compromised appliance can cascade into espionage, ransomware, or destructive attack depending on geopolitical conditions outside your control. Three things you can do today: <ol> <li> Block the six C2 IPs above. This is free, immediate, and confirmed high-confidence. </li> <li> Patch CVE-2026-45659 (SharePoint RCE). It's on the KEV catalog. Active exploitation is confirmed. If you have internet-facing SharePoint, you are in the target set. </li> <li> Ask your OT team one question: "Do we have Schneider EasyLogic or Saitel RTUs, and are they patched?" If the answer is "I don't know," that's your 30-day project. </li> </ol> The adversary is patient. They are building access now to use later. Your window to find and evict them is before the next geopolitical trigger — not after. Published 2026-07-03 by the Anomali CTI Desk. For questions or additional indicators, contact your Anomali account team or access ThreatStream Next-Gen for the full IOC feed associated with this report.

FEATURED RESOURCES

July 3, 2026

Anomali Cyber Watch