Iranian Cyber Retaliation Is No Longer Theoretical — It's Happening Now

Anomali Threat Research

Published on

July 24, 2026

Table of Contents

Threat Assessment Level: CRITICAL   <h2> Executive Summary </h2> On 23 July 2026, a joint FBI/NSA/DOE/CISA advisory confirmed what threat intelligence analysts have been warning about for weeks: Iranian state-backed hackers are actively disrupting US water and energy infrastructure. They are reprogramming programmable logic controllers (PLCs) to disable safety shutdowns and create physically unsafe conditions at critical facilities. This is not a theoretical risk assessment. This is confirmed, ongoing, destructive cyber activity against American critical infrastructure — timed precisely to the Iranian retaliation window following US kinetic strikes on Iranian nuclear facilities in late June 2026. If your organization operates industrial control systems, VPN edge devices, or sits within the defense industrial base supply chain, this blog demands your immediate attention.   <h2> What Changed </h2> The past 72 hours have produced a convergence of threat indicators that collectively represent the most dangerous Iranian cyber posture since the US-Iran conflict escalated in February 2026: <ol> <li> Active ICS Disruption Confirmed — Iranian actors are manipulating Rockwell, Schneider Electric, and Siemens PLCs at US water and energy providers, disabling alarms and shutdown processes. </li> <li> Hacktivist Group Handala Claims New Victims — Cal Water (California) breached; medical technology firm Stryker suffered a remote wipe of tens of thousands of devices via Intune/MDM abuse. </li> <li> 75,000 FortiGate Firewalls Compromised — The "Fortibleed" campaign has harvested credentials from an unprecedented number of VPN appliances, many potentially belonging to critical infrastructure operators. </li> <li> CVE-2026-0257 Under Active Exploitation — A CVSS 9.1 Palo Alto GlobalProtect authentication bypass is being weaponized by Qilin ransomware within days of disclosure. </li> <li> Iranian C2 Infrastructure Refreshed Today — Remcos RAT command-and-control nodes on Iranian academic and telecom infrastructure were updated on 24 July 2026, indicating active operational tempo. </li> <li> Seven ICS Advisories Published Simultaneously — Including vulnerabilities in foundational IEC 61850/60870 protocol libraries used across energy grid SCADA systems globally. </li> <li> MuddyWater Dalbit Ransomware Crossover Expanding — MOIS-affiliated MuddyWater refreshed Dalbit ransomware samples in late July, broadening targeting to defense, manufacturing, and healthcare sectors as espionage-under-ransomware-cover operations continue. </li> <li> APT34/OilRig HOLLOWGRAPH Implant Active — MOIS-affiliated APT34/OilRig continues operating the HOLLOWGRAPH implant, abusing Microsoft 365 Graph API for covert C2 communications that blend with legitimate cloud traffic. </li> <li> Russian-Iranian Infrastructure Convergence Identified — LockBit ransomware infrastructure tags co-located with Iranian hosting on ASN 213790, suggesting shared bulletproof hosting or active criminal infrastructure cooperation between Russian and Iranian actors. </li> </ol>   <h2> Conflict & Threat Timeline </h2>   <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 28 Feb 2026 </td> <td> US-Iran conflict escalates </td> <td> Cyber operations tempo increases (~147 days ago) </td> </tr> <tr> <td> 26 Jun 2026 </td> <td> US Operation Midnight Hammer strikes Iranian nuclear facilities </td> <td> Primary kinetic trigger for cyber retaliation </td> </tr> <tr> <td> 27 Jun 2026 </td> <td> New strikes in Strait of Hormuz; US attacks missile/drone sites in Iran </td> <td> Ceasefire fractures </td> </tr> <tr> <td> 28 Jun 2026 </td> <td> US strikes 10 targets in Iran; Iran fires missiles at Bahrain and Kuwait </td> <td> Full kinetic exchange </td> </tr> <tr> <td> 29 Jun 2026 </td> <td> Doha talks announced after "weekend of armed exchanges" </td> <td> Diplomatic window opens </td> </tr> <tr> <td> 30 Jun 2026 </td> <td> Tehran says "no negotiations planned" </td> <td> Diplomatic window closes </td> </tr> <tr> <td> ~27 Jun 2026 </td> <td> Pro-Iranian hacktivist groups enter operational silence (Day 27 as of today) </td> <td> Assessed as coordinated strike preparation </td> </tr> <tr> <td> Jun 2026 </td> <td> Handala breaches Cal Water; wipes Stryker devices via MDM </td> <td> Destructive operations confirmed </td> </tr> <tr> <td> Jun 2026 </td> <td> "Fortibleed" campaign compromises 75,000 FortiGate firewalls </td> <td> Mass initial access harvesting </td> </tr> <tr> <td> 12 Jul 2026 </td> <td> Iranian C2 infrastructure on ASN 34918 confirmed active </td> <td> Pre-positioning continues </td> </tr> <tr> <td> 22 Jul 2026 </td> <td> CVE-2026-16232 (Check Point SmartConsole, CVSS 9.1) added to CISA KEV </td> <td> Edge device exploitation accelerates </td> </tr> <tr> <td> 23 Jul 2026 </td> <td> Joint FBI/NSA/DOE/CISA advisory: Iranian hackers disrupting US water/energy PLCs </td> <td> Active disruption confirmed </td> </tr> <tr> <td> 23 Jul 2026 </td> <td> CISA publishes 7 ICS advisories including libIEC61850/lib60870 </td> <td> Attack surface expands </td> </tr> <tr> <td> 24 Jul 2026 </td> <td> CVE-2026-0257 (Palo Alto GlobalProtect, CVSS 9.1) actively exploited by Qilin </td> <td> VPN edge exploitation surge </td> </tr> <tr> <td> 24 Jul 2026 </td> <td> Iranian Remcos RAT C2 infrastructure refreshed </td> <td> Active operational tempo confirmed </td> </tr> </tbody> </table>     <h2> Key Threat Analysis </h2> <h3> Iranian State Operations Against ICS/OT (CRITICAL) </h3> The joint advisory from FBI, NSA, DOE, and CISA represents the clearest public confirmation of Iranian destructive cyber operations against US critical infrastructure. The attackers are: <ul> <li> Targeting internet-exposed PLCs from Rockwell Automation, Schneider Electric, and Siemens </li> <li> Reprogramming controller logic to disable safety alarms and emergency shutdowns </li> <li> Manipulating operational data to mask unsafe conditions from operators </li> <li> Creating conditions that could result in physical harm to personnel and communities </li> </ul> This activity maps directly to MITRE ATT&CK for ICS techniques including Module Firmware manipulation (T0839), Loss of Availability (T0826), and Manipulation of Control (T0831). <h3> The Pioneer Kitten → Ransomware Pipeline (HIGH) </h3> Pioneer Kitten (also tracked as Fox Kitten/UNC757), an IRGC-affiliated initial access broker, continues to operate its documented playbook: exploit VPN edge devices, establish persistence, then sell access to ransomware operators. The current threat landscape shows this pipeline operating at unprecedented scale: <ul> <li> Qilin ransomware is deploying within days of CVE-2026-0257 (Palo Alto GlobalProtect) disclosure </li> <li> Akira is exploiting Ivanti, Cisco, and Fortinet VPN appliances </li> <li> Cactus ransomware and IcedID loader have been identified on Iranian infrastructure (ASN 34918), suggesting a new ransomware family has entered the Iranian access-broker ecosystem </li> <li> The Fortibleed campaign's 75,000 compromised FortiGate firewalls represents a potential mass-activation scenario </li> </ul> Qilin was the most active ransomware group in Q2 2026, responsible for 14% of all attacks according to NCC Group data. <h3> MuddyWater Dalbit Ransomware Crossover (HIGH) </h3> MuddyWater (MOIS-affiliated) refreshed Dalbit ransomware crossover samples in late July, expanding targeting to defense, manufacturing, and healthcare sectors. This represents espionage operations using ransomware as cover — a technique that complicates attribution and delays incident response by misdirecting defenders toward criminal rather than state-sponsored hypotheses. <h3> APT34/OilRig HOLLOWGRAPH Implant (HIGH) </h3> APT34/OilRig (MOIS-affiliated) continues operating the novel HOLLOWGRAPH implant, which abuses Microsoft 365 Graph API for covert command-and-control communications. This technique blends C2 traffic with legitimate Microsoft cloud service communications, making network-based detection extremely difficult without deep inspection of Graph API call patterns. <h3> Hacktivist Operational Silence — Day 27 (HIGH) </h3> Pro-Iranian hacktivist groups including Handala , Cyber Av3ngers , and Banished Kitten have maintained operational silence for 27 days — far exceeding their historical 7–14 day operational cycle. This prolonged silence, combined with confirmed recent operations (Cal Water breach, Stryker device wipe), is assessed as coordinated preparation for a large-scale destructive or influence operation. The last time these groups went silent for this duration, the subsequent operation was significantly more destructive than their baseline activity. <h3> Russian-Iranian Infrastructure Convergence (MODERATE) </h3> Intelligence collection identified LockBit ransomware infrastructure tags co-located with Iranian hosting on ASN 213790 ("Limited Network"). While LockBit is Russian-affiliated, this overlap suggests either shared bulletproof hosting arrangements or active Russian-Iranian criminal infrastructure cooperation — a trend that complicates attribution and expands the threat actor ecosystem operating from Iranian network space.   <h2> Predictive Analysis </h2> Based on the convergence of confirmed active operations, kinetic escalation triggers, and historical Iranian cyber retaliation patterns, we assess the following probabilities over the next 7–14 days:   <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional Iranian destructive operations against US critical infrastructure (water, energy) </td> <td> 75% (HIGH) </td> <td> Joint advisory confirms active intrusions; retaliation motivation at peak; 24–28 day post-kinetic window matches historical pattern </td> </tr> <tr> <td> Handala coordinated data dump / influence operation </td> <td> 50% (MODERATE) </td> <td> 27-day silence with confirmed data exfiltration (Cal Water); likely timed to diplomatic failure </td> </tr> <tr> <td> Pioneer Kitten activation of dormant access in defense industrial base networks </td> <td> 45% (MODERATE) </td> <td> 75K FortiGate compromise provides unprecedented access pool; 117-day quiet period on DIB targeting suggests pre-positioning complete </td> </tr> <tr> <td> Escalation to ICS-destructive (not just disruptive) operations targeting energy grid substations </td> <td> 30% (LOW-MODERATE) </td> <td> libIEC61850/lib60870 vulnerabilities expand attack surface; Cyber Av3ngers have demonstrated intent; capability gap may limit execution </td> </tr> <tr> <td> Mass ransomware deployment via Fortibleed access across multiple sectors simultaneously </td> <td> 40% (MODERATE) </td> <td> Pioneer Kitten→Qilin/Cactus pipeline confirmed; 75K device compromise enables scale; financial motivation supplements strategic objectives </td> </tr> </tbody> </table>     <h2> SOC Operational Guidance </h2> <h3> Priority Detection Rules </h3>   <table> <thead> <tr> <th> ATT&CK Technique </th> <th> Detection Focus </th> <th> Guidance </th> </tr> </thead> <tbody> <tr> <td> T1190 (Exploit Public-Facing Application) </td> <td> VPN appliance exploitation — GlobalProtect, FortiGate, Check Point, Citrix </td> <td> Alert on authentication bypass patterns; monitor for CVE-2026-0257 exploit signatures; audit VPN logs for anomalous admin sessions </td> </tr> <tr> <td> T0839 (Module Firmware) </td> <td> PLC logic modifications on Rockwell/Schneider/Siemens controllers </td> <td> Monitor for unauthorized firmware uploads; baseline PLC logic and alert on changes; verify integrity of safety instrumented systems </td> </tr> <tr> <td> T0831 (Manipulation of Control) </td> <td> Operational data manipulation in SCADA/HMI systems </td> <td> Cross-reference sensor readings with physical measurements; alert on alarm suppression events; monitor for setpoint changes outside maintenance windows </td> </tr> <tr> <td> T1219 (Remote Access Software) </td> <td> Remcos RAT C2 beaconing </td> <td> Hunt for connections to port 43155 and port 995 on Iranian IP ranges; detect Remcos process injection patterns; monitor for registry persistence mechanisms </td> </tr> <tr> <td> T1071.001 (Web Protocols) </td> <td> HOLLOWGRAPH M365 Graph API abuse </td> <td> Baseline Graph API call patterns per user; alert on anomalous calendar/mail API access from service principals; monitor OAuth token grants to unfamiliar applications </td> </tr> <tr> <td> T1133 (External Remote Services) </td> <td> VPN credential abuse post-Fortibleed </td> <td> Force MFA re-enrollment on all FortiGate VPN accounts; hunt for VPN sessions from anomalous geolocations; correlate VPN access with impossible travel </td> </tr> <tr> <td> T1485 (Data Destruction) </td> <td> MDM/Intune bulk device wipe </td> <td> Alert on mass device wipe commands; restrict Intune administrative actions to break-glass accounts; monitor for bulk enrollment changes </td> </tr> <tr> <td> T1486 (Data Encrypted for Impact) </td> <td> Qilin/Cactus/Dalbit ransomware deployment </td> <td> Monitor for mass file encryption patterns; detect lateral movement preceding encryption; alert on shadow copy deletion </td> </tr> <tr> <td> T1078 (Valid Accounts) </td> <td> Stolen credential usage across VPN and cloud services </td> <td> Implement conditional access policies; detect credential stuffing against VPN portals; monitor for service account anomalies </td> </tr> </tbody> </table>   <h3> Hunting Hypotheses </h3> <ol> <li> Hypothesis: Pioneer Kitten has dormant access via compromised FortiGate credentials in your environment. </li> <ul> <li> Hunt: Query FortiGate VPN logs for authentications from Iranian IP ranges (ASN 34918, ASN 213790, ASN 59580). Check for VPN sessions that authenticated successfully but generated no subsequent internal traffic (sleeping implant). Review any FortiGate firmware updates applied outside change windows. </li> </ul> <li> Hypothesis: Remcos RAT is beaconing to refreshed Iranian C2 infrastructure. </li> <ul> <li> Hunt: Search network telemetry for connections to 62.60.226[.]42:43155, 193.142.30[.]148, 193.142.30[.]36, and 2.185.67[.]169:995. Look for periodic beaconing patterns (fixed intervals ± jitter) to any IP within ASN 59580 (Batterflyai Media). </li> </ul> <li> Hypothesis: HOLLOWGRAPH implant is using your M365 tenant for C2. </li> <ul> <li> Hunt: Audit Azure AD/Entra ID for OAuth application registrations created in the last 60 days with Graph API permissions (Calendars.ReadWrite, Mail.Send). Look for service principals making API calls outside business hours or from unexpected IP ranges. </li> </ul> <li> Hypothesis: ICS/OT controllers have been reprogrammed with malicious logic. </li> <ul> <li> Hunt: Compare current PLC logic against known-good baselines. Verify safety instrumented system (SIS) configurations have not been modified. Check for any PLC that has had its alarm thresholds changed or shutdown logic disabled since June 2026. </li> </ul> <li> Hypothesis: Handala is staging data for a coordinated leak operation. </li> <ul> <li> Hunt: Monitor for large-volume data exfiltration to cloud storage services. Check DLP alerts for bulk downloads of sensitive data. Review Telegram channels associated with Handala for pre-leak indicators (teasers, countdown posts). </li> </ul> </ol>   <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> <ul> <li> Primary threat: Ransomware deployment via compromised VPN edge devices (Qilin, Cactus); credential theft from Fortibleed campaign </li> <li> Immediate actions: Audit all FortiGate and Palo Alto GlobalProtect appliances for CVE-2026-0257 and Fortibleed indicators. Verify SWIFT/payment system network segments are isolated from VPN-accessible zones. Enable enhanced monitoring on wire transfer systems for anomalous after-hours activity. </li> <li> Detection priority: T1078 (credential abuse on VPN), T1486 (ransomware encryption), lateral movement from VPN DMZ to payment processing segments </li> </ul> <h3> Energy </h3> <ul> <li> Primary threat: Iranian state actors reprogramming PLCs to disable safety systems; libIEC61850/lib60870 vulnerabilities in substation SCADA </li> <li> Immediate actions: Verify all Rockwell, Schneider Electric, and Siemens PLCs are not internet-accessible. Validate safety instrumented system (SIS) logic integrity. Patch or isolate systems running libIEC61850 and lib60870 protocol stacks. Implement unidirectional gateways between IT and OT where not already present. </li> <li> Detection priority: T0839 (firmware manipulation), T0831 (control manipulation), T0826 (loss of availability), unauthorized connections to IEC 61850 services from untrusted network segments </li> </ul> <h3> Healthcare </h3> <ul> <li> Primary threat: MuddyWater (MOIS) Dalbit ransomware targeting healthcare for espionage cover; Handala MDM/Intune bulk device wipe (Stryker precedent) </li> <li> Immediate actions: Restrict Intune/MDM administrative privileges to dedicated break-glass accounts with hardware MFA. Audit all MDM policies for unauthorized bulk actions. Ensure medical device networks are segmented from enterprise IT. Verify backup integrity for electronic health record systems. </li> <li> Detection priority: T1485 (data destruction via MDM wipe), T1531 (account access removal), T1486 (Dalbit ransomware encryption), mass device enrollment/unenrollment events </li> </ul> <h3> Government </h3> <ul> <li> Primary threat: APT34 (MOIS) HOLLOWGRAPH implant using M365 Graph API for covert C2; Pioneer Kitten initial access via VPN exploitation; espionage collection on diplomatic/military communications </li> <li> Immediate actions: Audit all OAuth application registrations in government M365 tenants. Review conditional access policies for Graph API permissions. Verify VPN appliance patch levels across all agency networks. Implement phishing-resistant MFA (FIDO2) on all privileged accounts. </li> <li> Detection priority: T1071.001 (Graph API C2), T1190 (VPN exploitation), T1078 (valid account abuse), anomalous OAuth token grants, service principal API calls outside baseline patterns </li> </ul> <h3> Aviation & Logistics </h3> <ul> <li> Primary threat: Supply chain disruption via ransomware; VPN exploitation for initial access to logistics management systems; potential targeting of GPS/navigation systems adjacent to kinetic conflict zones </li> <li> Immediate actions: Audit all internet-facing VPN and remote access systems. Verify cargo management and flight operations systems are segmented from general enterprise networks. Review third-party logistics partner access for excessive permissions. Ensure operational continuity plans account for simultaneous ransomware across multiple logistics nodes. </li> <li> Detection priority: T1133 (external remote services), T1190 (public-facing application exploitation), T1486 (ransomware), lateral movement from partner VPN connections to operational technology systems </li> </ul>   <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3>   <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Block the following Iranian C2 IPs at perimeter firewalls and DNS sinkholes: 5.202.4[.]18, 77.90.185[.]118, 185.93.89[.]43, 62.60.226[.]42, 193.142.30[.]148, 193.142.30[.]36, 2.185.67[.]169 </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Ops </td> <td> Verify ALL internet-exposed Rockwell, Schneider Electric, and Siemens PLCs are network-segmented and not directly internet-accessible. If any are exposed, disconnect immediately and investigate for compromise </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Ops </td> <td> Confirm patch status for CVE-2026-0257 (Palo Alto GlobalProtect, CVSS 9.1) across all instances. If unpatched, apply emergency patch or disable GlobalProtect portal access until patched </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Hunt for CVE-2026-0257 exploitation attempts in GlobalProtect logs. Look for authentication bypass patterns and anomalous admin session creation </td> </tr> <tr> <td> IMMEDIATE </td> <td> OT Security </td> <td> Validate safety instrumented system (SIS) logic integrity on all Rockwell/Schneider/Siemens controllers. Compare against known-good baselines. Any deviation requires immediate investigation </td> </tr> <tr> <td> IMMEDIATE </td> <td> Executive/IR </td> <td> Activate incident response retainer and confirm IR team availability for potential ICS/OT incident. Pre-position forensic capabilities for PLC analysis </td> </tr> </tbody> </table>   <h3> 7-DAY </h3>   <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 7-DAY </td> <td> IT Ops </td> <td> Audit ALL FortiGate firewalls for Fortibleed credential compromise indicators. Force credential rotation on all FortiGate VPN accounts. Implement MFA on any FortiGate VPN that lacks it </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Deploy detection rules for Remcos RAT C2 beaconing on ports 43155 and 995. Add ASN 59580 (Batterflyai Media, Iran) to threat intelligence blocklist </td> </tr> <tr> <td> 7-DAY </td> <td> OT Security </td> <td> Patch or isolate all systems running libIEC61850 and lib60870 protocol stacks. Verify IEC 61850 services are not accessible from untrusted network segments </td> </tr> <tr> <td> 7-DAY </td> <td> IT Ops </td> <td> Audit M365/Entra ID OAuth application registrations for unauthorized Graph API permissions. Revoke any suspicious application grants created since May 2026 </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Implement enhanced monitoring for MDM/Intune bulk device actions. Restrict device wipe capabilities to break-glass accounts only </td> </tr> <tr> <td> 7-DAY </td> <td> IT Ops </td> <td> Review and restrict Check Point SmartConsole access per CVE-2026-16232 (CVSS 9.1, on CISA KEV). Apply vendor patches if not already deployed </td> </tr> </tbody> </table>   <h3> 30-DAY </h3>   <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Commission assessment of defense industrial base contractor VPN exposure to Fortibleed campaign. Cross-reference partner FortiGate inventory against known compromised device indicators </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Evaluate deployment of unidirectional security gateways (data diodes) for all IT-to-OT communication paths that currently rely on firewall rules alone </td> </tr> <tr> <td> 30-DAY </td> <td> IT Ops </td> <td> Migrate all VPN authentication to phishing-resistant MFA (FIDO2/hardware keys). Eliminate password-only and SMS-based MFA on all edge devices </td> </tr> <tr> <td> 30-DAY </td> <td> Executive </td> <td> Conduct tabletop exercise simulating simultaneous ICS disruption + ransomware deployment across multiple facilities, reflecting the current Iranian operational playbook </td> </tr> <tr> <td> 30-DAY </td> <td> Legal/CISO </td> <td> Review cyber insurance coverage for state-sponsored destructive attacks. Many policies exclude "acts of war" — confirm coverage applicability given the current US-Iran conflict status </td> </tr> </tbody> </table>     <h2> IOC Blocking Table </h2> The following network indicators have been verified through intelligence collection and should be implemented in blocking/detection rules: <h3> Network Indicators (Block at Perimeter) </h3>   <table> <thead> <tr> <th> IOC </th> <th> Type </th> <th> Context </th> <th> Confidence </th> </tr> </thead> <tbody> <tr> <td> 5.202.4[.]18 </td> <td> IPv4 </td> <td> Iranian C2 (ASN 34918, Pishgaman Toseeh) — Cactus ransomware, IcedID </td> <td> High </td> </tr> <tr> <td> 77.90.185[.]118 </td> <td> IPv4 </td> <td> Iranian C2 (ASN 213790, Limited Network) — APT tagged </td> <td> High </td> </tr> <tr> <td> 185.93.89[.]43 </td> <td> IPv4 </td> <td> Iranian C2 (ASN 213790) — Command injection </td> <td> High </td> </tr> <tr> <td> 185.93.89[.]75 </td> <td> IPv4 </td> <td> Iranian infrastructure (ASN 213790) — LockBit association </td> <td> Moderate </td> </tr> <tr> <td> 62.60.226[.]42 </td> <td> IPv4 </td> <td> Remcos RAT C2 (Iranian Research Org, port 43155) </td> <td> High </td> </tr> <tr> <td> 193.142.30[.]148 </td> <td> IPv4 </td> <td> Remcos RAT C2 (ASN 59580, Batterflyai Media) </td> <td> High </td> </tr> <tr> <td> 193.142.30[.]36 </td> <td> IPv4 </td> <td> Remcos RAT C2 (ASN 59580, Batterflyai Media) </td> <td> High </td> </tr> <tr> <td> 2.185.67[.]169 </td> <td> IPv4 </td> <td> C2 node (ASN 58224, Iran Telecom, port 995) </td> <td> Moderate </td> </tr> <tr> <td> 2.188.214[.]142 </td> <td> IPv4 </td> <td> Iranian infrastructure — monitor/block </td> <td> Moderate </td> </tr> </tbody> </table>   <h3> File Hashes </h3> For verified malware hashes associated with Iranian APT tooling referenced in this report, please query Anomali ThreatStream Next-Gen using the campaign tags IRAN-RETALIATION-2026, MUDDYWATER-DALBIT, APT34-HOLLOWGRAPH, and PIONEER-KITTEN-Q3-2026. Additional IOCs are available via US government advisory classified annexes.   <h2> Bottom Line </h2> We are 147 days into the US-Iran conflict and approximately 28 days past the kinetic escalation that triggered the current retaliation cycle. The intelligence is unambiguous: Iranian cyber operations have transitioned from pre-positioning to active disruption of US critical infrastructure. The joint FBI/NSA/DOE/CISA advisory is not a warning about what might happen — it is confirmation of what is happening right now . PLCs are being reprogrammed. Safety systems are being disabled. Unsafe conditions are being created at facilities that serve American communities. Simultaneously, 75,000 FortiGate firewalls sit compromised, the Pioneer Kitten access-broker pipeline is feeding multiple ransomware operations, and pro-Iranian hacktivist groups remain in an unprecedented 27-day operational silence that historically precedes their most destructive campaigns. The window for preventive action is narrowing. Every day that internet-exposed ICS/OT assets remain unsegmented, every unpatched VPN appliance, every FortiGate with unrotated credentials — these are the doors that Iranian operators are walking through today. Act now. Verify your exposure. Segment your OT. Patch your edge. Rotate your credentials. Brief your board. The next 7–14 days will determine whether your organization is a headline or a case study in preparedness.   Published by Anomali CTI Desk | 24 July 2026 Assessment based on intelligence collected through 24 July 2026 Next update: 25 July 2026

FEATURED RESOURCES

July 24, 2026

Anomali Cyber Watch