Iranian Cyber Retaliation Window Open: What CISOs Must Do in the Next 72 Hours

Anomali Threat Research

Published on

June 29, 2026

Table of Contents

Threat Assessment Level: CRITICAL <h2> Introduction </h2> Four months into the US-Iran kinetic conflict that began on February 28, 2026, Iranian cyber forces have entered what intelligence analysts assess as an active pre-operational retaliation phase. Following US CENTCOM strikes on Iranian missile and drone facilities on June 26, the digital battlespace is now the most dangerous it has been since hostilities began. Two critical-severity vulnerabilities are under active mass exploitation (CVE-2026-12569 and CVE-2026-20230), MuddyWater is producing fresh weaponized documents for credential harvesting, OT edge devices are being compromised through pre-disclosure exploits, and — most ominously — Iran's hacktivist proxy groups have gone silent during a period when historical patterns predict coordinated destructive operations. If your organization operates in defense, energy, water, healthcare, or government sectors, the next 72 hours demand heightened vigilance and immediate defensive action. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters </th> </tr> </thead> <tbody> <tr> <td> MuddyWater deploys new POWERSTATS samples (Jun 25–27) </td> <td> Fresh credential harvesting documents indicate active targeting of government and military-adjacent organizations. New tooling signals campaign preparation, not legacy activity. </td> </tr> <tr> <td> Cisco CUCM CVE-2026-20230 mass exploitation (within 24h of PoC) </td> <td> Attackers are deploying multi-stage JSP webshells via SSRF in the WebDialer service. Government, healthcare, and education sectors targeted. Root-level access achieved. </td> </tr> <tr> <td> CISA adds CVE-2026-12569 (PTC Windchill) to KEV catalog (Jun 25) </td> <td> Confirms active exploitation of a CVSS 9.8 deserialization RCE in engineering data management software used across the defense industrial base — Lockheed Martin, Boeing, Raytheon supply chains. </td> </tr> <tr> <td> Pre-disclosure OT edge exploitation (Chaya_006 cluster) </td> <td> Lantronix serial-to-IP converters exploited via CVE-2025-67038 before public disclosure . Attackers reverse-engineered vendor patches. 4,100+ brute-force attempts against OpenWrt devices in parallel. </td> </tr> <tr> <td> FortiBleed campaign confirmed still active </td> <td> Ongoing credential exposure from FortiGate devices. Pioneer Kitten historically leverages Fortinet vulnerabilities for initial access brokering. </td> </tr> <tr> <td> Iranian hacktivist proxies silent for 48+ hours post-kinetic strikes </td> <td> Handala Hack Team, Cyber Av3ngers, and DieNet have not issued claims. Historical pattern: silence precedes coordinated ICS/destructive attacks within 24–72 hours. </td> </tr> <tr> <td> Six Iranian C2 servers refreshed (Jun 28) </td> <td> Cobalt Strike, Remcos RAT, Venom Software, and SystemBC hosted on ASN 213790 — infrastructure ready for operational deployment. </td> </tr> <tr> <td> The Gentlemen RaaS enters top 10 by victim count (H1 2026) </td> <td> Go-based ransomware with BYOVD EDR-bypass capability and Yamux-multiplexed C2 is actively targeting critical infrastructure. No confirmed Iranian nexus, but criminal-state handoff pattern warrants monitoring. </td> </tr> <tr> <td> UNC5855 and UNC6729 targeting observed against allied governments (Jun 26) </td> <td> Both clusters last observed conducting surveillance operations against Israeli and allied government targets on June 26, coinciding with CENTCOM strikes — indicating coordinated intelligence collection alongside kinetic events. </td> </tr> </tbody> </table> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> </tr> </thead> <tbody> <tr> <td> 2026-02-28 </td> <td> US-Iran kinetic conflict begins </td> </tr> <tr> <td> 2026-06-12 </td> <td> CVE-2026-20230 (Cisco CUCM SSRF) disclosed </td> </tr> <tr> <td> 2026-06-17 </td> <td> Cyber Av3ngers last observed activity — then silence begins </td> </tr> <tr> <td> 2026-06-25 </td> <td> CISA adds CVE-2026-12569 (PTC Windchill, CVSS 9.8) to KEV catalog </td> </tr> <tr> <td> 2026-06-25 </td> <td> MuddyWater POWERSTATS sample #1 created </td> </tr> <tr> <td> 2026-06-26 </td> <td> US CENTCOM strikes Iranian missile and drone facilities </td> </tr> <tr> <td> 2026-06-26 </td> <td> UNC5855 and UNC6729 last observed IOC activity (targeting Israel) </td> </tr> <tr> <td> 2026-06-26 </td> <td> Fox Kitten / Pioneer Kitten profile updated in threat intelligence </td> </tr> <tr> <td> 2026-06-27 </td> <td> MuddyWater POWERSTATS sample #2 created </td> </tr> <tr> <td> 2026-06-28 </td> <td> Six Iranian C2 servers confirmed refreshed (ASN 213790) </td> </tr> <tr> <td> 2026-06-28 </td> <td> Cisco CUCM mass webshell campaign confirmed — exploitation within 24h of PoC </td> </tr> <tr> <td> 2026-06-28 </td> <td> FortiBleed campaign independently confirmed still active </td> </tr> <tr> <td> 2026-06-29 </td> <td> 72-hour retaliation window assessment — hacktivist claims expected imminently </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> MuddyWater (MOIS) — Credential Harvesting Pre-Positioning </h3> MuddyWater, Iran's Ministry of Intelligence and Security (MOIS) cyber unit, produced two new POWERSTATS weaponized Word documents between June 25–27. POWERSTATS is their signature PowerShell-based implant delivered via spearphishing attachments, designed for credential harvesting and establishing persistent access. The timing is not coincidental. These samples were created in the 48 hours surrounding the CENTCOM kinetic strikes, suggesting MuddyWater is pre-positioning for follow-on operations — likely credential theft against government and military-adjacent targets within 5–7 days. Key concern: No new C2 infrastructure was observed, which may indicate MuddyWater has pivoted to living-off-trusted-services for command and control — using Microsoft Teams, Power Automate, or OneDrive rather than traditional C2 domains. <h3> Pioneer Kitten / Handala / Banished Kitten — Unified Attack Pipeline </h3> Intelligence sharing from H-ISAC has confirmed what analysts suspected: Pioneer Kitten (also known as Fox Kitten/Lemon Sandstorm, IRGC-affiliated), Handala Hack Team, and Banished Kitten are operating as a unified pipeline. Pioneer Kitten provides initial access through exploitation of edge devices (Fortinet, Ivanti, now potentially PTC Windchill), Handala conducts destructive operations, and Banished Kitten handles data exfiltration. Operational implication: An indicator attributed to any one of these groups should be treated as an indicator for all three . Detection of Pioneer Kitten access brokering means destructive operations may follow. <h3> Cisco CUCM CVE-2026-20230 — Communications Infrastructure at Risk </h3> A mass exploitation campaign is actively deploying multi-stage JSP webshells against Cisco Unified Communications Manager via an SSRF vulnerability in the WebDialer service (CVSS 8.6, Cisco SIR override to CRITICAL). Attackers achieve root-level access and route all traffic through Tor exit nodes. While currently unattributed and opportunistic, this vulnerability directly threatens government and military VoIP infrastructure. Iranian actors have historically weaponized opportunistic access for targeted operations. Exploitation indicators: <ul> <li> Reconnaissance probe: /webdialer/Version.jws?wsdl </li> <li> Exploitation endpoint: /cmplatform/installClusterStatusExecute with path traversal in hostname parameter </li> <li> Webshell location: /platform-services/axis2-web/*.jsp </li> </ul> <h3> PTC Windchill CVE-2026-12569 — Defense Industrial Base Engineering Data </h3> CISA's June 25 KEV addition confirms active exploitation of a CVSS 9.8 deserialization RCE in PTC Windchill — the engineering data management platform used across the defense industrial base. This vulnerability provides unauthenticated remote code execution against systems containing controlled unclassified information (CUI), weapons system designs, and supply chain data. All Windchill CPS versions prior to 11.0 M030 are affected. <h3> OT Edge Exploitation — Pre-Disclosure Capability Demonstrated </h3> The Chaya_006 threat cluster has demonstrated the ability to reverse-engineer vendor patches and build working exploits before public disclosure of CVE-2025-67038 (Lantronix EDS5000 serial-to-IP converters). In parallel, over 4,100 brute-force attempts targeted OpenWrt LuCI interfaces across approximately 32,000 internet-exposed devices. This represents a capability escalation: traditional patch-on-disclosure timelines are insufficient when adversaries can weaponize vulnerabilities from patch analysis alone. <h3> The Gentlemen RaaS — Emerging Ransomware with BYOVD Capability </h3> A rapidly growing ransomware-as-a-service operation ("The Gentlemen") has entered the top 10 by victim count in H1 2026. Their toolkit includes Go-based ransomware with novel obfuscation, Bring Your Own Vulnerable Driver (BYOVD) techniques for EDR bypass, and a custom Go backdoor using Yamux multiplexing for C2. While no direct Iranian nexus has been confirmed, the BYOVD technique and critical infrastructure targeting warrant monitoring for potential criminal-state handoff — a pattern observed in prior Iranian operations. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Pro-Iranian hacktivist claims against water/energy infrastructure </td> <td> 75% </td> <td> Next 24–48 hours </td> <td> Historical 24–72h lag between kinetic events and hacktivist retaliation; current 48h+ silence matches pre-operational pattern </td> </tr> <tr> <td> Pioneer Kitten pivot to CVE-2026-12569 (Windchill) against DIB contractors </td> <td> 50% </td> <td> Next 7 days </td> <td> Pioneer Kitten's established pattern of rapid exploitation of newly disclosed edge vulnerabilities; FortiBleed activity suggests active operations </td> </tr> <tr> <td> MuddyWater credential harvesting campaign against government/military targets </td> <td> 70% </td> <td> 5–7 days </td> <td> Fresh POWERSTATS samples indicate campaign preparation; credential harvesting typically precedes deeper network penetration by 5–10 days </td> </tr> <tr> <td> Cyber Av3ngers ICS attack on water/energy SCADA systems </td> <td> 40% </td> <td> Next 7–14 days </td> <td> 12+ days of silence matches historical pattern preceding major ICS attacks; kinetic strikes provide motivation </td> </tr> <tr> <td> Opportunistic CVE-2026-20230 access sold to Iranian actors </td> <td> 35% </td> <td> Next 14 days </td> <td> Mass exploitation creates access inventory; Pioneer Kitten has purchased access from criminal brokers previously </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> ATT&CK Technique </th> <th> What to Monitor </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> T1566.001 (Spearphishing Attachment) </td> <td> Inbound Word documents with macro/PowerShell execution </td> <td> Alert on Office process spawning PowerShell; block POWERSTATS hashes at mail gateway </td> </tr> <tr> <td> T1190 (Exploit Public-Facing Application) </td> <td> CUCM WebDialer, PTC Windchill, FortiGate management, Lantronix EDS </td> <td> Monitor for path traversal patterns in HTTP requests to /cmplatform/, unexpected .jsp file creation </td> </tr> <tr> <td> T1505.003 (Web Shell) </td> <td> CUCM axis2-web directory, any JSP files not in baseline </td> <td> File integrity monitoring on /platform-services/axis2-web/; alert on new .jsp files </td> </tr> <tr> <td> T1059.001 (PowerShell) </td> <td> PowerShell execution with encoded commands, network callbacks </td> <td> Detect base64-encoded PowerShell, constrained language mode bypass attempts </td> </tr> <tr> <td> T1090.003 (Multi-hop Proxy — Tor) </td> <td> Connections from known Tor exit nodes to CUCM/VoIP infrastructure </td> <td> Block or alert on Tor exit node IPs connecting to communications infrastructure </td> </tr> <tr> <td> T1078 (Valid Accounts) </td> <td> Credential use from unusual locations/times post-FortiBleed </td> <td> Correlate VPN authentications against FortiBleed exposure lists; force MFA re-enrollment </td> </tr> <tr> <td> T1110.001 (Brute Force) </td> <td> Authentication attempts against OpenWrt LuCI, OT edge devices </td> <td> Threshold alerting on cgi-bin/luci/rpc/auth endpoint; geo-block non-operational source IPs </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> MuddyWater Living-off-Trusted-Services: Hunt for anomalous Microsoft Teams external federation requests, Power Automate flows with external connectors, and OneDrive sharing to unrecognized tenant IDs. The absence of new C2 infrastructure suggests legitimate service abuse. </li> <li> CUCM Webshell Persistence: Search for any .jsp files in /platform-services/axis2-web/ that were not present in the last known-good baseline. Check for webshell password pattern pwd=123 in HTTP POST bodies. </li> <li> Pioneer Kitten Access Brokering: Correlate any FortiGate credential exposure (FortiBleed) with subsequent VPN logins from Iranian ASN ranges (213790, 41881). Look for lateral movement within 24–48 hours of initial VPN access. </li> <li> OT Edge Reconnaissance: Monitor for scanning activity against Lantronix EDS management interfaces and OpenWrt LuCI endpoints. The string lntxe in payloads indicates Lantronix-specific targeting tools. </li> <li> BYOVD EDR Bypass: Alert on loading of known vulnerable drivers: ProcessMonitorDriver.sys, wamsdk.sys, gamedriverx64.sys, biontdrv.sys, inpoutx64.sys, wsftprm.sys, Havoc.sys. These are associated with The Gentlemen RaaS EDR bypass toolkit. </li> </ol> <h3> IOC Blocking Guidance </h3> Hashes (block at EDR/mail gateway): <table> <thead> <tr> <th> SHA-256 </th> <th> Attribution </th> </tr> </thead> <tbody> <tr> <td> d3b8a7489136327ac58cb98a2d7a53a94a3f74d1f6ebeb8ff346038dcb943cec </td> <td> MuddyWater POWERSTATS </td> </tr> <tr> <td> 31a14fcea7dddf3c24860734237ff7d3d48aa0e002d276c566e032c1b82d3982 </td> <td> MuddyWater POWERSTATS </td> </tr> </tbody> </table> Network indicators (block/alert at perimeter): <table> <thead> <tr> <th> Indicator </th> <th> Type </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> 192.253.248[.]169 </td> <td> IPv4 </td> <td> Iranian APT C2 (ASN 213790) </td> </tr> <tr> <td> 77.90.185[.]253 </td> <td> IPv4 </td> <td> Iranian APT C2 (ASN 213790) </td> </tr> <tr> <td> 185.93.89[.]147 </td> <td> IPv4 </td> <td> Iranian APT C2 (ASN 213790) </td> </tr> <tr> <td> 95.38.16[.]220 </td> <td> IPv4 </td> <td> Iranian infrastructure </td> </tr> <tr> <td> 171.22.27[.]16 </td> <td> IPv4 </td> <td> Iranian infrastructure </td> </tr> <tr> <td> 46.148.39[.]36 </td> <td> IPv4 </td> <td> Iranian infrastructure </td> </tr> <tr> <td> 81.177.215[.]15 </td> <td> IPv4 </td> <td> The Gentlemen RaaS C2 (Yamux) </td> </tr> <tr> <td> zexeq[.]com </td> <td> Domain </td> <td> C2 infrastructure </td> </tr> <tr> <td> sempersim[.]su </td> <td> Domain </td> <td> C2 infrastructure </td> </tr> <tr> <td> check-ftp[.]ru </td> <td> Domain </td> <td> C2 infrastructure </td> </tr> <tr> <td> nwgrus[.]ru </td> <td> Domain </td> <td> C2 infrastructure </td> </tr> <tr> <td> olihonols.in[.]net </td> <td> Domain </td> <td> C2 infrastructure </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> <ul> <li> Primary threat: MuddyWater credential harvesting targeting SWIFT-connected systems and treasury platforms. Pioneer Kitten access brokering through compromised VPN appliances. </li> <li> Action: Audit all FortiGate VPN configurations for FortiBleed exposure. Enforce hardware token MFA on all privileged financial system access. Monitor for anomalous SWIFT message patterns following any credential compromise. </li> <li> ATT&CK focus: T1078 (Valid Accounts), T1552.001 (Credentials in Files) </li> </ul> <h3> Energy </h3> <ul> <li> Primary threat: Cyber Av3ngers ICS targeting (historically water and energy SCADA), Chaya_006 OT edge exploitation of serial-to-IP converters, Lantronix/OpenWrt compromise as pivot points into operational technology networks. </li> <li> Action: Inventory all Lantronix EDS5000/3000 devices and OpenWrt-based equipment. Verify firmware versions (EDS5000 ≥ v2.2.0R1, EDS3000 ≥ v3.2.0.0R2). Segment all serial-to-IP converters from internet access. Conduct emergency review of Schneider Electric PowerLogic P7 deployments per ICSA-26-176-07. </li> <li> ATT&CK focus: T1190 (Exploit Public-Facing Application), T1059.004 (Unix Shell on OT devices) </li> </ul> <h3> Healthcare </h3> <ul> <li> Primary threat: Cisco CUCM exploitation threatening hospital VoIP and nurse call systems. Opportunistic ransomware (The Gentlemen RaaS) targeting healthcare for maximum pressure. </li> <li> Action: Immediately audit CUCM WebDialer status — disable if not operationally required. Scan for unauthorized .jsp files in axis2-web directories. Ensure BYOVD-capable drivers are blocked via Windows Defender Application Control (WDAC) policies. </li> <li> ATT&CK focus: T1505.003 (Web Shell), T1068 (Privilege Escalation via vulnerable drivers) </li> </ul> <h3> Government </h3> <ul> <li> Primary threat: MuddyWater spearphishing with POWERSTATS for credential harvesting, followed by persistent access for espionage. UNC5855 and UNC6729 conducting surveillance operations against allied government targets. </li> <li> Action: Block POWERSTATS hashes at email gateway. Deploy enhanced PowerShell logging (Script Block Logging, Module Logging). Hunt for Microsoft Teams external federation from unrecognized tenants. Brief personnel on spearphishing indicators — weaponized Word documents referencing current geopolitical events. </li> <li> ATT&CK focus: T1566.001 (Spearphishing Attachment), T1059.001 (PowerShell), T1071.001 (Web Protocols C2) </li> </ul> <h3> Aviation / Logistics </h3> <ul> <li> Primary threat: PTC Windchill CVE-2026-12569 exploitation targeting engineering data in aerospace supply chains. Pioneer Kitten access brokering into DIB contractor networks for follow-on espionage or destructive operations. </li> <li> Action: Verify all PTC Windchill instances are patched to ≥11.0 M030 per PTC article CS473270. Audit access logs for Windchill PDMLink and FlexPLM for unauthorized access patterns. Review DIB subcontractor security posture — Pioneer Kitten targets the weakest link in the supply chain. </li> <li> ATT&CK focus: T1190 (Exploit Public-Facing Application), T1059 (Deserialization to code execution) </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops </td> <td> Patch or mitigate PTC Windchill CVE-2026-12569 — upgrade to ≥11.0 M030 or apply vendor workaround per CS473270. KEV deadline is imminent. </td> </tr> <tr> <td> 2 </td> <td> IT Ops / SOC </td> <td> Disable Cisco CUCM WebDialer if not operationally required. If required, restrict access to internal networks only and monitor /cmplatform/installClusterStatusExecute for path traversal attempts. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Block confirmed Iranian C2 IPs at perimeter: 192.253.248[.]169, 77.90.185[.]253, 185.93.89[.]147, 95.38.16[.]220, 171.22.27[.]16, 46.148.39[.]36 </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Ingest POWERSTATS hashes into EDR blocklists and email gateway. Alert on any match. </td> </tr> <tr> <td> 5 </td> <td> SOC </td> <td> Deploy Tor exit node blocking for all connections to CUCM, VoIP, and OT management interfaces. </td> </tr> <tr> <td> 6 </td> <td> Executive / IR </td> <td> Activate 72-hour elevated monitoring posture — expect pro-Iranian hacktivist claims against water/energy infrastructure within 24–48 hours. Pre-position incident response team. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops </td> <td> Audit and patch all Lantronix EDS5000/3000 serial-to-IP converters. Upgrade firmware, segment from internet, enforce non-default credentials on all OpenWrt LuCI interfaces. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Hunt for MuddyWater living-off-trusted-services C2 — audit Teams external federation, Power Automate external connectors, OneDrive sharing to unknown tenants. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Correlate FortiBleed exposure with subsequent VPN authentication anomalies. Force credential rotation and MFA re-enrollment for any exposed accounts. </td> </tr> <tr> <td> 4 </td> <td> IT Ops </td> <td> Deploy WDAC policies blocking known BYOVD drivers: ProcessMonitorDriver.sys, wamsdk.sys, gamedriverx64.sys, biontdrv.sys, inpoutx64.sys, wsftprm.sys, Havoc.sys </td> </tr> <tr> <td> 5 </td> <td> IR / Legal </td> <td> Update incident response playbooks for Iranian destructive attack scenarios — include ICS/SCADA isolation procedures, communication failover plans (if CUCM is compromised), and regulatory notification timelines. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> CISO </td> <td> Commission OT edge device inventory — identify all serial-to-IP converters, OpenWrt-based routers, and unmanaged network equipment across energy/ICS environments. Pre-disclosure exploitation capability means patch-on-disclosure is no longer sufficient. </td> </tr> <tr> <td> 2 </td> <td> CISO </td> <td> Evaluate virtual patching / WAF capability for rapid response to pre-disclosure exploitation. Organizations must be able to deploy protective rules from patch diff analysis within hours, not days. </td> </tr> <tr> <td> 3 </td> <td> IT Ops </td> <td> Assess Schneider Electric PowerLogic P7 exposure per ICSA-26-176-07. Review protection/control platform configurations in energy infrastructure. </td> </tr> <tr> <td> 4 </td> <td> CISO / Executive </td> <td> Conduct tabletop exercise simulating coordinated Iranian cyber-kinetic attack: simultaneous CUCM compromise (communications disruption), Windchill breach (IP theft), and ICS manipulation (operational disruption). Test decision-making under multi-vector pressure. </td> </tr> <tr> <td> 5 </td> <td> CISO </td> <td> Review DIB subcontractor security requirements — Pioneer Kitten targets the weakest supply chain link. Require attestation of Windchill patching, FortiGate hardening, and MFA enforcement from all tier-1 suppliers. </td> </tr> </tbody> </table> <h2> Bottom Line </h2> We are 122 days into the US-Iran conflict, and the cyber dimension is accelerating. The convergence of fresh MuddyWater tooling, two critical KEVs under active exploitation, demonstrated pre-disclosure OT exploitation capability, and anomalous hacktivist silence during a kinetic retaliation window creates a threat environment where inaction carries unacceptable risk. The intelligence is clear: Iranian cyber forces are preparing. The question is not whether retaliation will come, but where and when . The 72-hour window following the June 26 CENTCOM strikes is the highest-probability timeframe for coordinated operations. Patch Windchill. Disable or isolate CUCM WebDialer. Block the C2 infrastructure. Hunt for living-off-trusted-services C2. Pre-position your incident response team. Brief your executive leadership on the escalation scenario. The adversary is not waiting. Neither should you. Anomali CTI Desk | 2026-06-29 For IOC feeds, YARA rules, and detection content supporting this advisory, contact your Anomali representative or access indicators directly via Anomali ThreatStream Next-Gen.

FEATURED RESOURCES

December 24, 2025

Anomali Cyber Watch

Anomali Cyber Watch: LockBit 5.0, Chrome Zero-Day CVE-2026-2441, Infostealer Targets OpenClaw, and more Copy

LockBit 5.0 Ransomware Targets Windows, Linux, and VMware ESXi in Active Campaigns. Google Patches Actively Exploited Chrome Zero-Day CVE-2026-2441. Infostealer Targets OpenClaw Configuration Files to Capture Credentials and User Context. And more...

June 29, 2026

Anomali Cyber Watch