Iran's Cyber War Machine Evolves: Physical Attacks, Ransomware Convergence, and a Closing Window for Defenders

Anomali Threat Research

Published on

June 4, 2026

Table of Contents

Threat Assessment Level: HIGH (Maintained from prior cycle. Political conditions continue to deteriorate — Iran's Foreign Minister declared "no tangible progress" in negotiations on June 4, and the US House voted 215-208 to invoke the War Powers Act. These developments sustain the elevated probability of Iranian cyber escalation as a low-cost signaling mechanism during the 97th day of the Iran-Israel-US conflict.) <h2> Introduction </h2> Ninety-seven days into the kinetic conflict that began on February 28, 2026, Iran's cyber apparatus is not merely persisting — it is evolving in ways that demand immediate executive attention. This week, Iran's Ministry of Intelligence (MOIS) formally unified cyber operations, physical attack solicitation, and influence campaigns under a single operational brand. Simultaneously, Iranian-linked actors are deploying ransomware against Western transportation networks, CISA has confirmed active exploitation of Oracle WebLogic servers, and a joint advisory urges immediate hardening of fuel infrastructure control systems. The ceasefire that held since April 8 is fracturing. Diplomacy has stalled. The US naval blockade continues. Iran continues blocking the Strait of Hormuz. Every indicator points toward cyber operations as Iran's preferred escalation tool in the coming days. If your organization operates in energy, transportation, financial services, government, or defense — and particularly if you have Gulf region exposure or Israeli business partnerships — this report requires your immediate attention. <h2> What Changed (Last 72 Hours) </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 2026-06-02 </td> <td> CISA/Partners issue joint advisory urging hardening of Automatic Tank Gauge (ATG) systems </td> <td> Validates ongoing Iranian targeting of fuel infrastructure; advisory timing suggests specific intelligence </td> </tr> <tr> <td> 2026-06-02 </td> <td> Recorded Future attributes physical attack solicitation to MOIS under "Handala" brand </td> <td> Doctrinal evolution — MOIS now operates across cyber, physical, and influence domains simultaneously </td> </tr> <tr> <td> 2026-06-03 </td> <td> MuddyWater/Hive ransomware IOCs surface targeting transportation and retail sectors </td> <td> Confirms Iranian state-criminal ransomware convergence with fresh indicators </td> </tr> <tr> <td> 2026-06-04 </td> <td> Iran FM Araghchi publicly declares "no tangible progress" in negotiations </td> <td> Removes diplomatic de-escalation pathway; increases probability of cyber signaling </td> </tr> <tr> <td> 2026-06-04 </td> <td> US House votes 215-208 to invoke War Powers Act </td> <td> Iran may interpret as US political weakness — potential trigger for escalation </td> </tr> <tr> <td> 2026-06-04 </td> <td> Mirai botnet payloads staged on Iranian-named infrastructure (82.25.63[.]213) </td> <td> Active DDoS staging; multi-architecture compilation suggests broad IoT targeting </td> </tr> <tr> <td> 2026-06-01 </td> <td> CVE-2024-21182 (Oracle WebLogic) added to CISA KEV catalog </td> <td> Confirmed active exploitation; Iranian actors have historically leveraged WebLogic </td> </tr> </tbody> </table> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Day </th> <th> Date </th> <th> Event </th> </tr> </thead> <tbody> <tr> <td> Day 1 </td> <td> 2026-02-28 </td> <td> Joint US-Israeli strikes on Iranian military and nuclear facilities initiate conflict </td> </tr> <tr> <td> Day 40 </td> <td> 2026-04-08 </td> <td> Fragile ceasefire established; US naval blockade and Hormuz closure persist </td> </tr> <tr> <td> Day 78 </td> <td> 2026-05-16 </td> <td> HYDRO KITTEN (IRGC-CEC) confirmed breach of US fuel tank ATG systems </td> </tr> <tr> <td> Day 80 </td> <td> 2026-05-18 </td> <td> Megalodon supply chain attack compromises 5,500+ GitHub repositories </td> </tr> <tr> <td> Day 95 </td> <td> 2026-06-01 </td> <td> CVE-2024-21182 added to CISA KEV; Oracle WebLogic exploitation confirmed </td> </tr> <tr> <td> Day 96 </td> <td> 2026-06-02 </td> <td> CISA ATG hardening advisory issued; MOIS Handala physical expansion reported </td> </tr> <tr> <td> Day 96 </td> <td> 2026-06-03 </td> <td> MuddyWater/Hive ransomware IOCs targeting transportation sector </td> </tr> <tr> <td> Day 97 </td> <td> 2026-06-04 </td> <td> Iran declares negotiations failed; US House War Powers vote; Mirai staging confirmed </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. MOIS Unifies Cyber, Physical, and Influence Operations Under "Handala" Brand </h3> Actors: Handala Hack Team / UNC5203 / Haywire Kitten (all MOIS-attributed) New Entity: Handala Popular Resistance Front (HPRF) Iran's MOIS has achieved something unprecedented in modern state cyber operations: the unification of hacktivist personas, cyber attack capabilities, physical attack recruitment, and influence operations under a single brand identity. The Handala Popular Resistance Front (HPRF) and three additional influence networks are now actively soliciting individuals to conduct physical attacks and espionage against US and Israeli entities — for financial reward . This is not theoretical. This is a state intelligence service running a recruitment operation for kinetic attacks against Western facilities, coordinated with ongoing cyber operations against the same targets. What this means for CISOs: Your threat model must now account for insider recruitment, physical facility targeting, and cyber-physical convergence scenarios. Physical security and cybersecurity can no longer operate in silos. <h3> 2. MuddyWater Deploys Hive Ransomware Against Transportation Sector </h3> Actors: MuddyWater (MOIS-linked) operating through Hive Ransomware-as-a-Service Targets: Transportation and retail sectors (confirmed); Cyprus-based entities Techniques: T1486 (Data Encrypted for Impact), T1059.001 (PowerShell), T1078 (Valid Accounts), T1021.002 (SMB/Windows Admin Shares) The convergence of Iranian state actors with criminal ransomware infrastructure is now operationally confirmed. MuddyWater — a well-documented MOIS cyber unit — is deploying Hive ransomware variants against Western transportation networks. This gives Iran plausible deniability ("it's just ransomware") while achieving strategic disruption of logistics and supply chains. Fresh IOCs from June 3–4 confirm active targeting. Transportation companies, logistics providers, and retail chains with supply chain dependencies should treat this as an immediate threat. <h3> 3. CVE-2024-21182: Oracle WebLogic Under Active Exploitation </h3> CVE: CVE-2024-21182 (CVSS 7.5 HIGH) Affected: Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 Vector: Unauthenticated remote data access via T3/IIOP protocols Status: Added to CISA Known Exploited Vulnerabilities catalog on June 1, 2026 This vulnerability allows complete access to all accessible data on affected WebLogic instances without authentication. Iranian APT groups — particularly those targeting financial services and government — have historically leveraged WebLogic as an initial access vector. With CISA confirmation of active exploitation, any unpatched WebLogic instance is an open door. <h3> 4. Fuel Infrastructure Under Direct Threat — CISA ATG Advisory </h3> Actors: Cyber Av3ngers (IRGC-affiliated), HYDRO KITTEN (IRGC-CEC) Targets: Automatic Tank Gauge (ATG) systems in gas stations and fuel depots Context: HYDRO KITTEN confirmed breach of US fuel tank ATG systems on May 16, 2026 CISA's joint advisory urging immediate hardening of ATG systems is not routine guidance — its timing during active conflict suggests the intelligence community possesses specific threat information about imminent operations. These systems monitor fuel levels and control dispensing at thousands of locations. Compromise enables both data theft (fuel supply intelligence) and physical disruption (tank overflow, supply interruption). <h3> 5. Iranian DDoS Infrastructure Staging — Mirai Variants </h3> Infrastructure: 82.25.63[.]213 hosting multi-architecture Mirai payloads Naming Convention: Files named iran.armv4l, iran.armv6l, iran.m68k Capability: Network denial of service via IoT botnet Six Mirai variant binaries compiled for multiple processor architectures indicate preparation for large-scale DDoS operations. The explicit "iran" naming in file paths — while potentially a false flag — aligns with the broader pattern of Iranian-directed DDoS campaigns that have intensified throughout the conflict. These payloads target IoT devices, routers, and embedded systems to build attack capacity. <h2> Predictive Analysis: 72-Hour Threat Window </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Increased hacktivist DDoS tempo against Israeli/allied targets </td> <td> 75% </td> <td> Failed negotiations remove restraint; 80+ groups already coordinated; Mirai staging confirms preparation </td> </tr> <tr> <td> Wiper deployment against Israeli critical infrastructure </td> <td> 50% </td> <td> ARCANE KITTEN/UNC1860 confirmed active with HTTPoke memory injection; BANISHED KITTEN handoff pattern for destructive ops established </td> </tr> <tr> <td> Pioneer Kitten exploitation of CVE-2026-0257 (PAN-OS GlobalProtect) against DIB targets </td> <td> 40% </td> <td> 74 days of quiet on DIB pre-positioning is concerning; political trigger (ceasefire collapse) increasingly likely </td> </tr> <tr> <td> MuddyWater/Hive ransomware expansion beyond transportation </td> <td> 45% </td> <td> Fresh IOCs confirm active operations; financial services and energy are logical next targets </td> </tr> <tr> <td> ICS/OT incident at fuel or water infrastructure </td> <td> 35% </td> <td> CISA advisory timing suggests specific intelligence; HYDRO KITTEN breach confirmed May 16; ATG systems remain exposed </td> </tr> <tr> <td> MOIS-directed physical attack attempt against US/Israeli facility </td> <td> 20% </td> <td> Recruitment confirmed but execution requires willing individuals; lower probability but catastrophic impact </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> <ol> <li> Hive/MuddyWater Ransomware Activity </li> </ol> <ul> <li> ATT&CK Techniques: T1486, T1059.001, T1078, T1021.002 </li> <li> Hunt Hypothesis: MuddyWater gains initial access via valid credentials (T1078), moves laterally via SMB admin shares (T1021.002), executes PowerShell-based loaders (T1059.001), then deploys Hive encryption (T1486) </li> <li> Detection: Alert on PowerShell execution with encoded commands from service accounts; monitor SMB lateral movement patterns outside business hours; deploy hash-based detections for IOCs listed below </li> <li> Investigation: Any Hive-family ransomware detection should be escalated as potential state-directed activity — do not treat as routine criminal ransomware </li> </ul> <ol start="2"> <li> Oracle WebLogic Exploitation (CVE-2024-21182) </li> </ol> <ul> <li> ATT&CK Techniques: T1190, T1005 </li> <li> Hunt Hypothesis: Attackers exploit T3/IIOP listeners on WebLogic 12.2.1.4.0 or 14.1.1.0.0 to extract sensitive data without authentication </li> <li> Detection: Monitor T3/IIOP traffic (ports 7001–7002) for anomalous connection patterns; alert on unexpected data exfiltration from WebLogic hosts; audit WebLogic access logs for unauthenticated data retrieval </li> <li> Investigation: Inventory all WebLogic instances immediately; any unpatched instance should be assumed compromised pending forensic review </li> </ul> <ol start="3"> <li> Mirai/DDoS Staging Infrastructure </li> </ol> <ul> <li> ATT&CK Techniques: T1584.004, T1498, T1059.004 </li> <li> Hunt Hypothesis: IoT devices and embedded systems on your network are being recruited into botnets via default credentials or known vulnerabilities </li> <li> Detection: Block C2 IP 82.25.63[.]213 at perimeter; monitor for ELF binary downloads to IoT/embedded devices; alert on outbound connections to known Mirai C2 infrastructure </li> <li> Investigation: Scan for IoT devices with default credentials; audit network segments containing embedded systems (cameras, routers, building automation) </li> </ul> <ol start="4"> <li> Fox Kitten / Pioneer Kitten VPN Persistence </li> </ol> <ul> <li> ATT&CK Techniques: T1133 (External Remote Services), T1078 (Valid Accounts), T1556 (Modify Authentication Process) </li> <li> Hunt Hypothesis: Iranian actors maintain persistent access via compromised VPN appliances (Cisco ASA, PAN-OS GlobalProtect, Ivanti Connect Secure) — access may have been established months ago and is awaiting activation </li> <li> Detection: Audit VPN appliance configurations for unauthorized accounts, modified authentication modules, or webshell artifacts; review GlobalProtect logs for CVE-2026-0257 exploitation attempts </li> <li> Investigation: Any anomalous VPN account creation or configuration change on internet-facing appliances should be treated as potential nation-state pre-positioning </li> </ul> <ol start="5"> <li> ATG/ICS System Monitoring </li> </ol> <ul> <li> ATT&CK Techniques: T1190, T0890, T0816, T0826 </li> <li> Hunt Hypothesis: Internet-exposed ATG systems are being enumerated and exploited by IRGC-CEC-affiliated actors for fuel supply disruption </li> <li> Detection: Monitor for Shodan/Censys-style scanning of ATG ports; alert on any inbound connection to ATG systems from non-whitelisted IPs; monitor Modbus/TCP traffic for anomalous commands </li> <li> Investigation: Immediately audit internet exposure of all OT/ICS systems; any ATG system reachable from the internet should be disconnected or segmented immediately </li> </ul> <h2> IOC Blocking Table </h2> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 82.25.63[.]213 </td> <td> Mirai botnet staging — Iranian-named payloads </td> </tr> <tr> <td> SHA-256 </td> <td> aaf56c20c2da05fae2ce6dc4dfd9c864f91b934b9fd17049b4e6c849a319398b </td> <td> Mirai variant (armv4l) </td> </tr> <tr> <td> SHA-256 </td> <td> 46775f5d7918869ac3d7409cf7e4465055e21f174588b3b79d7f8099fcd9c3a7 </td> <td> Mirai variant </td> </tr> <tr> <td> SHA-256 </td> <td> b91e8b00e83895fa76323ebff997e89ad06ea4efdd57be0fd60fe1cfc7f9cd18 </td> <td> Mirai variant </td> </tr> <tr> <td> SHA-256 </td> <td> b7293cf7e8a0bac91010b152d8845cfea175688561f30f908a93264d00a738f1 </td> <td> Mirai variant </td> </tr> <tr> <td> MD5 </td> <td> a4af965c3d205df36757d24f92636691 </td> <td> Mirai variant </td> </tr> <tr> <td> MD5 </td> <td> 4fcdd144d8d2faa7c20ad5493449a522 </td> <td> Mirai variant </td> </tr> <tr> <td> MD5 </td> <td> b54558cbaf582502664e5c0f0a282d74 </td> <td> Mirai variant </td> </tr> <tr> <td> SHA-256 </td> <td> 3f66d551d043c732cc93030831e3fd071e3bed07917e62dd721d60742f9cba7c </td> <td> Hive ransomware — MuddyWater (retail targeting) </td> </tr> <tr> <td> SHA-256 </td> <td> 168e625c7eb51720f5ce1922aec6ad316b3aaca838bd864ee2bcdbd9b66171d0 </td> <td> Hive ransomware — MuddyWater (multi-sector, Cyprus) </td> </tr> <tr> <td> MD5 </td> <td> 293cb83ab23fc3ad2594474184a92d03 </td> <td> Hive ransomware — MuddyWater (transportation) </td> </tr> <tr> <td> MD5 </td> <td> fcd0928ef0c389415c256931754ac863 </td> <td> Hive ransomware — MuddyWater (transportation) </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> Primary threats: Oracle WebLogic exploitation (CVE-2024-21182) for data theft; MuddyWater/Hive ransomware expansion; SWIFT/payment system targeting during conflict escalation. <ul> <li> Immediate: Inventory and patch all Oracle WebLogic instances. If patching requires downtime, implement WAF rules blocking T3/IIOP from untrusted sources as interim mitigation. </li> <li> 7-Day: Review third-party payment processor connections for anomalous authentication patterns. Iranian actors historically target financial messaging systems during escalation phases. </li> <li> 30-Day: Conduct red team assessment of SWIFT environment isolation. Ensure transaction monitoring systems can detect manipulation at the message level, not just network level. </li> </ul> <h3> Energy </h3> Primary threats: ATG system exploitation (HYDRO KITTEN/IRGC-CEC, Cyber Av3ngers); fuel supply chain disruption; DDoS against SCADA/HMI interfaces; physical-cyber convergence targeting facilities. <ul> <li> Immediate: Disconnect all internet-exposed ATG systems. Implement network segmentation between IT and OT environments. Verify no Modbus/TCP services are reachable from corporate networks. </li> <li> 7-Day: Conduct physical security briefing on MOIS Handala recruitment operations targeting energy facilities. Review badge access logs for anomalous patterns at critical infrastructure sites. </li> <li> 30-Day: Deploy passive OT network monitoring (e.g., Claroty, Dragos, Nozomi) if not already in place. Establish out-of-band communication procedures for OT operations in case of IT network compromise. </li> </ul> <h3> Healthcare </h3> Primary threats: Ransomware (Hive/MuddyWater convergence); data exfiltration of research data (Handala claims against research institutions); supply chain compromise affecting medical device connectivity. <ul> <li> Immediate: Verify endpoint detection coverage across clinical systems. Deploy Hive ransomware IOCs to all detection platforms. Ensure offline backups of electronic health records are current and tested. </li> <li> 7-Day: Audit medical device network segmentation — IoT medical devices are potential Mirai recruitment targets. Review vendor remote access connections for unauthorized persistence. </li> <li> 30-Day: Tabletop exercise for ransomware scenario affecting clinical operations during a period when Iranian actors may deliberately time attacks for maximum pressure. </li> </ul> <h3> Government </h3> Primary threats: Espionage via WebLogic and VPN exploitation; pre-positioned access activation in DIB contractor networks; influence operations and data leaks for psychological impact; insider recruitment via MOIS Handala operations. <ul> <li> Immediate: Patch WebLogic and audit VPN appliance configurations (PAN-OS GlobalProtect, Cisco ASA, Ivanti). Review privileged account activity for anomalous patterns over the past 90 days. </li> <li> 7-Day: Issue insider threat awareness briefing referencing MOIS financial recruitment operations. Coordinate with counterintelligence on personnel with access to sensitive facilities or data. </li> <li> 30-Day: Review and exercise continuity of operations plans for scenarios involving simultaneous cyber disruption and physical security incidents at government facilities. </li> </ul> <h3> Aviation / Logistics </h3> Primary threats: MuddyWater/Hive ransomware directly targeting transportation; supply chain disruption via logistics system compromise; DDoS against booking/scheduling systems; cargo tracking manipulation. <ul> <li> Immediate: Deploy all MuddyWater/Hive IOCs. Monitor for PowerShell-based lateral movement in operational technology segments (baggage handling, cargo management, fuel systems). </li> <li> 7-Day: Audit third-party logistics integrations for unauthorized access. Review API authentication for cargo tracking and manifest systems. Iranian actors have demonstrated interest in logistics data for intelligence purposes. </li> <li> 30-Day: Assess resilience of flight operations and cargo management to ransomware scenarios. Ensure manual fallback procedures are documented and exercised for critical operational systems. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Block IP 82.25.63[.]213 and deploy all Mirai + Hive hashes from IOC table to EDR, SIEM, and network detection platforms </td> </tr> <tr> <td> 2 </td> <td> IT Ops </td> <td> Patch Oracle WebLogic Server (12.2.1.4.0, 14.1.1.0.0) against CVE-2024-21182 — confirmed actively exploited </td> </tr> <tr> <td> 3 </td> <td> OT/ICS </td> <td> Audit and disconnect all internet-exposed Automatic Tank Gauge systems per CISA advisory </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Verify PAN-OS GlobalProtect patches for CVE-2026-0257 are applied; hunt for exploitation artifacts </td> </tr> <tr> <td> 5 </td> <td> CISO </td> <td> Elevate organizational cyber readiness posture — Iran's declaration of failed negotiations opens a retaliatory window </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> Physical Security </td> <td> Brief facility teams on MOIS Handala physical attack recruitment — individuals being offered financial reward for attacks on US/Israeli-linked facilities </td> </tr> <tr> <td> 2 </td> <td> SOC / Threat Hunt </td> <td> Initiate hunt for Fox Kitten / Pioneer Kitten VPN persistence on Cisco ASA, PAN-OS GlobalProtect, and Ivanti Connect Secure appliances </td> </tr> <tr> <td> 3 </td> <td> IT Ops </td> <td> Audit all VPN appliance configurations for unauthorized accounts, webshells, or modified authentication modules </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Review Azure AD / Entra ID logs for anomalous OAuth token grants and Power Automate flows — Iranian APT35 cloud TTPs </td> </tr> <tr> <td> 5 </td> <td> CTI </td> <td> Diversify intelligence collection sources to address OSINT feed degradation — single-source dependency is unacceptable during active conflict </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> CISO </td> <td> Commission tabletop exercise for combined cyber-physical attack: simultaneous DDoS/wiper + MOIS-directed insider or physical attack </td> </tr> <tr> <td> 2 </td> <td> CISO </td> <td> Review and update incident response plans to account for state-directed ransomware (different escalation path than criminal ransomware) </td> </tr> <tr> <td> 3 </td> <td> IT Architecture </td> <td> Deploy passive OT network monitoring across all industrial control system environments </td> </tr> <tr> <td> 4 </td> <td> Legal / Executive </td> <td> Establish pre-authorized communication templates for ransomware scenarios involving state actors (different legal and disclosure implications) </td> </tr> <tr> <td> 5 </td> <td> CISO </td> <td> Assess cyber insurance coverage for state-sponsored attacks — many policies exclude "acts of war"; confirm coverage position with carrier </td> </tr> </tbody> </table> <h2> Bottom Line </h2> We are 97 days into a conflict where Iran has demonstrated willingness to blur every boundary — between cyber and physical, between state and criminal, between espionage and destruction. The failed negotiations announced today are not merely a diplomatic setback. They are a permission signal for Iran's cyber operators. The MuddyWater/Hive convergence means your ransomware playbook must now account for state-directed operations. The Handala physical expansion means your cybersecurity team must coordinate with physical security. The 74-day silence on defense industrial base pre-positioning is not reassurance — it is the sound of an adversary waiting for the right moment. The next 72 hours represent a critical window. Patch WebLogic. Disconnect exposed ATG systems. Deploy the IOCs. Hunt for VPN persistence. Brief your physical security teams. And ensure your executive leadership understands that the next Iranian cyber operation may not look like espionage — it may look like a ransomware attack, a DDoS campaign, or a recruitment pitch to someone with a badge to your facility. Act now. The window is closing. Published 2026-06-04 by the Anomali CTI Desk. Intelligence derived from Anomali ThreatStream Next-Gen, CISA advisories, Recorded Future, and partner feeds. For IOC feeds and automated detection content, contact your Anomali representative.

FEATURED RESOURCES

July 10, 2026

Anomali Cyber Watch

Iranian Cyber Operations Reach Inflection Point: FortiBleed Pipeline Weaponized, Multi-Actor Convergence Accelerates

July 10, 2026

Anomali Cyber Watch

Public Sector

Critical ColdFusion Vulnerability, New Phishing-as-a-Service Platform, and Russian Infrastructure Refresh Demand Immediate State Government Action

July 8, 2026

Anomali Cyber Watch

Public Sector

Critical Vulnerabilities and Novel Attack Techniques Threaten State Government Networks

Explore All