Iran's Cyber War Machine Hits 3× Surge: What CISOs Must Do Before the Next Strike

Anomali Threat Research

Published on

July 6, 2026

Table of Contents

Threat Assessment Level: HIGH — ESCALATING The numbers are no longer estimates. On June 29, Israel's National Cyber Security Directorate chief publicly confirmed what threat intelligence teams have been tracking for months: Iranian cyberattacks tripled year-over-year, with approximately 4,800 hostile cyber incidents recorded in June 2026 alone — up from ~1,600 in June 2025. Eighteen weeks into the Iran-Israel/US cyber conflict that began February 28, 2026, we are witnessing the most sustained state-sponsored cyber escalation campaign since NotPetya. But here's what should keep you awake tonight: the absence of destructive operations during this surge isn't reassurance — it's a warning. Iranian operational doctrine builds access first, then executes destruction on political command. The IRGC's cyber units are pre-positioning. The question isn't if they'll strike — it's when and where . <h2> What Changed This Week </h2> The past seven days brought five developments that materially alter the threat landscape: <ol> <li> Official validation of the escalation scale. Multiple independent outlets — Reuters, Jerusalem Post, The Next Web — confirmed the Israeli government's 3× surge figure. This transforms what was previously an intelligence assessment into established fact. </li> <li> Fresh Iranian surveillance infrastructure went live. On July 2, a new cluster of command-and-control domains impersonating Microsoft services and VPN providers was identified, delivering MarkiRAT (aka SCRAPWOOD) — a surveillance tool historically used by IRGC-affiliated actors against dissidents, journalists, and opposition figures. </li> <li> A validated C2 server was tagged for "retaliation window" operations. A European-hosted server (Germany, ASN 214351) was confirmed as an active Iranian-linked C2 node deploying DarkComet RAT, explicitly tagged by intelligence sources with the assessment: "Iran declares ceasefire over — cyber retaliation window opens for critical infrastructure." </li> <li> Pioneer Kitten ransomware convergence confirmed on shared infrastructure. ASN 213790 (Tehran) now hosts IPs tagged simultaneously to Iranian state actors, LockBit ransomware operations, and Pinchy Spider — reflecting the documented Pioneer Kitten (UNC757) model of selling initial access to ransomware operators and deliberately complicating attribution. </li> <li> CISA disclosed ICS/OT vulnerabilities directly relevant to Iranian targeting. July 2 advisories cover satellite attitude control hardware (CubeSpace), satellite terminal access (ST Engineering iDirect), remote terminal units (Schneider Electric), and storage systems — expanding the attack surface at a critical moment in the conflict. </li> </ol> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 2026-02-28 </td> <td> Iran-Israel/US cyber conflict begins </td> <td> Initiating event — 18 weeks ago </td> </tr> <tr> <td> 2026-06-08–29 </td> <td> ASN 213790 (Tehran) scanning activity sustained </td> <td> Iranian APT reconnaissance targeting government, healthcare, telecom, chemical sectors </td> </tr> <tr> <td> 2026-06-22 </td> <td> Alhurra exposé reveals IRGC cyber unit structure </td> <td> Opposition sources confirm organizational readiness of IRGC cyber warfare network </td> </tr> <tr> <td> 2026-06-24–25 </td> <td> IOCONTROL/QUEUECAT ICS malware refreshed </td> <td> IRGC-CEC (Cyber Av3ngers) maintaining OT-destructive capability </td> </tr> <tr> <td> 2026-06-29 </td> <td> Israeli NCSD chief confirms 3× cyberattack surge </td> <td> ~4,800 incidents in June 2026; official government validation </td> </tr> <tr> <td> 2026-07-01 </td> <td> DHS HSIN breach confirmed; CVE-2026-45659 added to CISA KEV </td> <td> SharePoint RCE actively exploited across 10,000+ servers </td> </tr> <tr> <td> 2026-07-02 </td> <td> MarkiRAT C2 infrastructure refresh (6 new domains) </td> <td> VPN/Microsoft-themed lures for surveillance tool delivery </td> </tr> <tr> <td> 2026-07-02 </td> <td> CISA ICS advisories: satellite, RTU, IoT, storage </td> <td> CubeSpace firmware upload, iDirect terminal access, Schneider RTU exposure </td> </tr> <tr> <td> 2026-07-03–04 </td> <td> UNC6496 confirmed active; UNC5855/AnonymousForJustice latest IOC </td> <td> IRGC-affiliated phishing kits SARAQAKIT/SILENTRAQIB deployed </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> The IRGC's Expanding C2 Footprint </h3> Iranian actors are aggressively building out command-and-control infrastructure. Six new domains on the pis2ray[.]online and comi-site[.]website families were identified on July 2, all impersonating Microsoft services or VPN providers. The naming convention — "pis2ray" likely references V2Ray, a popular proxy tool — suggests lures targeting populations that use VPNs to circumvent censorship. The malware being delivered is MarkiRAT (Google TAG designation: SCRAPWOOD), a Windows surveillance tool with keylogging, screen capture, and file exfiltration capabilities. While historically used against dissidents, the infrastructure scale suggests potential expansion to broader espionage targets. Simultaneously , a Tehran-based ASN (213790, "Limited Network") continues hosting active scanning infrastructure. Three IPs on this ASN — rated at 90–97 confidence — are conducting reconnaissance against government, healthcare, telecommunications, and chemical sector targets using non-standard ports (T1571) and application-layer protocols (T1071). <h3> Multi-Actor Infrastructure Convergence </h3> A troubling development: ASN 213790 now hosts IPs tagged to Iranian state actors, LockBit ransomware operations, AND Pinchy Spider (GandCrab/REvil lineage). This isn't coincidental — it reflects the documented Pioneer Kitten (UNC757) operational model where IRGC-affiliated actors sell initial access to ransomware operators. This convergence means: <ul> <li> Attribution becomes deliberately harder </li> <li> A "ransomware" incident may actually be state-directed destruction </li> <li> Defenders cannot dismiss Iranian-origin scanning as merely criminal </li> </ul> <h3> The Retaliation Pre-Positioning Phase </h3> The validated C2 server at 62[.]60[.]226[.]10 (hosted in Germany on ASN 214351) represents something more concerning than routine espionage. Tagged by Recorded Future as "Recently-Linked-to-APT" and explicitly associated with Iran's post-ceasefire retaliation posture, this server is deploying DarkComet RAT — a remote access tool that provides full system control including file manipulation, credential theft, and destructive capability. The server also runs Keitaro TDS (Traffic Distribution System), which enables operators to selectively redirect victims based on geography, browser, or other fingerprinting — a hallmark of targeted operations rather than opportunistic campaigns. <h3> ICS/OT Attack Surface Expanding at the Worst Possible Time </h3> CISA's July 2 advisory batch disclosed vulnerabilities in systems directly relevant to Iranian targeting: <ul> <li> CubeSpace CW0057 Reaction Wheel : Arbitrary firmware upload to satellite attitude control hardware </li> <li> ST Engineering iDirect iQ-Series Terminals : Unauthorized access to satellite terminal information </li> <li> Schneider Electric EasyLogic T150 / Saitel DP RTU : Sensitive data exposure in remote terminal units </li> <li> StoneFly Storage Concentrator : Arbitrary command execution </li> </ul> The convergence of satellite system vulnerabilities with Iran's known interest in disrupting military command-and-control makes space-ground segment security an urgent priority. <h2> Named Threat Actors & Attribution </h2> The following groups are confirmed active or maintaining operational readiness: <table> <thead> <tr> <th> Actor </th> <th> Affiliation </th> <th> Current Activity </th> <th> Primary Targets </th> </tr> </thead> <tbody> <tr> <td> APT42 / Charming Kitten </td> <td> IRGC-IO </td> <td> Adjacent to UNC6496 phishing operations </td> <td> Government, think tanks, media </td> </tr> <tr> <td> UNC6496 </td> <td> IRGC </td> <td> Active — deploying SARAQAKIT/SILENTRAQIB phishing kits </td> <td> Credential harvesting at scale </td> </tr> <tr> <td> UNC5855 / AnonymousForJustice </td> <td> IRGC (hacktivist front) </td> <td> Latest IOC July 3–4 </td> <td> Critical infrastructure, IO </td> </tr> <tr> <td> Pioneer Kitten / UNC757 </td> <td> IRGC </td> <td> Scanning phase (ASN 213790); ransomware handoff model </td> <td> Edge devices, VPNs, then ransomware </td> </tr> <tr> <td> Cyber Av3ngers / HYDRO KITTEN </td> <td> IRGC-CEC </td> <td> IOCONTROL/QUEUECAT malware refreshed June 24–25 </td> <td> ICS/OT — water, energy </td> </tr> <tr> <td> BANISHED KITTEN / Cotton Sandstorm </td> <td> IRGC </td> <td> Operational readiness maintained </td> <td> Destructive operations </td> </tr> <tr> <td> MuddyWater / TEMP.Zagros </td> <td> MOIS </td> <td> Anomalous silence (pre-strike indicator) </td> <td> Government, telecom, energy </td> </tr> <tr> <td> UNC2428 </td> <td> IRGC </td> <td> Tracked — operational status unclear </td> <td> Defense industrial base </td> </tr> <tr> <td> Handala </td> <td> IRGC-directed </td> <td> Anomalous silence (pre-strike indicator) </td> <td> Israeli targets, IO/destruction </td> </tr> </tbody> </table> Critical absence signal: MuddyWater, Handala, and Pioneer Kitten are simultaneously silent during a confirmed 3× escalation. Historically, coordinated silence across Iranian groups precedes destructive operations. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Trigger </th> </tr> </thead> <tbody> <tr> <td> Iranian destructive operation (wiper/ransomware) against Israeli or Gulf targets </td> <td> 70% </td> <td> Within 14 days </td> <td> Next kinetic escalation event </td> </tr> <tr> <td> Pioneer Kitten ransomware handoff using ASN 213790 access </td> <td> 60% </td> <td> Within 21 days </td> <td> Access maturation in healthcare/government networks </td> </tr> <tr> <td> IOCONTROL/QUEUECAT deployment against water/energy OT </td> <td> 50% </td> <td> Within 30 days </td> <td> Political command following ceasefire collapse </td> </tr> <tr> <td> Dormant DIB access activation (PTC Windchill, Fortinet VPN) </td> <td> 55% </td> <td> Within 21 days </td> <td> Escalation in US-Iran tensions </td> </tr> <tr> <td> MarkiRAT campaign expansion beyond dissidents to government/corporate targets </td> <td> 45% </td> <td> Within 14 days </td> <td> Infrastructure already deployed </td> </tr> <tr> <td> Satellite/space-ground segment attack leveraging CISA-disclosed vulnerabilities </td> <td> 30% </td> <td> Within 60 days </td> <td> Requires capability development beyond current known TTPs </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> DNS/Proxy Monitoring — MarkiRAT C2 ( T1071.001 , T1583.001 ) <ul> <li> Hunt hypothesis: "Endpoints resolving domains on pis2ray[.]online or comi-site[.]website families are communicating with Iranian surveillance C2" </li> <li> Detection: DNS query logs for any subdomain of pis2ray[.]online or comi-site[.]website </li> <li> Action: Block at DNS resolver and web proxy; alert on any historical resolution </li> </ul> Network Telemetry — Iranian APT Scanning ( T1595.001 , T1571 ) <ul> <li> Hunt hypothesis: "Inbound connections from ASN 213790 (Limited Network, Tehran) indicate active Iranian reconnaissance" </li> <li> Detection: Firewall/IDS alerts for source IPs 192[.]253[.]248[.]55, 192[.]253[.]248[.]169, 77[.]90[.]185[.]253 on non-standard ports </li> <li> Action: Block inbound; investigate any established sessions in last 30 days </li> </ul> C2 Beaconing — DarkComet RAT ( T1071.001 , T1105 , T1219 ) <ul> <li> Hunt hypothesis: "Outbound connections to 62[.]60[.]226[.]10 indicate active DarkComet RAT compromise" </li> <li> Detection: Network flow data for destination IP 62[.]60[.]226[.]10; DarkComet behavioral signatures (mutex patterns, registry keys) </li> <li> Action: Immediate isolation of any communicating endpoint; full forensic triage </li> </ul> VPN-Themed Phishing ( T1566.002 , T1036.005 ) <ul> <li> Hunt hypothesis: "Phishing emails referencing VPN services or Microsoft authentication that link to pis2ray[.]online infrastructure deliver MarkiRAT" </li> <li> Detection: Email gateway rules for URLs containing pis2ray, comi-site; user-reported phishing with VPN themes </li> <li> Action: Quarantine; extract and block additional infrastructure from email headers </li> </ul> <h3> Ongoing Hunting Campaigns </h3> ICS/OT Firmware Integrity ( T1542.004 , T0839 ) <ul> <li> Hunt hypothesis: "Satellite communication terminals or RTUs have received unauthorized firmware modifications" </li> <li> Detection: Compare firmware hashes against vendor-published baselines for ST Engineering iDirect, CubeSpace, Schneider EasyLogic/Saitel DP </li> <li> Action: Isolate any device with firmware mismatch; engage vendor for validation </li> </ul> Dormant Access Detection ( T1078 — Valid Accounts) <ul> <li> Hunt hypothesis: "Iranian actors hold dormant credentials in Fortinet VPN, PTC Windchill, or GitHub Enterprise from prior Pioneer Kitten campaigns" </li> <li> Detection: Audit VPN authentication logs for accounts with no activity >60 days that suddenly authenticate; review GitHub Enterprise audit logs for repository access from unexpected geolocations </li> <li> Action: Force credential rotation on all edge device service accounts; enable MFA enforcement gaps audit </li> </ul> SharePoint RCE Exploitation — CVE-2026-45659 ( T1190 ) <ul> <li> Hunt hypothesis: "Unpatched SharePoint servers are being exploited via CVE-2026-45659 for initial access" </li> <li> Detection: SharePoint ULS logs for anomalous web part instantiation; IIS logs for exploitation signatures; CISA KEV compliance scan </li> <li> Action: Emergency patch; if patching delayed >48h, implement WAF virtual patch or take offline </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> Primary threat: Pioneer Kitten ransomware handoff model — Iranian actors gain access, sell to ransomware operators (LockBit affiliates on shared ASN 213790 infrastructure). Actions: <ul> <li> Audit all Fortinet/Ivanti/Cisco edge device firmware and patch levels against CISA KEV </li> <li> Implement network segmentation between SWIFT/payment systems and general corporate network </li> <li> Enable enhanced monitoring on inter-bank communication channels for anomalous authentication </li> <li> Review cyber insurance policy exclusions for state-sponsored attacks disguised as ransomware </li> </ul> <h3> Energy </h3> Primary threat: IOCONTROL/QUEUECAT (IRGC-CEC/Cyber Av3ngers) targeting Schneider/Siemens/Yokogawa ICS; Schneider EasyLogic/Saitel DP RTU vulnerabilities disclosed July 2. Actions: <ul> <li> Patch Schneider EasyLogic T150 and Saitel DP RTU per CISA ICSA-26-181-04 within 7 days </li> <li> Verify EcoStruxure IT Data Center Expert patched per ICSA-26-181-03 </li> <li> Conduct firmware integrity verification on all RTUs and PLCs in OT environment </li> <li> Ensure OT network monitoring can detect IOCONTROL behavioral patterns (DNS tunneling to elf[.]iocontrol family) </li> <li> Test manual override procedures for critical processes in case of control system compromise </li> </ul> <h3> Healthcare </h3> Primary threat: Iranian APT scanning from ASN 213790 explicitly targets healthcare sector (IP 192[.]253[.]248[.]169, confidence 97). Ransomware handoff risk is elevated. Actions: <ul> <li> Block ASN 213790 IP ranges at perimeter; alert on any historical connections </li> <li> Ensure offline backups of EHR systems are current and tested (ransomware resilience) </li> <li> Audit remote access pathways (VPN, RDP, Citrix) for unnecessary exposure </li> <li> Implement application allowlisting on clinical workstations to prevent RAT execution </li> <li> Brief clinical engineering teams on medical device firmware integrity checks </li> </ul> <h3> Government </h3> Primary threat: Multi-vector — credential phishing (UNC6496/SARAQAKIT), SharePoint RCE (CVE-2026-45659), surveillance (MarkiRAT), and pre-positioned access for destructive operations. Actions: <ul> <li> Emergency patch SharePoint for CVE-2026-45659 — 10,000+ servers exposed globally </li> <li> Implement phishing-resistant MFA (FIDO2) for all privileged accounts; disable SMS/voice MFA </li> <li> Audit Azure AD/Entra ID for anomalous OAuth application grants from unexpected geolocations </li> <li> Review Conditional Access policies for gaps exploitable by Iranian IP ranges </li> <li> Conduct tabletop exercise for simultaneous wiper + data leak scenario (Iranian doctrine) </li> </ul> <h3> Aviation & Logistics </h3> Primary threat: Satellite communication terminal vulnerabilities (ST Engineering iDirect iQ-Series, CubeSpace reaction wheel) combined with Iranian interest in disrupting military and civilian C2 links. Actions: <ul> <li> Audit all satellite terminal firmware against vendor baselines (CISA ICSA-26-183-01/02) </li> <li> Segment satellite ground station networks from corporate IT </li> <li> Implement out-of-band communication procedures in case of SATCOM disruption </li> <li> Review supply chain for any Iranian-manufactured or Iranian-transited components </li> <li> Monitor for anomalous satellite terminal behavior (unexpected firmware updates, configuration changes) </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Block MarkiRAT C2 domains at DNS/proxy: starvpn[.]pis2ray[.]online, microsoft[.]comi-site[.]website, min[.]comi-site[.]website, min[.]pis2ray[.]online, microsoft[.]pis2ray[.]online, c[.]pis2ray[.]online </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Block/alert on IP 62[.]60[.]226[.]10 — validated Iranian C2 server (DarkComet RAT, retaliation-tagged) </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Add IPs 192[.]253[.]248[.]55, 192[.]253[.]248[.]169, 77[.]90[.]185[.]253 to monitoring/block — active Iranian scanning </td> </tr> <tr> <td> 4 </td> <td> IT Ops </td> <td> Verify SharePoint patched for CVE-2026-45659; if unpatched, implement WAF rules or take offline </td> </tr> <tr> <td> 5 </td> <td> Executive </td> <td> Brief leadership on 3× escalation confirmation and 70% probability of destructive operations within 14 days </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops </td> <td> Audit satellite terminals (ST Engineering iDirect iQ-Series) and RTUs (Schneider EasyLogic/Saitel DP) for firmware integrity </td> </tr> <tr> <td> 2 </td> <td> IT Ops </td> <td> Patch Schneider Electric EasyLogic T150, Saitel DP RTU, and EcoStruxure IT Data Center Expert per CISA advisories </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Deploy detection rules for MarkiRAT/SCRAPWOOD behavioral indicators — VPN-themed lures, V2Ray proxy references, pis2ray[.]online DNS queries </td> </tr> <tr> <td> 4 </td> <td> IT Ops </td> <td> Force credential rotation on all edge device service accounts (Fortinet, Ivanti, Cisco) </td> </tr> <tr> <td> 5 </td> <td> IR </td> <td> Update incident response playbooks for simultaneous wiper + ransomware + data leak scenario </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> CISO </td> <td> Commission proactive threat hunt for dormant Iranian access in DIB contractor networks — focus on PTC Windchill, GitHub Enterprise, Fortinet VPN logs </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Expand dark web and Telegram collection for Handala, Cyber Toufan, and AnonymousForJustice channels </td> </tr> <tr> <td> 3 </td> <td> CISO </td> <td> Conduct tabletop exercise simulating Iranian destructive attack: wiper deployment + simultaneous data leak + hacktivist IO amplification </td> </tr> <tr> <td> 4 </td> <td> IT Ops </td> <td> Implement network segmentation between OT/ICS and IT networks where gaps exist; validate air-gap integrity </td> </tr> <tr> <td> 5 </td> <td> Executive </td> <td> Review cyber insurance coverage for state-sponsored attacks; assess exclusion clauses for "acts of war" given confirmed state attribution </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> The following IOCs are confirmed from intelligence collection and should be actioned immediately: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 192[.]253[.]248[.]55 </td> <td> Iranian APT scanning (ASN 213790) </td> <td> Block/Monitor </td> </tr> <tr> <td> IPv4 </td> <td> 192[.]253[.]248[.]169 </td> <td> Iranian APT scanning, healthcare/gov targeting (conf 97) </td> <td> Block </td> </tr> <tr> <td> IPv4 </td> <td> 77[.]90[.]185[.]253 </td> <td> Iranian APT scanning, chemical sector (ASN 213790) </td> <td> Block/Monitor </td> </tr> <tr> <td> IPv4 </td> <td> 171[.]22[.]27[.]16 </td> <td> Iranian-linked infrastructure (ASN 60631) </td> <td> Monitor </td> </tr> <tr> <td> IPv4 </td> <td> 62[.]60[.]226[.]10 </td> <td> Validated C2 — DarkComet RAT, retaliation-tagged </td> <td> Block </td> </tr> <tr> <td> IPv4 </td> <td> 95[.]38[.]16[.]220 </td> <td> Iranian-linked APT infrastructure </td> <td> Monitor </td> </tr> <tr> <td> Domain </td> <td> starvpn[.]pis2ray[.]online </td> <td> MarkiRAT C2 — VPN-themed lure </td> <td> Block </td> </tr> <tr> <td> Domain </td> <td> microsoft[.]comi-site[.]website </td> <td> MarkiRAT C2 — Microsoft impersonation </td> <td> Block </td> </tr> <tr> <td> Domain </td> <td> min[.]comi-site[.]website </td> <td> MarkiRAT C2 </td> <td> Block </td> </tr> <tr> <td> Domain </td> <td> min[.]pis2ray[.]online </td> <td> MarkiRAT C2 </td> <td> Block </td> </tr> <tr> <td> Domain </td> <td> microsoft[.]pis2ray[.]online </td> <td> MarkiRAT C2 — Microsoft impersonation </td> <td> Block </td> </tr> <tr> <td> Domain </td> <td> c[.]pis2ray[.]online </td> <td> MarkiRAT C2 </td> <td> Block </td> </tr> <tr> <td> Domain </td> <td> sonic05[.]irandns[.]com </td> <td> Iranian DNS infrastructure </td> <td> Monitor </td> </tr> <tr> <td> Domain </td> <td> 4bagh[.]net </td> <td> Iranian credential theft infrastructure </td> <td> Monitor </td> </tr> <tr> <td> Domain </td> <td> ftp[.]4bagh[.]net </td> <td> Iranian credential exfiltration </td> <td> Monitor </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. <h2> The Bottom Line </h2> Eighteen weeks into this conflict, we have moved from intelligence assessment to confirmed reality. The Israeli government has validated the 3× escalation. Fresh C2 infrastructure is being deployed weekly. Scanning operations target your sectors specifically. And the coordinated silence of Iran's most destructive groups — Handala, Pioneer Kitten, and BANISHED KITTEN — during peak escalation is not inactivity. It is preparation. MuddyWater's parallel silence, unusual for an MOIS collection apparatus this active in prior phases, compounds the concern. The 70% probability of destructive operations within 14 days is not a theoretical exercise. It is based on observed Iranian operational patterns: build access quietly, then execute destruction on political command. The next kinetic escalation event — a strike, a failed negotiation, a provocation — becomes the trigger. Your 24-hour checklist: <ol> <li> Block the IOCs above </li> <li> Verify CVE-2026-45659 (SharePoint) is patched </li> <li> Brief your executive team on the threat level </li> <li> Confirm your IR playbook covers simultaneous wiper + data leak + IO scenarios </li> <li> Validate offline backup integrity for your most critical systems </li> </ol> The window to prepare is closing. Act now. Anomali CTI Desk | 2026-07-06 For IOC feeds, YARA rules, and detection content supporting this analysis, contact your Anomali representative or access ThreatStream Next-Gen directly.

FEATURED RESOURCES

July 6, 2026

Anomali Cyber Watch