Iran's Cyber War Machine Hits Full Stride: What CISOs Must Do Right Now

Anomali Threat Research

Published on

April 1, 2026

Table of Contents

Threat Assessment Level: CRITICAL Thirty-two days into the most intense state-on-state cyber conflict since Russia-Ukraine, Iranian cyber operations have crossed a threshold that demands immediate executive attention. Intelligence confirmed this week shows Iranian state-sponsored actors are now operating across 17 countries and 7 industry verticals with custom backdoors, diversified command-and-control infrastructure, and a broadening target aperture that extends well beyond the Middle East. Meanwhile, the most dangerous signal may be what we're not seeing — the prolonged silence of Iran's most destructive ICS/OT attack group during the peak of the conflict. This is not a drill. If your organization operates edge devices, cloud services, OT/SCADA systems, or relies on open-source software supply chains, you are in the blast radius. <h2>What Changed                               </h2> The past week brought several developments that shift the calculus for defenders: <ul> <li>Iranian APT operations confirmed at highest confidence level. Corroborated intelligence across three independent axes — tactics, infrastructure, and targeting — confirms that MOIS-affiliated groups including MuddyWater (tracked as UNC3313/UNC5667), OilRig/APT34, and UNC5203 are conducting a global espionage campaign spanning energy, government, telecommunications, utilities, education, and non-profit sectors across 17 countries.</li> <li>Cyber Av3ngers (HYDRO KITTEN) silent for 21+ days — ICS/OT threat at peak risk. Iran's most destructive ICS/OT attack group, affiliated with the IRGC Cyber Electronic Command, has gone dark during the most intense phase of the conflict. Every previous major ICS operation by Iranian actors was preceded by a quiet period. Combined with decentralized IRGC command following leadership decapitation, this silence is assessed as pre-operational security, not capability degradation.</li> <li>Iranian actors are abandoning Cobalt Strike for open-source C2 frameworks. A Tehran-based IP address (45.147.77[.]210, ASN 51889) was independently confirmed as both an Iranian APT command-and-control node and an AdaptixC2 server — an open-source red-team framework with lower EDR detection rates than Cobalt Strike. Organizations relying solely on Cobalt Strike signatures for Iranian APT detection now have a confirmed blind spot.</li> <li>New espionage campaign targets Azerbaijan and Turkey. The TWOSTROKE malware campaign, attributed to suspected Iranian espionage actors, expanded its targeting to Azerbaijani and Turkish organizations — likely driven by Turkey's military cooperation with Israel and Azerbaijan's strategic energy infrastructure (BTC pipeline, Shah Deniz gas).</li> <li>F5 BIG-IP receives new security advisory (K000160515) amid active exploitation of F5 appliances in the wild. Combined with the still-active CVE-2025-53521 (CVSS 9.8, pre-auth RCE) and CVE-2026-3055 (Citrix NetScaler, CVSS 9.3, SAML key leakage), the edge-device attack surface remains the single most exploited vector in this conflict.</li> <li>Axios npm supply chain compromise now detectable. A Nessus detection plugin was published on 31 March for the backdoored Axios npm package (~45 million weekly downloads). The compromised version deploys a cross-platform remote access trojan. Detection is now possible — but remediation across development environments remains urgent.</li> <li>OAuth authorization flow attacks documented in detail. New research confirms attackers can abuse OAuth device code grants and authorization code flows to bypass MFA entirely, obtain persistent access tokens, and maintain indefinite access — with no attacker-controlled infrastructure required. Iranian actors have been observed adopting these exact techniques against cloud environments.</li> </ul> <h2>Conflict & Threat Timeline                    </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> </tr> </thead> <tbody> <tr> <td> 28 Feb 2026 </td> <td> Iran-US kinetic conflict begins; Iranian cyber operations activate </td> </tr> <tr> <td> ~10 Mar 2026 </td> <td> UNC5858 Rafael defense impersonation campaign last observed </td> </tr> <tr> <td> ~11 Mar 2026 </td> <td> iranat[.]click phishing infrastructure last active subdomain </td> </tr> <tr> <td> ~18 Mar 2026 </td> <td> Israeli strikes kill Khamenei and Larijani; IRGC command decentralizes </td> </tr> <tr> <td> ~18 Mar 2026 </td> <td> UNC6446 aerospace/DIB espionage (SHADYSMILE malware) last observed </td> </tr> <tr> <td> ~24 Mar 2026 </td> <td> CISA ICS advisories issued for WAGO switches, PTC Windchill, Anritsu, others </td> </tr> <tr> <td> 26 Mar 2026 </td> <td> APT42/CALANQUE TAMECAT phishing kit updated — possible infrastructure rotation </td> </tr> <tr> <td> 27 Mar 2026 </td> <td> Handala Hack Team breaches FBI Director's personal Gmail; 300+ emails published </td> </tr> <tr> <td> 28–30 Mar 2026 </td> <td> CVE-2025-53521 (F5 BIG-IP, CVSS 9.8) and CVE-2026-3055 (Citrix NetScaler, CVSS 9.3) reach active exploitation </td> </tr> <tr> <td> 30 Mar 2026 </td> <td> Google/Mandiant publishes Campaign 26.029: MuddyWater espionage across 17 countries with 15+ custom backdoors </td> </tr> <tr> <td> 31 Mar 2026 </td> <td> TWOSTROKE campaign updated — Iranian espionage expands to Azerbaijan and Turkey </td> </tr> <tr> <td> 31 Mar 2026 </td> <td> Axios npm supply chain Nessus detection plugin published </td> </tr> <tr> <td> 31 Mar 2026 </td> <td> AdaptixC2 confirmed on Iranian APT infrastructure </td> </tr> <tr> <td> 1 Apr 2026 </td> <td> F5 BIG-IP advisory K000160515 published; intelligence collection cutoff </td> </tr> </tbody> </table> <h2>Key Threat Analysis                    </h2> <h3>1. MOIS Global Espionage at Scale — MuddyWater, OilRig, UNC5203</h3> The most significant intelligence development this cycle is the confirmation that Iran's Ministry of Intelligence and Security (MOIS) is running a global espionage campaign of unprecedented breadth. MuddyWater subclusters UNC3313 and UNC5667 are deploying 15+ custom backdoors and abusing legitimate remote access tools (T1219) across commercial, education, energy, government, non-profit, telecommunications, and utilities sectors in 17 countries. This is not surgical espionage — it is broad collection by a regime under existential threat, casting a wide intelligence net and selectively exploiting high-value targets after initial access. The confirmation that Iranian operators are now using AdaptixC2 — an open-source C2 framework — alongside their traditional tooling represents a deliberate effort to evade the Cobalt Strike detection signatures that most SOCs rely on. This mirrors the tooling diversification already seen from Russian and Chinese APT groups (Sliver, Mythic, Havoc) and should be treated as a permanent shift, not an anomaly. Named actors: MuddyWater (UNC3313, UNC5667), OilRig/APT34, UNC5203 (Handala Hack Team / Homeland Justice) Key TTPs: T1190 (Exploit Public-Facing Application), T1059.001 (PowerShell), T1219 (Remote Access Software), T1078 (Valid Accounts), T1071.001 (Web Protocols C2), T1573.002 (Asymmetric Crypto Encrypted Channel) <h3>2. The Cyber Av3ngers Silence — The Most Dangerous Signal</h3> Cyber Av3ngers (also tracked as HYDRO KITTEN), the IRGC-CEC-affiliated group responsible for the 2023 Unitronics PLC campaign against US water utilities, has been silent for 21+ days during the most intense phase of the conflict. This is not reassuring — it is alarming. Every previous major ICS operation by Iranian actors was preceded by a quiet period. The convergence of factors — regime decapitation creating decentralized IRGC command, CISA's reduced operational capacity, and Iran's public designation of cloud providers as kinetic targets — creates maximum opportunity for a destructive ICS/OT operation. The IOCONTROL malware, previously associated with Cyber Av3ngers targeting of energy infrastructure, remains confirmed active with high confidence. Assessment: The silence is more consistent with pre-operational security than capability degradation. Probability of resurfacing (under a new persona or with a visible ICS operation) within 7 days: 50%. <h3>3. Edge Device Exploitation — The Primary Entry Point</h3> Iranian actors continue to exploit internet-facing edge devices as their primary initial access vector. The active exploitation landscape includes: <ul> <li>CVE-2025-53521 — F5 BIG-IP pre-auth RCE (CVSS 9.8), with memory-resident webshells deployed past CISA's patch deadline</li> <li>CVE-2026-3055 — Citrix NetScaler SAML signing key leakage (CVSS 9.3)</li> <li>F5 advisory K000160515 — New advisory published 1 April; CVE pending NVD assignment</li> <li>Additional tracked CVEs across Ivanti Connect Secure and Cisco SD-WAN/FMC</li> </ul> Nine or more CVEs are under active tracking in this campaign. Any unpatched edge device is an open door. <h3>4. Supply Chain Compromise — Systemic Risk Accumulating</h3> Three simultaneous supply chain compromises are active: <table> <thead> <tr> <th> Campaign </th> <th> Vector </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> Axios npm backdoor </td> <td> Compromised npm maintainer account </td> <td> ~45M weekly downloads; cross-platform RAT deployed </td> </tr> <tr> <td> TeamPCP / PyPI </td> <td> Malicious Python packages </td> <td> Developer workstation compromise </td> </tr> <tr> <td> GlassWorm / Solana </td> <td> Blockchain-based C2 channel </td> <td> Novel exfiltration via Solana transactions </td> </tr> </tbody> </table> The Axios compromise is now detectable via Nessus plugin (published 31 March), but detection does not equal remediation. Any organization with JavaScript or Python dependencies should assume exposure until verified clean. <h3>5. OAuth and Cloud Access — MFA Is Not Enough</h3> Documented attacks exploiting OAuth device authorization grants and authorization code flows demonstrate that MFA can be completely bypassed through legitimate OAuth mechanisms. Attackers reuse legitimate client IDs, obtain tokens that never trigger MFA challenges, and refresh them indefinitely. Iranian actors — particularly APT42 (IRGC-IO) and UNC5203 — have been observed adopting these techniques against cloud environments. The combination of OAuth token theft (T1528), token reuse (T1550.001), and device code flow abuse (T1621) represents a fundamental challenge to identity-centric security models. <h3>6. TWOSTROKE — Geographic Expansion of Iranian Espionage</h3> The TWOSTROKE malware campaign's expansion to Azerbaijan and Turkey signals that Iranian intelligence collection is no longer confined to traditional adversaries. Azerbaijan's energy infrastructure and Turkey's military cooperation with Israel make them logical MOIS targets. This campaign uses spearphishing with themed decoys (T1566.001) and PowerShell-based execution chains (T1059.001). Assessment: 40% probability of further expansion to Georgian or Central Asian targets following the Turkic-language targeting pattern. <h2>Predictive Analysis — What Comes Next</h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> MuddyWater deploys new POWERSTATS variant via AdaptixC2 against Gulf state government targets </td> <td> 70% </td> <td> 72 hours </td> <td> 31 Mar Anomali ThreatStream Next-Gen update cadence; 17-country campaign scope; confirmed AdaptixC2 adoption </td> </tr> <tr> <td> Cyber Av3ngers resurface under new persona or execute visible ICS/OT operation </td> <td> 50% </td> <td> 7 days </td> <td> 21-day silence matches pre-operation OPSEC pattern; peak conflict conditions </td> </tr> <tr> <td> TWOSTROKE campaign expands to Georgia or Central Asia </td> <td> 40% </td> <td> 14 days </td> <td> Turkic-language targeting pattern; Azerbaijan geographic proximity </td> </tr> <tr> <td> APT42/CALANQUE resumes nuclear sector espionage with rotated infrastructure </td> <td> 30% </td> <td> 14 days </td> <td> TAMECAT phishing kit updated 26 Mar suggests preparation, not abandonment </td> </tr> <tr> <td> ClickFix social engineering technique adopted by Iranian actors </td> <td> 25% </td> <td> 30 days </td> <td> 13 global ClickFix campaigns tracked; Iranian actors historically rapid adopters </td> </tr> </tbody> </table> <h2>SOC Operational Guidance            </h2> <h3>What to Hunt For</h3> Hypothesis 1: AdaptixC2 beaconing from internal hosts Iranian APTs have confirmed use of AdaptixC2 on Tehran-based infrastructure. Hunt for: <ul> <li>Outbound connections to ports 50443, 8010, 4444 (AdaptixC2 defaults)</li> <li>JA3/JA4 fingerprints associated with AdaptixC2 TLS handshakes</li> <li>HTTP/S beaconing with regular intervals to IPs in ASN 51889 or ASN 44208</li> <li>ATT&CK: T1071.001, T1573.002</li> </ul> Hypothesis 2: Cyber Av3ngers ICS pre-positioning The 21-day silence demands proactive hunting, not passive waiting: <ul> <li>Scan for Unitronics Vision/Samba PLC reconnaissance from Iranian ASNs</li> <li>Monitor Shodan/Censys for scanning of Unitronics and Schneider Electric devices from Iranian IP ranges</li> <li>ATT&CK: T1190, T0883 (Internet Accessible Device), T0855 (Unauthorized Command Message)</li> </ul> Hypothesis 3: SHADYSMILE developer platform compromise UNC6446 aerospace espionage has been quiet for 14 days — long dwell times are expected for this actor: <ul> <li>Audit internal GitHub/GitLab for dormant accounts matching UNC6446 TTPs</li> <li>Search for SHADYSMILE indicators on developer workstations</li> <li>Review repository access logs for unusual cloning or forking patterns</li> <li>ATT&CK: T1195.002, T1199 (Trusted Relationship)</li> </ul> Hypothesis 4: OAuth device code flow abuse <ul> <li>Alert on unusual device code authorization grants in Azure AD/Entra ID, especially from non-device endpoints</li> <li>Monitor for token refresh patterns from unexpected geolocations</li> <li>Search for applications with excessive OAuth scopes granted via consent flows</li> <li>ATT&CK: T1528, T1550.001, T1621</li> </ul> <h3>Detection Rules to Prioritize</h3> <ul> <li>Edge device exploitation: Ensure IDS/IPS signatures are current for CVE-2025-53521 (F5 BIG-IP) and CVE-2026-3055 (Citrix NetScaler). Monitor for post-exploitation webshell indicators on F5 appliances.</li> <li>PowerShell-based backdoors: Enhance logging and alerting for T1059.001 — MuddyWater's POWERSTATS lineage relies heavily on PowerShell. Enable Script Block Logging and Constrained Language Mode where feasible.</li> <li>Legitimate RAT abuse: Alert on unexpected installations of remote access tools (AnyDesk, ScreenConnect, Atera) — Iranian actors use these as living-off-the-land persistence (T1219).</li> <li>Supply chain indicators: Run npm audit across all JavaScript projects; cross-reference Axios package versions against the Nessus plugin for the backdoored release.</li> </ul> <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services</h3> Iranian state actors have historically targeted financial institutions for both espionage and destructive attacks (the 2012–2013 Operation Ababil DDoS campaign set the precedent). In the current conflict: <ul> <li>Priority: OAuth and cloud identity security. Financial institutions' heavy reliance on cloud services and federated identity makes them prime targets for the OAuth device code flow attacks documented this cycle. Audit all OAuth application consents in your tenant. Revoke overly permissive grants. Implement conditional access policies that restrict device code flow to managed devices only.</li> <li>Priority: Monitor for DDoS-for-hire escalation. The Aisuru-Kimwolf botnet remains available to pro-Iranian hacktivists; financial services are a traditional target for retaliatory DDoS during geopolitical escalation.</li> <li>ATT&CK focus: T1528, T1550.001, T1621, T1498 (Network Denial of Service)</li> </ul> <h3>Energy</h3> This sector faces the highest risk of destructive attack in the current threat environment: <ul> <li>Priority: ICS/OT network segmentation validation. The Cyber Av3ngers silence is most dangerous for energy operators. Validate that SCADA systems are not directly reachable from IT networks. Specifically hunt for IOCONTROL malware indicators (SHA-256 hash above) on any system that bridges IT/OT boundaries.</li> <li>Priority: Edge device patching. Energy companies running F5 BIG-IP or Citrix NetScaler for remote access to operational networks must treat CVE-2025-53521 and CVE-2026-3055 as emergency patches — these are confirmed entry points for Iranian operators targeting this sector.</li> <li>Priority: Monitor for TWOSTROKE targeting if you operate in Azerbaijan, Turkey, or adjacent energy corridors (BTC pipeline, Shah Deniz, TANAP).</li> <li>ATT&CK focus: T1190, T0883, T0855, T1078</li> </ul> <h3>Healthcare</h3> Healthcare organizations face dual risk from both state-sponsored espionage and ransomware operators who may be operating with tacit Iranian state approval: <ul> <li>Priority: Supply chain hygiene. Healthcare IT environments frequently rely on JavaScript-based applications and patient portal frameworks that may include Axios as a dependency. Audit immediately.</li> <li>Priority: Ransomware preparedness. The MOIS-cybercrime convergence trend (Pay2Key ransomware-as-a-service) means healthcare organizations could face ransomware attacks with state-level sophistication. Ensure offline backups are current and tested.</li> <li>Priority: Phishing resilience. MuddyWater's spearphishing campaigns use themed decoys — healthcare-themed lures targeting medical research and pharmaceutical organizations are consistent with Iranian collection priorities.</li> <li>ATT&CK focus: T1566.001, T1195.002, T1486 (Data Encrypted for Impact)</li> </ul> <h3>Government</h3> Government agencies — particularly those involved in defense, diplomacy, and intelligence — are primary targets: <ul> <li>Priority: Credential and identity security. The Handala Hack Team breach of the FBI Director's personal Gmail demonstrates that Iranian actors will target personal accounts of government officials to bypass institutional security controls. Brief all senior officials on personal account security, including hardware security keys and separation of personal/professional communications.</li> <li>Priority: DIB contractor oversight. UNC6446's SHADYSMILE campaign targeting aerospace contractors through developer platforms has been quiet for 14 days — which for a pre-positioning operation may indicate successful dwell, not abandonment. Require DIB contractors to report anomalous developer platform activity.</li> <li>Priority: Diplomatic communications security. With no ceasefire negotiations visible, expect Iranian intelligence collection against diplomatic channels to intensify.</li> <li>ATT&CK focus: T1078, T1199, T1195.002, T1114 (Email Collection)</li> </ul> <h3>Aviation & Logistics</h3> Aviation and logistics organizations face espionage risk from Iranian actors seeking intelligence on military supply chains and sanctions evasion: <ul> <li>Priority: Developer platform security. UNC6446's targeting of aerospace organizations through GitHub/GitLab makes this sector a direct target. Audit repository access controls, review for dormant or suspicious accounts, and monitor for unusual code access patterns.</li> <li>Priority: Edge device hardening. Aviation logistics networks frequently use VPN concentrators and load balancers (F5, Citrix, Ivanti) for partner connectivity — all of which are under active Iranian exploitation.</li> <li>Priority: Third-party risk. Aviation supply chains involve numerous subcontractors and logistics partners. Any partner running unpatched edge devices or compromised npm dependencies becomes an entry point.</li> <li>ATT&CK focus: T1190, T1199, T1195.002, T1041 (Exfiltration Over C2 Channel)</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>IMMEDIATE (Within 24 Hours)</h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> Deploy AdaptixC2 detection signatures — JA3/JA4 fingerprints, default beacon ports (50443, 8010, 4444). Iranian APTs confirmed using this framework on Tehran-based infrastructure. </td> <td> SOC </td> </tr> <tr> <td> Review F5 BIG-IP APM patch status against advisory K000160515 (published 1 April) and CVE-2025-53521. Confirm no memory-resident webshells on F5 appliances. </td> <td> IT Ops </td> </tr> <tr> <td> Verify Citrix NetScaler patching against CVE-2026-3055. Rotate any SAML signing keys that may have been exposed. </td> <td> IT Ops </td> </tr> <tr> <td> Brief executive leadership and board on current threat level. Iranian actors have demonstrated willingness to target senior officials' personal accounts (Handala/FBI Director breach). Recommend hardware security keys for all C-suite personal email. </td> <td> CISO / Executive </td> </tr> </tbody> </table> <h3>7-DAY</h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> Audit all npm projects for Axios package integrity. Run npm audit and cross-reference against the published Nessus detection plugin. Extend to PyPI dependencies (TeamPCP indicators). </td> <td> DevOps </td> </tr> <tr> <td> Implement OAuth device code flow monitoring in Azure AD/Entra ID. Alert on device code grants from non-device endpoints and unusual token refresh patterns. </td> <td> SOC / Identity Team </td> </tr> <tr> <td> Conduct proactive threat hunt for Cyber Av3ngers / HYDRO KITTEN ICS activity — Unitronics/Schneider PLC scanning, IOCONTROL C2 callbacks, and the IOCONTROL hash listed above. </td> <td> SOC / OT Security </td> </tr> <tr> <td> Hunt for SHADYSMILE indicators on internal GitHub/GitLab instances and developer workstations. Audit for dormant accounts matching UNC6446 TTPs. </td> <td> SOC / DevOps </td> </tr> <tr> <td> Validate incident response playbooks for destructive ICS/OT attack scenarios. Ensure OT-specific IR procedures exist and are exercised — do not assume IT IR playbooks transfer to OT environments. </td> <td> IR Team </td> </tr> <tr> <td> Review and restrict OAuth application consents across cloud tenants. Revoke unnecessary scopes. Implement admin consent workflow for new application registrations. </td> <td> Identity / Cloud Team </td> </tr> </tbody> </table> <h3>30-DAY</h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> Commission assessment of ICS/OT network segmentation. Validate that SCADA/PLC systems are isolated from IT networks and that monitoring covers the IT/OT boundary. The Cyber Av3ngers silence may precede a major operation. </td> <td> CISO / OT Security </td> </tr> <tr> <td> Migrate from Cobalt Strike-only C2 detection to multi-framework coverage. Add detection for AdaptixC2, Sliver, Havoc, and Mythic. Iranian (and Russian/Chinese) APTs are permanently diversifying beyond Cobalt Strike. </td> <td> SOC / Detection Engineering </td> </tr> <tr> <td> Evaluate supply chain security tooling (Socket.dev, Snyk, or equivalent) for continuous monitoring of open-source dependencies across development environments. Three simultaneous supply chain compromises represent systemic risk. </td> <td> DevOps / AppSec </td> </tr> <tr> <td> Conduct tabletop exercise simulating a combined Iranian cyber-kinetic scenario: simultaneous edge device exploitation, ICS/OT disruption, and hacktivist data leak. Test cross-functional coordination between IT security, OT operations, legal, and communications. </td> <td> CISO / Executive </td> </tr> <tr> <td> Reassess threat intelligence collection coverage for defense industrial base (DIB) pre-positioning. 14+ days without visibility into UNC6446 aerospace espionage is a gap that needs active closure, not passive monitoring. </td> <td> CTI / CISO </td> </tr> </tbody> </table> <h2>The Bottom Line                            </h2> We are 32 days into a conflict that has produced the most intense Iranian cyber operations ever documented. The intelligence picture is clear: Iran's MOIS has gone broad. Seventeen countries, seven industries, 15+ custom backdoors. This is not targeted espionage — it is a regime under existential threat conducting mass collection. Your organization does not need to be a primary target to be caught in this net. Iran's IRGC is going quiet — and that's worse. The Cyber Av3ngers' 21-day silence during peak conflict conditions, combined with decentralized IRGC command after leadership decapitation, creates the conditions for an uncontrolled destructive ICS/OT operation. If you operate critical infrastructure, the time to validate your OT segmentation and IR readiness is now — not after the attack. Your detection stack has a blind spot. The confirmed adoption of AdaptixC2 by Iranian operators means Cobalt Strike-centric detection is no longer sufficient. The same shift is happening with supply chain attacks — three active compromises across npm and PyPI mean your developers' npm install is an attack surface. MFA is necessary but not sufficient. OAuth device code flow attacks bypass MFA entirely through legitimate mechanisms. Identity security must evolve beyond "did they pass MFA?" to "is this token grant pattern normal?" The absence of ceasefire signals 32 days into this conflict is itself intelligence. There is no off-ramp visible. Cyber operations will intensify, not moderate. Act accordingly.

FEATURED RESOURCES

April 1, 2026

Anomali Cyber Watch