Iran's Cyber War Machine Hits Triple Speed: What CISOs Must Do Now

Anomali Threat Research

Published on

July 2, 2026

Table of Contents

Threat Assessment Level: CRITICAL <h2> Introduction </h2> One hundred twenty-four days into active US-Iran kinetic conflict, Iran's cyber operations have reached an inflection point that demands immediate executive attention. Israel's National Cyber Directorate chief confirmed what defenders have felt on the ground: hostile cyber incidents tripled to approximately 4,800 per month in June 2026 — up from 1,600 a year prior. US officials have explicitly stated that a preliminary diplomatic deal with Tehran will not reduce cyber operations, which run on a separate track from nuclear negotiations. This is not a theoretical escalation. Active command-and-control infrastructure is confirmed online. A mass credential-harvesting campaign targeting 430,000 firewalls has been linked to ransomware deployments. Seven ICS/SCADA advisories dropped simultaneously, expanding the attack surface for Iranian proxies with documented intent to strike water and energy systems. And a critical SharePoint RCE vulnerability — now on CISA's Known Exploited Vulnerabilities catalog — puts over 10,000 internet-facing servers in the crosshairs. If your organization touches defense, energy, water, government, healthcare, or financial services, this report is your call to action. <h2> What Changed </h2> The past 72 hours brought a convergence of developments that collectively pushed the threat level to CRITICAL: <ul> <li> 3x attack volume confirmed — Israel's National Cyber Directorate publicly acknowledged ~4,800 cyber incidents/month in June 2026, directly attributed to the US-Israeli offensive against Iran </li> <li> Handala Hack Team C2 infrastructure active — The domain handala[.]red confirmed as live command-and-control, with intelligence tagging indicating expansion to "physical threats" — a new escalation vector </li> <li> FortiBleed → Ransomware pipeline confirmed — The mass credential-harvesting campaign (11,250 FortiGate portals scanned, ~110 million credentials gathered) is now directly linked to INC Ransom and Lynx ransomware operations, with 354 completed intrusions and 12 ransomware deployments </li> <li> CVE-2026-45659 (SharePoint RCE) added to CISA KEV — Low-complexity, authenticated deserialization vulnerability affecting SharePoint Enterprise 2016, Server 2019, and Subscription Edition; 10,000+ servers exposed online </li> <li> CVE-2026-35616 (FortiClient EMS, CVSS 9.1) — Actively exploited to deploy EKZ Stealer malware in the FortiBleed campaign chain </li> <li> 7 simultaneous ICS/SCADA advisories — Schneider Electric EcoStruxure, Delta Electronics DVP12SE PLCs, StoneFly Storage, and others — expanding OT attack surface at the worst possible moment </li> <li> MuddyWater (MOIS) POWERSTATS operations active — Iran's MOIS-affiliated espionage group is producing fresh POWERSTATS credential-harvesting malware on a near-daily cadence, sustaining active collection operations against government and defense targets </li> <li> Pioneer Kitten 80+ day operational silence — UNC757's extended public silence matches documented pre-positioning behavior; actor profile refreshed 2026-07-01, confirming continued tracking and active threat status </li> <li> US officials confirm cyber ops persist despite diplomacy — The preliminary US-Iran deal creates zero reduction in Iranian cyber tempo </li> </ul> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 2026-02-28 </td> <td> US-Iran kinetic conflict begins </td> <td> Day 0 — cyber operations surge begins </td> </tr> <tr> <td> 2026-06-03 </td> <td> Iran strikes Kuwait </td> <td> Escalated cyber retaliation posture triggered </td> </tr> <tr> <td> 2026-06-04 </td> <td> handala[.]red C2 domain first observed active </td> <td> Handala Hack Team establishes persistent infrastructure </td> </tr> <tr> <td> 2026-06-07 </td> <td> Iran-Israel exchange missile strikes </td> <td> Hacktivist proxy activation expected </td> </tr> <tr> <td> 2026-06-17 </td> <td> US officials confirm cyber ops persist despite deal </td> <td> Diplomatic progress ≠ cyber de-escalation </td> </tr> <tr> <td> 2026-06-23 </td> <td> Iranian IRGC-linked banks hit by retaliatory cyber ops </td> <td> Bidirectional conflict — retaliation cycle active </td> </tr> <tr> <td> 2026-06-24 </td> <td> IOCONTROL malware updated in threat feeds </td> <td> ICS-targeting capability refreshed </td> </tr> <tr> <td> 2026-06-25–30 </td> <td> MuddyWater produces fresh POWERSTATS credential harvesters daily </td> <td> Active MOIS espionage operations </td> </tr> <tr> <td> 2026-06-29 </td> <td> CVE-2026-48558 (SimpleHelp, CVSS 10.0) added to CISA KEV </td> <td> Matches Pioneer Kitten exploitation playbook </td> </tr> <tr> <td> 2026-06-30 </td> <td> 7 ICS/SCADA advisories published (Schneider, Delta, StoneFly) </td> <td> OT attack surface expansion </td> </tr> <tr> <td> 2026-07-01 </td> <td> CVE-2026-45659 (SharePoint RCE) added to CISA KEV </td> <td> Government/DIB infrastructure at risk </td> </tr> <tr> <td> 2026-07-01 </td> <td> UNC5855, UNC2428, UNC757 actor profiles refreshed </td> <td> Active Iranian APT operations confirmed </td> </tr> <tr> <td> 2026-07-02 </td> <td> FortiBleed linked to INC/Lynx ransomware (354 intrusions) </td> <td> Criminal-state convergence confirmed </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> Iranian Nation-State Actors: Operating at Scale </h3> MuddyWater (MOIS-affiliated) continues producing fresh POWERSTATS credential-harvesting malware on a near-daily cadence. This group's operational tempo directly supports Iran's intelligence collection requirements against government and defense targets. Pioneer Kitten / UNC757 (IRGC-affiliated) maintains 80+ days of operational silence — a pattern historically consistent with pre-positioning behavior before major operations. Their actor profile was refreshed on 2026-07-01, indicating continued tracking by intelligence services. Pioneer Kitten's documented model of exploiting Fortinet and Citrix devices and selling access to ransomware affiliates creates a direct parallel to the FortiBleed campaign. UNC5855 — associated with Iranian operations targeting Israeli government infrastructure — had IOCs last observed on 2026-07-01, confirming active operations. UNC2428 / Agrius — Iran's destructive/wiper capability — was updated on 2026-07-01, indicating continued operational readiness. <h3> Hacktivist Proxies: Silence Before the Storm </h3> Handala Hack Team, Cyber Av3ngers, DieNet, and 313 Team (all IRGC-linked) have maintained 9+ days of public silence. Historical pattern analysis shows this matches pre-destructive-operation behavior. The confirmed active C2 domain handala[.]red — combined with intelligence tagging referencing "physical threats" — suggests these groups are preparing for a coordinated operation rather than going dormant. Cyber Av3ngers specifically have documented history of targeting Unitronics and Schneider PLCs in US water systems. The simultaneous publication of Delta Electronics DVP12SE PLC and Schneider Electric EasyLogic/Saitel DP RTU advisories creates fresh exploitation opportunities aligned with their known targeting preferences. <h3> Criminal-State Convergence: The FortiBleed Pipeline </h3> The FortiBleed campaign represents a dangerous convergence of criminal and state-sponsored operations: <ul> <li> Scale: 11,250 FortiGate portals scanned, 430,000 firewalls targeted, ~110 million credentials harvested </li> <li> Operator: Russian-speaking, ~20-person organized operation </li> <li> Downstream: Direct linkage to INC Ransom and Lynx ransomware (operator logged into both negotiation panels) </li> <li> Exploitation: CVE-2026-35616 (FortiClient EMS, CVSS 9.1) used to deploy EKZ Stealer </li> <li> Iran nexus: Pioneer Kitten uses the identical business model (exploit Fortinet → sell access to ransomware affiliates). Whether the FortiBleed operator is a customer, competitor, or collaborator of Pioneer Kitten remains under investigation </li> </ul> For defenders, the distinction between "Iranian state access broker" and "Russian criminal access broker" is operationally irrelevant — the same Fortinet devices are targeted by both, and the downstream impact is identical. <h3> Critical Vulnerabilities Under Active Exploitation </h3> <table> <thead> <tr> <th> CVE </th> <th> Product </th> <th> CVSS </th> <th> Status </th> <th> Iran Relevance </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-45659 </td> <td> Microsoft SharePoint </td> <td> High </td> <td> CISA KEV (2026-07-01) </td> <td> Government/DIB staple; Iranian actors historically target Microsoft infrastructure </td> </tr> <tr> <td> CVE-2026-48558 </td> <td> SimpleHelp </td> <td> 10.0 </td> <td> CISA KEV (2026-06-29) </td> <td> Matches Pioneer Kitten exploitation playbook exactly </td> </tr> <tr> <td> CVE-2026-35616 </td> <td> FortiClient EMS </td> <td> 9.1 </td> <td> Actively exploited </td> <td> Used in FortiBleed chain; Pioneer Kitten parallel </td> </tr> </tbody> </table> <h2> Predictive Analysis </h2> Based on current intelligence indicators, actor behavior patterns, and historical precedent: <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Iranian actors exploit CVE-2026-45659 (SharePoint) </td> <td> 75% </td> <td> 7–14 days </td> <td> KEV status + government targeting alignment + 10K exposed servers </td> </tr> <tr> <td> Coordinated destructive hacktivist operation against US water/energy </td> <td> 70% </td> <td> 7 days </td> <td> 9+ day silence pattern + active C2 + historical precedent </td> </tr> <tr> <td> Pioneer Kitten weaponizes CVE-2026-48558 (SimpleHelp) </td> <td> 60% </td> <td> 14 days </td> <td> CVSS 10.0 + matches documented exploitation playbook </td> </tr> <tr> <td> FortiBleed infrastructure linked to Iranian access-brokering </td> <td> 55% </td> <td> 7–14 days </td> <td> Parallel business model + shared Fortinet targeting </td> </tr> <tr> <td> Cyber Av3ngers target newly-disclosed Delta/Schneider PLC vulns </td> <td> 50% </td> <td> 14 days </td> <td> Historical rapid ICS exploitation pattern </td> </tr> <tr> <td> Handala "physical threats" escalation leads to confirmed physical incident </td> <td> 25% </td> <td> 30 days </td> <td> New capability indicator; limited precedent </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> <ol> <li> Handala C2 Communication ( T1071.001 — Application Layer Protocol: Web Protocols) </li> </ol> <ul> <li> Block and alert on DNS resolution or HTTP/HTTPS connections to handala[.]red </li> <li> Hunt hypothesis: "Are any internal hosts resolving or connecting to handala[.]red or related infrastructure?" </li> <li> Search proxy/DNS logs for the past 30 days for historical connections </li> </ul> <ol start="2"> <li> Iranian APT Infrastructure — ASN 213790 ( T1583.006 — Acquire Infrastructure) </li> </ol> <ul> <li> Deploy network detection rules for traffic to/from ASN 213790 ("Limited Network," Tehran) </li> <li> Key IPs to monitor and block: </li> <ul> <li> 192.253.248[.]55 </li> <li> 192.253.248[.]169 </li> <li> 77.90.185[.]253 </li> </ul> <li> Hunt hypothesis: "Do we have any outbound connections to ASN 213790 that could indicate C2 beaconing?" </li> </ul> <ol start="3"> <li> FortiBleed Exploitation Chain ( T1190 , T1040 , T1078 ) </li> </ol> <ul> <li> Monitor FortiGate appliances for unauthorized Golang processes (packet sniffers) </li> <li> Alert on FortiClient EMS exploitation indicators (CVE-2026-35616) </li> <li> Hunt hypothesis: "Are there any anomalous processes on Fortinet appliances, or credential dumps from FortiGate admin interfaces?" </li> <li> Audit all FortiGate admin credentials — assume compromise if unpatched before June 2026 </li> </ul> <ol start="4"> <li> SharePoint Exploitation ( T1190 , T1505.003 — Web Shell) </li> </ol> <ul> <li> Monitor SharePoint servers for deserialization exploitation attempts (CVE-2026-45659) </li> <li> Alert on web shell deployment to SharePoint directories </li> <li> Hunt hypothesis: "Are there any new .aspx files in SharePoint web directories, or unusual process spawning from w3wp.exe?" </li> <li> Review SharePoint ULS logs for serialization errors or unusual API calls </li> </ul> <ol start="5"> <li> ICS/OT Anomaly Detection ( T0855 , T0831 ) </li> </ol> <ul> <li> Monitor for unauthorized command messages to Delta DVP12SE PLCs </li> <li> Alert on configuration changes to Schneider Electric EasyLogic T150 and Saitel DP RTUs </li> <li> Hunt hypothesis: "Are there any unauthorized engineering workstation connections to PLC/RTU networks, or unexpected firmware/logic changes?" </li> </ul> <h3> ATT&CK Techniques to Prioritize for Detection </h3> <table> <thead> <tr> <th> Technique ID </th> <th> Name </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> T1190 </td> <td> Exploit Public-Facing Application </td> <td> SharePoint, FortiGate, SimpleHelp, Citrix </td> </tr> <tr> <td> T1078 </td> <td> Valid Accounts </td> <td> FortiBleed credential harvesting </td> </tr> <tr> <td> T1071.001 </td> <td> Web Protocols (C2) </td> <td> Handala C2 communications </td> </tr> <tr> <td> T1505.003 </td> <td> Web Shell </td> <td> Post-exploitation persistence on SharePoint </td> </tr> <tr> <td> T1486 </td> <td> Data Encrypted for Impact </td> <td> INC/Lynx ransomware downstream </td> </tr> <tr> <td> T1040 </td> <td> Network Sniffing </td> <td> Golang packet sniffers on Fortinet devices </td> </tr> <tr> <td> T0855 </td> <td> Unauthorized Command Message </td> <td> ICS targeting (Delta, Schneider PLCs) </td> </tr> <tr> <td> T1059 </td> <td> Command and Scripting Interpreter </td> <td> Post-exploitation execution </td> </tr> <tr> <td> T1021.001 </td> <td> Remote Services: RDP </td> <td> Lateral movement in FortiBleed intrusions </td> </tr> </tbody> </table> <h3> IOC Blocking Table </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> handala[.]red </td> <td> Handala Hack Team active C2 (confidence 90) </td> </tr> <tr> <td> Domain </td> <td> ftp.4bagh[.]net </td> <td> Iranian credential exfiltration infrastructure </td> </tr> <tr> <td> Domain </td> <td> 4bagh[.]net </td> <td> Iranian credential exfiltration infrastructure </td> </tr> <tr> <td> Domain </td> <td> sonic05.irandns[.]com </td> <td> Iranian DNS infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]55 </td> <td> ASN 213790 — Iranian APT infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]169 </td> <td> ASN 213790 — Iranian APT infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 77.90.185[.]253 </td> <td> ASN 213790 — Iranian APT infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 95.38.16[.]220 </td> <td> Iranian APT indicator (Fanava Group) </td> </tr> <tr> <td> IPv4 </td> <td> 171.22.27[.]16 </td> <td> Iranian APT indicator </td> </tr> <tr> <td> IPv4 </td> <td> 62.60.226[.]10 </td> <td> Iranian APT indicator </td> </tr> <tr> <td> Domain </td> <td> soniamirandaholding.recantomirabella[.]website </td> <td> Credential harvesting infrastructure </td> </tr> <tr> <td> Domain </td> <td> goroda.nexloc[.]ro </td> <td> Credential harvesting infrastructure </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> Primary threat: Retaliatory operations against banking infrastructure (IRGC-linked banks were hit on June 23 — counter-retaliation is expected). FortiBleed credential exposure may include financial institution VPN credentials. <ul> <li> Audit all Fortinet VPN appliances for compromise indicators; assume credentials are exposed if devices were internet-facing before June 2026 </li> <li> Enable enhanced monitoring on SWIFT messaging systems and core banking platforms </li> <li> Review third-party vendor access — Iranian actors use supply chain compromise to reach financial targets </li> <li> Prepare for DDoS campaigns (T1498) as hacktivist proxies historically target banking websites during escalation periods </li> </ul> <h3> Energy </h3> Primary threat: Cyber Av3ngers and Handala targeting ICS/SCADA systems. IOCONTROL malware (updated 2026-06-24) specifically designed for energy sector PLCs. <ul> <li> Immediately patch or segment Delta Electronics DVP12SE PLCs and Schneider Electric EasyLogic T150/Saitel DP RTUs </li> <li> Verify network segmentation between IT and OT environments — Iranian actors exploit IT-side vulnerabilities (Fortinet, Citrix) to pivot to OT </li> <li> Deploy monitoring for unauthorized engineering workstation connections </li> <li> Review and restrict remote access to SCADA systems; disable any internet-facing HMI interfaces (FUXA SCADA advisory relevant) </li> <li> Ensure backup operational procedures exist for manual plant operation if digital systems are compromised </li> </ul> <h3> Healthcare </h3> Primary threat: Ransomware via FortiBleed pipeline (INC/Lynx); SharePoint exploitation for data theft; medical device vulnerabilities (OFFIS DCMTK advisory). <ul> <li> Patch SharePoint instances immediately — healthcare organizations frequently run legacy SharePoint versions </li> <li> Review OFFIS DCMTK medical imaging toolkit deployments for file write and information disclosure vulnerabilities </li> <li> Ensure ransomware resilience: offline backups of EHR systems, tested recovery procedures </li> <li> Monitor for EKZ Stealer deployment (targets Chromium/Firefox credentials — clinical workstations at risk) </li> </ul> <h3> Government </h3> Primary threat: Iranian APT espionage (MuddyWater POWERSTATS, Pioneer Kitten pre-positioning); SharePoint RCE exploitation; credential harvesting. <ul> <li> CVE-2026-45659 (SharePoint) is your top priority — government agencies are primary targets and SharePoint is ubiquitous in federal/state environments </li> <li> Hunt for POWERSTATS malware indicators (credential harvesting via PowerShell) </li> <li> Audit SimpleHelp remote access deployments (CVE-2026-48558, CVSS 10.0) — these are common in government IT support </li> <li> Review all accounts with access to classified or sensitive systems for credential compromise via FortiBleed </li> <li> Coordinate with CISA on threat briefings specific to your agency's mission </li> </ul> <h3> Aviation & Logistics </h3> Primary threat: Supply chain disruption operations; Pioneer Kitten targeting of VPN/remote access infrastructure; potential physical-cyber convergence (Handala "physical threats" expansion). <ul> <li> Audit all remote access infrastructure (Fortinet, Citrix, SimpleHelp) — these are the primary entry vectors for Iranian actors </li> <li> Review PTC Windchill PLM system security if deployed (active Iranian targeting of defense industrial base PLM systems) </li> <li> Brief physical security teams on Handala's expansion to physical threats — airport and logistics facility personnel may be targeted </li> <li> Ensure operational continuity plans account for simultaneous cyber and physical disruption scenarios </li> <li> Monitor for credential theft targeting airline reservation and cargo management systems </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🔴 </td> <td> SOC </td> <td> Block handala[.]red at DNS/proxy layer; alert on any historical resolution attempts; investigate any hosts that have connected </td> </tr> <tr> <td> 🔴 </td> <td> SOC </td> <td> Deploy blocking rules for ASN 213790 IPs: 192.253.248[.]55, 192.253.248[.]169, 77.90.185[.]253 </td> </tr> <tr> <td> 🔴 </td> <td> IT Ops </td> <td> Patch Microsoft SharePoint against CVE-2026-45659 on all Enterprise 2016, Server 2019, and Subscription Edition instances </td> </tr> <tr> <td> 🔴 </td> <td> IT Ops </td> <td> Verify all FortiGate appliances and FortiClient EMS instances are patched; audit for Golang packet sniffers; rotate all admin credentials </td> </tr> <tr> <td> 🔴 </td> <td> IT Ops </td> <td> Audit SimpleHelp deployments for CVE-2026-48558 (CVSS 10.0) — patch or remove from internet exposure immediately </td> </tr> <tr> <td> 🔴 </td> <td> Executive/IR </td> <td> Confirm incident response retainers are active and IR playbooks account for destructive/wiper scenarios (not just ransomware) </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟠 </td> <td> OT Security </td> <td> Patch or network-segment Delta Electronics DVP12SE PLCs and Schneider Electric EasyLogic T150/Saitel DP RTUs per CISA advisories </td> </tr> <tr> <td> 🟠 </td> <td> SOC </td> <td> Deploy detection analytics for T1505.003 (web shell) on SharePoint servers and T1040 (network sniffing) on Fortinet appliances </td> </tr> <tr> <td> 🟠 </td> <td> Physical Security </td> <td> Brief facility security teams on Handala's expansion to physical threats; coordinate with law enforcement on any threatening communications </td> </tr> <tr> <td> 🟠 </td> <td> IT Ops </td> <td> Audit all internet-facing Citrix NetScaler instances for CitrixBleed 2 exploitation indicators (Anubis ransomware campaign active) </td> </tr> <tr> <td> 🟠 </td> <td> Identity </td> <td> Force credential rotation for all accounts that authenticated through FortiGate VPNs in the past 90 days </td> </tr> <tr> <td> 🟠 </td> <td> Executive </td> <td> Brief board/senior leadership that diplomatic progress with Iran does NOT reduce cyber risk — maintain heightened posture </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟡 </td> <td> CISO </td> <td> Commission assessment of AI-agent attack surface — inventory all exposed Langflow, LiteLLM, n8n, and MCP orchestration instances </td> </tr> <tr> <td> 🟡 </td> <td> Architecture </td> <td> Review and harden IT/OT network segmentation; ensure no flat network paths exist between corporate IT and industrial control systems </td> </tr> <tr> <td> 🟡 </td> <td> IR Planning </td> <td> Conduct tabletop exercise simulating coordinated Iranian destructive operation (wiper + DDoS + physical threat) against your sector </td> </tr> <tr> <td> 🟡 </td> <td> Vendor Risk </td> <td> Assess third-party vendors' exposure to FortiBleed credential compromise — request attestation of Fortinet patching status </td> </tr> <tr> <td> 🟡 </td> <td> SOC </td> <td> Establish persistent hunting cadence for Iranian actor TTPs: PowerShell credential harvesting, Fortinet/Citrix exploitation, web shell deployment </td> </tr> </tbody> </table> <h2> The Bottom Line </h2> The US-Iran conflict has entered a phase where cyber operations are self-sustaining regardless of diplomatic outcomes . US officials have said it plainly. The data confirms it — 4,800 incidents per month and climbing. Three factors make the next 14 days particularly dangerous: <ol> <li> Hacktivist silence matches pre-attack patterns. When Cyber Av3ngers and Handala go dark simultaneously while maintaining active C2 infrastructure, history tells us a coordinated operation is being staged. </li> <li> The vulnerability window is wide open. CVE-2026-45659 (SharePoint), CVE-2026-48558 (SimpleHelp), CVE-2026-35616 (FortiClient EMS), and fresh ICS advisories for Schneider and Delta PLCs — all actively exploited or immediately exploitable, all aligned with documented Iranian actor preferences. </li> <li> Criminal-state convergence eliminates safe assumptions. You cannot assume a ransomware attack is "just criminal" anymore. The same Fortinet vulnerabilities feed both Russian criminal operators and Iranian state access brokers. The same downstream impact hits your organization regardless of attribution. </li> </ol> Do not let diplomatic optimism become a security posture. Patch now. Hunt now. Prepare for destructive scenarios — not just data theft or ransomware. The next coordinated Iranian cyber operation is not a question of if , but when — and the indicators suggest when is measured in days, not months. Published 2026-07-02 by the Anomali CTI Desk. Intelligence derived from ThreatStream Next-Gen CISA advisories, open-source reporting, and partner feeds. For IOC feeds and detection content, contact your Anomali representative.

FEATURED RESOURCES

July 24, 2026

Anomali Cyber Watch

Iranian Cyber Retaliation Is No Longer Theoretical — It's Happening Now

December 24, 2025

Anomali Cyber Watch

Anomali Cyber Watch: Sample

LockBit 5.0 Ransomware Targets Windows, Linux, and VMware ESXi in Active Campaigns. Google Patches Actively Exploited Chrome Zero-Day CVE-2026-2441. Infostealer Targets OpenClaw Configuration Files to Capture Credentials and User Context. And more...

July 14, 2026

Anomali Cyber Watch

The Silence Before the Storm: Iranian Cyber Retaliation Is Imminent — What CISOs Must Do Now

Explore All