Iran's Cyber War Machine Isn't Stopping for Peace Talks: What CISOs Need to Know Now

Anomali Threat Research

Published on

June 15, 2026

Table of Contents

Threat Assessment Level: HIGH <h2> Introduction </h2> We are now 107 days into the Iran-Israel conflict, and the intelligence picture is unambiguous: Iranian state-sponsored cyber operations are accelerating, not pausing, despite active ceasefire negotiations. This week, a CVSS 10.0 remote code execution vulnerability in Ivanti Sentry hit CISA's Known Exploited Vulnerabilities catalog with a public proof-of-concept — and the Iranian threat group most likely to weaponize it has a documented history of exploiting Ivanti products within 72 hours of PoC availability. Simultaneously, fresh phishing infrastructure impersonating military career portals confirms that Defense Industrial Base (DIB) pre-positioning continues unabated. A 46-day silence from one of Iran's most destructive hacktivist proxies — the same group that wiped 200,000 endpoints in a single operation in March — is not reassuring. It's alarming. If your organization operates in defense, energy, healthcare, financial services, government, or critical infrastructure, this report demands your immediate attention. <h2> What Changed (June 11–15, 2026) </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> June 11 </td> <td> CVE-2026-10520 (Ivanti Sentry, CVSS 10.0) added to CISA KEV </td> <td> Unauthenticated root-level RCE; public PoC published by WatchTowr Labs </td> </tr> <tr> <td> June 12 </td> <td> CVE-2026-35273 (Oracle PeopleSoft, CVSS 9.8) added to CISA KEV </td> <td> Unauthenticated RCE affecting PeopleSoft 8.61/8.62 — widely deployed in HR/ERP </td> </tr> <tr> <td> June 12 </td> <td> Handala (Void Manticore) broke 9-day silence </td> <td> Claimed FBI drone breach; issued threats against FIFA World Cup teams and US military personnel </td> </tr> <tr> <td> June 14 </td> <td> Handala actor profile refreshed in threat intelligence feeds </td> <td> Targeting expanded to 17 countries across 8 industry verticals </td> </tr> <tr> <td> June 14 </td> <td> Fresh SOCKS proxy infrastructure provisioned on Qeshm Island ISP (ASN 43395) </td> <td> Coincides with expected ceasefire agreement signing — pre-positioning indicator </td> </tr> <tr> <td> June 15 </td> <td> mtcareers.myftp[.]org confirmed as active Iranian phishing domain </td> <td> Military/defense career impersonation — DIB targeting during peace talks </td> </tr> <tr> <td> June 15 </td> <td> US Government suspends Anthropic Fable 5 and Mythos 5 AI models </td> <td> Jailbreak vulnerabilities enabling cyberattack generation; export controls applied </td> </tr> <tr> <td> June 15 </td> <td> CVE-2026-42271 (LiteLLM, CVSS 8.8) confirmed in KEV </td> <td> Authenticated RCE in AI proxy infrastructure via MCP stdio transport </td> </tr> <tr> <td> Ongoing </td> <td> CyberAv3ngers — 46 days of operational silence during active conflict </td> <td> Anomalous gap for an ICS/OT-focused group; probability of high-impact resurgence increases daily </td> </tr> <tr> <td> June 14 </td> <td> Iranian Mirai/Bashlite botnet staging confirmed on 94.156.152[.]234 </td> <td> Multi-architecture IoT binaries with Iran-themed naming; DDoS amplification capability against critical infrastructure </td> </tr> </tbody> </table> <h2> Conflict & Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event Type </th> <th> Detail </th> </tr> </thead> <tbody> <tr> <td> Feb 28, 2026 </td> <td> Conflict onset </td> <td> Iran-Israel hostilities escalate to sustained cyber-kinetic operations </td> </tr> <tr> <td> Mar 11, 2026 </td> <td> Destructive attack </td> <td> Handala/Void Manticore wipes 200,000 endpoints at Stryker </td> </tr> <tr> <td> Apr 30, 2026 </td> <td> Last known activity </td> <td> CyberAv3ngers last confirmed operation — now 46 days silent </td> </tr> <tr> <td> Jun 8, 2026 </td> <td> Actor emergence </td> <td> UNC6077/Berry Sandstorm (aka Unk_craftycamel) newly tracked — zero campaign visibility </td> </tr> <tr> <td> Jun 11, 2026 </td> <td> Vulnerability weaponization </td> <td> CVE-2026-10520 (CVSS 10.0) added to KEV with public PoC </td> </tr> <tr> <td> Jun 12, 2026 </td> <td> Vulnerability weaponization </td> <td> CVE-2026-35273 (CVSS 9.8) added to KEV </td> </tr> <tr> <td> Jun 12, 2026 </td> <td> Threat actor activity </td> <td> Handala resurfaces with threats against Western targets </td> </tr> <tr> <td> Jun 14, 2026 </td> <td> Infrastructure staging </td> <td> SOCKS proxy infrastructure on Qeshm Island ISP; Handala profile update </td> </tr> <tr> <td> Jun 15, 2026 </td> <td> Active phishing </td> <td> mtcareers.myftp[.]org — Iranian DIB career impersonation confirmed active </td> </tr> <tr> <td> Jun 15, 2026 </td> <td> AI threat escalation </td> <td> Anthropic models suspended; LiteLLM CVE-2026-42271 in KEV </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Pioneer Kitten and the Ivanti Sentry Crisis (CVE-2026-10520) </h3> Pioneer Kitten (MOIS-adjacent, also tracked as Fox Kitten/UNC757) has a documented pattern of exploiting Ivanti products within 72 hours of proof-of-concept availability. CVE-2026-10520 is an OS command injection vulnerability in Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1 that grants unauthenticated attackers root-level access. The combination of: <ul> <li> CVSS 10.0 severity </li> <li> Public PoC (WatchTowr Labs, published on GitHub) </li> <li> CISA KEV listing (June 11) </li> <li> Pioneer Kitten's historical exploitation pattern </li> </ul> ...creates an imminent exploitation window . Ivanti Sentry is widely deployed across government agencies and DIB contractors for secure remote access — precisely the environments Pioneer Kitten targets for initial access brokering. <h3> 2. Handala/Void Manticore — Expanded Scope, Undiminished Capability </h3> Handala (aliases: UNC5203, HomeLandJustice, BANISHED KITTEN, DUNE) — the IRGC-affiliated group responsible for wiping 200,000 endpoints at Stryker on March 11 — has expanded its targeting to 17 countries across 8 industry verticals : construction, education, energy, financial services, government, healthcare, manufacturing, and technology. Their TTPs remain focused on maximum destruction: <ul> <li> T1190: Exploiting public-facing applications for initial access </li> <li> T1486: Deploying wipers disguised as ransomware </li> <li> T1565.001: Manipulating stored data </li> <li> T1491.002: External defacement for psychological impact </li> </ul> The June 12 resurfacing with threats against FIFA World Cup teams and US military personnel signals continued intent to target Western interests. <h3> 3. DIB Pre-Positioning via Career Portal Impersonation </h3> The domain mtcareers.myftp[.]org (resolving to 52.204.228[.]76 on AWS) represents active Iranian phishing infrastructure targeting defense sector personnel. The "mtcareers" naming convention strongly suggests military technology career portal impersonation — a social engineering approach designed to harvest credentials from DIB contractor employees. Key characteristics: <ul> <li> Hosted on AWS for legitimacy (ASN 14618) </li> <li> Registered via No-IP.com free DDNS — enables rapid infrastructure rotation </li> <li> Tagged by Recorded Future's Insikt Group as Iranian-attributed </li> <li> Active during ceasefire negotiations — confirming that diplomacy provides cover for accelerated pre-positioning </li> </ul> <h3> 4. CyberAv3ngers: 46 Days of Silence </h3> CyberAv3ngers — the IRGC-affiliated group known for targeting ICS/OT systems (including the November 2023 Unitronics attacks against US water utilities) — has been silent for 46 days during an active conflict. This is anomalous and concerning. Historical pattern analysis suggests three possibilities: <ul> <li> Persona rotation to evade tracking </li> <li> Preparation for a significant destructive operation </li> <li> Shift to new infrastructure not yet attributed </li> </ul> The longer the silence, the higher the probability of a high-impact operation upon resurfacing. <h3> 5. AI Weaponization: A Two-Vector Threat </h3> The US Government's emergency suspension of Anthropic's Fable 5 and Mythos 5 models — combined with CVE-2026-42271 (LiteLLM, CVSS 8.8, authenticated RCE via MCP stdio transport) — creates a dual AI threat surface: <ul> <li> Vector A: Exploiting AI infrastructure for network access (LiteLLM vulnerability) </li> <li> Vector B: Weaponizing AI models for capability development (jailbroken models generating exploit code) </li> </ul> Iranian actors, particularly APT42/Charming Kitten , have demonstrated interest in AI tools for social engineering and exploit development. The US government's emergency response indicates this threat is assessed as imminent. <h3> 6. Iranian Botnet Staging (Mirai/Bashlite) </h3> IP 94.156.152[.]234 is hosting multi-architecture IoT botnet binaries with explicitly Iran-themed naming (iran.armv6l, iran.arm7). This infrastructure provides DDoS amplification capability that could be directed at critical infrastructure during escalation windows — particularly OT/ICS environments where network flooding can cause physical disruption. <h2> Named Threat Actors — Attribution Summary </h2> <table> <thead> <tr> <th> Actor </th> <th> Affiliation </th> <th> Primary Capability </th> <th> Current Status </th> </tr> </thead> <tbody> <tr> <td> Handala / Void Manticore (UNC5203, BANISHED KITTEN, DUNE) </td> <td> IRGC </td> <td> Destructive wipers, defacement </td> <td> Active — profile refreshed June 14; threats issued June 12 </td> </tr> <tr> <td> CyberAv3ngers </td> <td> IRGC </td> <td> ICS/OT targeting, water/energy </td> <td> Silent 46 days — anomalous </td> </tr> <tr> <td> Pioneer Kitten (Fox Kitten, UNC757) </td> <td> MOIS-adjacent </td> <td> Initial access brokering, Ivanti exploitation </td> <td> Expected to exploit CVE-2026-10520 within 72h </td> </tr> <tr> <td> MuddyWater (TEMP.Zagros) </td> <td> MOIS </td> <td> Spearphishing, PowerShell backdoors </td> <td> Active — last confirmed update May 27 </td> </tr> <tr> <td> APT42 / Charming Kitten </td> <td> IRGC-IO </td> <td> Credential harvesting, social engineering, AI interest </td> <td> Active — AI weaponization concern </td> </tr> <tr> <td> UNC6077 / Berry Sandstorm (Unk_craftycamel) </td> <td> Suspected MOIS </td> <td> Unknown — newly tracked </td> <td> Zero campaign visibility — emerging actor </td> </tr> </tbody> </table> <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Pioneer Kitten exploits CVE-2026-10520 against government/DIB Ivanti Sentry instances </td> <td> 75% </td> <td> Within 72 hours </td> <td> Historical pattern: exploits Ivanti within 72h of PoC; public PoC available; KEV-listed </td> </tr> <tr> <td> Additional Iran-attributed phishing domains using career/recruitment themes surface </td> <td> 50% </td> <td> 7 days </td> <td> mtcareers domain confirms active campaign; peace talks provide operational cover </td> </tr> <tr> <td> CyberAv3ngers break silence with ICS/OT targeting claim or destructive operation </td> <td> 35% </td> <td> 7–14 days </td> <td> 46-day silence during active conflict is anomalous; probability increases daily </td> </tr> <tr> <td> Handala deploys wiper against Western target following negotiation breakdown </td> <td> 25% </td> <td> Within 48h of breakdown </td> <td> Demonstrated capability (200K endpoints wiped March 11); expanded targeting scope </td> </tr> <tr> <td> Iranian actors weaponize jailbroken AI models for exploit generation </td> <td> 30% </td> <td> 30 days </td> <td> APT42 interest in AI tools; Anthropic models suspended due to confirmed jailbreak vulnerabilities </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK Technique </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> Ivanti Sentry exploitation attempts </td> <td> T1190, T1059.004 </td> <td> Monitor Ivanti Sentry logs for unauthenticated API calls to admin endpoints; alert on OS command injection patterns in HTTP parameters </td> </tr> <tr> <td> CRITICAL </td> <td> Phishing with military/defense career lures </td> <td> T1566.001, T1566.002 </td> <td> Email gateway rules for domains matching *careers* on free DDNS providers (No-IP, DuckDNS, DynDNS); inspect links to myftp.org subdomains </td> </tr> <tr> <td> HIGH </td> <td> IoT botnet staging downloads </td> <td> T1584.005, T1059.004 </td> <td> Network detection for HTTP GETs to /bins.sh, /bot.*, or binaries with iran.* naming from IoT device subnets </td> </tr> <tr> <td> HIGH </td> <td> LiteLLM MCP exploitation </td> <td> T1190 </td> <td> Monitor /mcp-rest/test/* endpoints for unexpected command execution; audit authenticated sessions for privilege abuse </td> </tr> <tr> <td> HIGH </td> <td> Oracle PeopleSoft RCE attempts </td> <td> T1190 </td> <td> WAF rules for CVE-2026-35273 exploitation patterns against PeopleSoft 8.61/8.62 instances </td> </tr> <tr> <td> MEDIUM </td> <td> Wiper deployment indicators </td> <td> T1486, T1565.001 </td> <td> Endpoint detection for mass file encryption/deletion patterns; monitor for MBR/VBR overwrites; alert on bulk file system changes </td> </tr> <tr> <td> MEDIUM </td> <td> DDNS-based C2 communications </td> <td> T1583.006, T1071.001 </td> <td> DNS analytics for high-frequency queries to free DDNS providers from internal hosts </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> Hypothesis: Pioneer Kitten has already scanned your Ivanti Sentry instances. </li> <ul> <li> Hunt: Review Ivanti Sentry access logs for the past 7 days. Look for unauthenticated requests to administrative API endpoints, particularly from IP ranges associated with Iranian hosting providers or VPN exit nodes. </li> <li> Technique: T1190, T1595.002 (Active Scanning: Vulnerability Scanning) </li> </ul> <li> Hypothesis: Career-themed phishing emails have reached employee inboxes. </li> <ul> <li> Hunt: Search email logs for messages containing "military careers," "defense careers," "mt careers," or links to myftp.org / No-IP.com subdomains. Check for any credential submissions to these domains in proxy logs. </li> <li> Technique: T1566.002, T1078 (Valid Accounts) </li> </ul> <li> Hypothesis: IoT devices on your network are communicating with botnet C2. </li> <ul> <li> Hunt: Query DNS/proxy logs for connections from IoT device segments to 94.156.152[.]234. Search for bins.sh or shell script downloads from any external IP to IoT subnets. </li> <li> Technique: T1584.005, T1059.004 </li> </ul> <li> Hypothesis: CyberAv3ngers have rotated to new infrastructure you haven't blocked. </li> <ul> <li> Hunt: Review ICS/OT network segments for new outbound connections to previously unseen IPs/domains. Cross-reference with known CyberAv3ngers TTPs (Unitronics default credential abuse, T1078, T1133). </li> <li> Technique: T1133 (External Remote Services), T1078 </li> </ul> </ol> <h3> IOC Blocking Table </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> mtcareers.myftp[.]org </td> <td> Iranian DIB phishing — military career impersonation </td> </tr> <tr> <td> IPv4 </td> <td> 52.204.228[.]76 </td> <td> Hosting for mtcareers phishing domain (AWS) </td> </tr> <tr> <td> IPv4 </td> <td> 94.156.152[.]234 </td> <td> Mirai/Bashlite botnet staging — Iran-themed binaries </td> </tr> <tr> <td> SHA-256 </td> <td> d3cdc3f18bbc5bb050ec5b212d7e28ae972185de8b3b7361f68bc4a53450ce49 </td> <td> Mirai/Bashlite multi-arch IoT botnet binary </td> </tr> <tr> <td> Domain </td> <td> Vpsvault[.]host </td> <td> C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> markherman.59veterans[.]com </td> <td> C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> b27[.]icu </td> <td> C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> sjrhs[.]org </td> <td> C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> mtscvs[.]com </td> <td> C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> mebeliotmasiv[.]com </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 91.132.228[.]133 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 45.198.224[.]214 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 84.32.214[.]103 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 45.207.163[.]89 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 115.190.225[.]63 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]220 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]230 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]231 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 206.123.156[.]238 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]169 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]52 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]55 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 185.93.89[.]43 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 172.94.9[.]250 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 192.253.248[.]181 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 217.60.241[.]17 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 62.60.226[.]42 </td> <td> C2 infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 45.86.5[.]225 </td> <td> C2 infrastructure </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services </h3> Primary threat: Handala/Void Manticore has expanded targeting to include financial services across 17 countries. Their wiper-as-ransomware technique (T1486) is designed to destroy data while creating confusion about whether recovery is possible. Actions: <ul> <li> Validate offline backup integrity for core banking systems — assume wipers will target both primary and backup volumes </li> <li> Review Oracle PeopleSoft deployments (HR/payroll) — CVE-2026-35273 provides unauthenticated RCE to these systems </li> <li> Ensure SWIFT/payment systems are network-segmented from general IT infrastructure </li> <li> Brief fraud teams on Iranian social engineering campaigns using career-themed lures </li> </ul> <h3> Energy </h3> Primary threat: CyberAv3ngers' 46-day silence is most concerning for energy sector organizations. Their historical targeting of ICS/OT systems (Unitronics PLCs, SCADA/HMI) and the active Mirai/Bashlite botnet staging suggest DDoS-as-disruption capability against OT networks. Actions: <ul> <li> Audit all internet-facing OT/ICS devices — remove any with default credentials </li> <li> Deploy network monitoring at IT/OT boundaries specifically watching for connections to 94.156.152[.]234 </li> <li> Review Arista EOS network switch configurations against published security advisories </li> <li> Ensure safety instrumented systems (SIS) are air-gapped from control networks </li> <li> Prepare for DDoS against OT networks — validate that safety systems function independently of network connectivity </li> </ul> <h3> Healthcare </h3> Primary threat: Handala's expanded targeting now explicitly includes healthcare. Their March 11 wiper attack (200,000 endpoints) demonstrates willingness to cause mass disruption regardless of humanitarian impact. Actions: <ul> <li> Prioritize Ivanti Sentry patching — healthcare organizations commonly deploy Ivanti for remote clinician access </li> <li> Ensure electronic health record (EHR) systems have tested offline operational procedures </li> <li> Validate that medical device networks are segmented from administrative IT </li> <li> Review all DDNS-based connections from clinical networks — free DDNS services (No-IP.com) are being abused for C2 </li> </ul> <h3> Government </h3> Primary threat: Pioneer Kitten's expected exploitation of CVE-2026-10520 directly targets government Ivanti Sentry deployments. The mtcareers phishing domain specifically targets government/military personnel. Actions: <ul> <li> Emergency Ivanti Sentry patching — this is the #1 priority for government networks </li> <li> Implement additional authentication controls on all remote access gateways pending patch deployment </li> <li> Brief all personnel with security clearances on career-themed phishing campaigns — "mtcareers" specifically targets military/defense job seekers </li> <li> Audit AWS-hosted services for unauthorized connections from 52.204.228[.]76 </li> <li> Review Ivanti Sentry logs for any unauthenticated access in the past 14 days (pre-PoC scanning may have occurred) </li> </ul> <h3> Aviation & Logistics </h3> Primary threat: Iranian actors have historically used career-themed lures against aviation sector personnel (tracked as Nimbus Manticore/MiniFast campaigns). The mtcareers domain may represent an extension of this targeting. Actions: <ul> <li> Alert HR/recruiting teams about fraudulent career portal domains — verify all job application platforms before sharing with candidates </li> <li> Review supply chain vendor access — Iranian actors use initial access brokering (Pioneer Kitten) to move laterally through contractor networks </li> <li> Audit all Ivanti and Oracle deployments in logistics management systems </li> <li> Monitor for anomalous VPN connections from geographic regions inconsistent with employee locations </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops / Vulnerability Management </td> <td> Patch all Ivanti Sentry instances to R10.5.2, R10.6.2, or R10.7.1 minimum. CVE-2026-10520 is CVSS 10.0 with public PoC and active exploitation expected within 72 hours. If patching is not possible within 24h, implement network-level access restrictions to Sentry admin interfaces. </td> </tr> <tr> <td> 2 </td> <td> SOC / Network Security </td> <td> Block mtcareers.myftp[.]org and IP 52.204.228[.]76 at DNS, proxy, and email gateway layers. Add all IOCs from the blocking table above to detection and prevention controls. </td> </tr> <tr> <td> 3 </td> <td> SOC / Network Security </td> <td> Block 94.156.152[.]234 and deploy network detection for bins.sh download patterns and iran.* binary naming in HTTP traffic, particularly from IoT device subnets. </td> </tr> <tr> <td> 4 </td> <td> SOC / Email Security </td> <td> Deploy email filtering rules for messages containing military/defense career themes with links to free DDNS providers (myftp.org, no-ip.com, ddns.net, duckdns.org). </td> </tr> <tr> <td> 5 </td> <td> Executive / IR </td> <td> Validate incident response readiness — confirm IR retainer is active, contact lists are current, and wiper-specific playbooks are tested. Handala's demonstrated capability (200K endpoints) means response time is measured in minutes, not hours. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops / Vulnerability Management </td> <td> Patch Oracle PeopleSoft to address CVE-2026-35273 (CVSS 9.8, unauthenticated RCE). Any PeopleSoft 8.61/8.62 instance is vulnerable. </td> </tr> <tr> <td> 2 </td> <td> DevOps / Cloud Security </td> <td> Audit LiteLLM proxy deployments for versions below 1.83.7. CVE-2026-42271 allows authenticated users to execute arbitrary commands via MCP stdio transport. Patch or restrict /mcp-rest/test/* endpoints. </td> </tr> <tr> <td> 3 </td> <td> SOC / Threat Hunting </td> <td> Execute hunting hypotheses listed above — prioritize Ivanti Sentry log review and career-themed phishing email searches. </td> </tr> <tr> <td> 4 </td> <td> Network Security / OT </td> <td> Deploy IoT botnet detection — monitor IoT device subnets for outbound connections to known staging IPs and shell script downloads. </td> </tr> <tr> <td> 5 </td> <td> IT Ops / Network </td> <td> Review Arista EOS switch configurations against published security advisories. Ensure network infrastructure is not exploitable as a pivot point. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> CISO / Threat Intelligence </td> <td> Commission proactive threat hunt for CyberAv3ngers persona rotation. 46 days of silence during active conflict is anomalous — search for new Telegram channels, rebranded personas, and infrastructure overlap with known aliases. </td> </tr> <tr> <td> 2 </td> <td> CISO / Security Architecture </td> <td> Conduct wiper resilience assessment — validate that backup systems are isolated from production networks, test restoration procedures, and confirm that safety-critical systems can operate independently during a mass wiper event. </td> </tr> <tr> <td> 3 </td> <td> CISO / Vendor Management </td> <td> Audit all Ivanti, Oracle, and AI/ML platform deployments across the enterprise and supply chain. These three vendor categories represent the current Iranian exploitation focus. </td> </tr> <tr> <td> 4 </td> <td> Security Architecture </td> <td> Implement network segmentation review — ensure ICS/OT, medical devices, IoT, and AI infrastructure are properly segmented from general IT networks. Iranian actors exploit flat networks for lateral movement. </td> </tr> <tr> <td> 5 </td> <td> Threat Intelligence </td> <td> Establish collection requirements for UNC6077/Berry Sandstorm (aka Unk_craftycamel) — newly tracked Iranian actor with zero campaign visibility. Coordinate with threat intelligence vendors for early indicator sharing. </td> </tr> </tbody> </table> <h2> The Bottom Line </h2> One hundred and seven days into this conflict, the pattern is clear: Iranian cyber operations do not pause for diplomacy. Every ceasefire negotiation window we've observed has coincided with accelerated pre-positioning — not de-escalation. Today's intelligence confirms this pattern with hard evidence: <ul> <li> Active phishing infrastructure targeting defense personnel during peace talks </li> <li> A CVSS 10.0 vulnerability in the exact product category Iranian actors prefer to exploit, with a public PoC and a 72-hour exploitation window </li> <li> A destructive threat group that wiped 200,000 endpoints three months ago, now targeting 17 countries across 8 industries </li> <li> A 46-day silence from an ICS/OT-focused group that historically precedes significant operations </li> </ul> The threat level remains HIGH . The question is not whether Iranian actors will exploit these opportunities — it's whether your organization will be patched, segmented, and prepared when they do. Patch Ivanti Sentry today. Block the IOCs today. Validate your wiper response playbook today. Tomorrow may be too late. Published 2026-06-15 by the Anomali CTI Desk. Intelligence derived from Anomali ThreatStream Next-Gen. CISA KEV, and partner feeds. For IOC feeds and STIX packages, contact your Anomali representative. Previous threat level: HIGH (2026-06-14) → Current threat level: HIGH (unchanged). No de-escalation indicators observed.

FEATURED RESOURCES

June 15, 2026

Anomali Cyber Watch