The Cyber Front Is Now a Killing Field: What CISOs Must Know About the Iran Conflict at Day 16

Anomali Threat Research

Published on

March 16, 2026

Table of Contents

Sixteen days into the most significant state-on-state cyber-kinetic conflict since Russia’s invasion of Ukraine, the Iran theater has crossed thresholds that no security playbook anticipated. Drones have struck cloud data centers. A single hacktivist front group wiped 200,000 endpoints at a Fortune 500 medical device company. Iran’s new Supreme Leader has publicly named Amazon, Google, Microsoft, and Palantir as military targets. And the quietest actors on the board — Iran’s state-sponsored APTs — are almost certainly already inside networks that haven’t detected them yet. This is not a future scenario. This is the week of 10–15 March 2026. If your organization touches healthcare, defense, energy, financial services, cloud infrastructure, or industrial control systems, this briefing is for you. The decisions you make in the next 72 hours will determine whether you’re a headline or a bystander. <h2>What Changed This Week</h2> The 2026 Iran conflict — triggered by Operation Epic Fury’s US-Israel kinetic strikes beginning 28 February — entered a dangerous new phase this week. Here are the seven developments that should be on every CISO’s radar: <ol> <li>Handala destroyed 200,000 devices at Stryker Corporation (11–13 March), exfiltrating 50TB of data and causing a global network outage. This is the largest confirmed Iranian-linked destructive cyberattack against a US company to date. Stryker’s stock dropped 3.6%.</li> <li>Iran’s new Supreme Leader, Mojtaba Khamenei, issued his first public statement vowing continued Strait of Hormuz closure and attacks on US interests — eliminating near-term diplomatic off-ramps and sustaining maximum escalation pressure.</li> <li>Cisco SD-WAN exploitation widened with two new CVEs (CVE-2026-20122, CVE-2026-20128) under active attack, bringing the total to eight vulnerabilities in this campaign. CISA added them to the Known Exploited Vulnerabilities catalog with enhanced reporting requirements.</li> <li>Eight ICS/OT advisories dropped in three days, including a critical remote code execution flaw in Inductive Automation Ignition (SCADA/HMI) and high-severity vulnerabilities in Siemens S7-1500 PLCs, Honeywell building management systems, and Trane HVAC controllers.</li> <li>Russia-aligned hacktivists joined the Iranian cyber front. Quantified for the first time: 149 DDoS attacks against 110 organizations across 16 countries by 12 groups — with Keymous+, DieNet, and NoName057(16) responsible for nearly 75% of all activity.</li> <li>Iranian state APTs are maintaining a conspicuously quiet posture. MuddyWater’s Dindoor backdoor campaign was confirmed in US airport, bank, software company, and NGO networks — one of the few state operations detected. The broader silence from MuddyWater (MOIS), APT42 (IRGC-IO), UNC1549, and BANISHED KITTEN (IRGC) is consistent with Iranian pre-positioning doctrine: proxies generate noise while state operators preserve access for decisive strikes.</li> <li>IRGC drone strikes hit three AWS data centers in UAE and Bahrain (5 March), marking the first-ever kinetic attack on cloud computing infrastructure. Iran subsequently named AWS, Google, Microsoft, and Palantir as military targets — a doctrinal shift with direct implications for any organization dependent on cloud services.</li> </ol> <h2>Conflict Timeline: 28 February – 15 March 2026</h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Cyber/Kinetic </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> 28 Feb </td> <td> Operation Epic Fury launches — US-Israel strikes on Iran </td> <td> Kinetic </td> <td> Supreme Leader Khamenei killed; Iranian internet collapses to 1–4% capacity </td> </tr> <tr> <td> 1–4 Mar </td> <td> Pro-Iran hacktivist swarm activates (Handala, DieNet, Keymous+, 313 Team, Cyber Toufan) </td> <td> Cyber </td> <td> DDoS, defacement, and wiper attacks against US and allied targets begin </td> </tr> <tr> <td> 3 Mar </td> <td> SecurityWeek reports state-sponsored APT activity stays “quiet” while hacktivists spike </td> <td> Cyber (assessment) </td> <td> Pattern consistent with Iranian doctrine: proxies provide cover for state operators </td> </tr> <tr> <td> 4 Mar </td> <td> The Hacker News quantifies hacktivist campaign: 149 attacks, 110 orgs, 16 countries, 12 groups </td> <td> Cyber </td> <td> Healthcare, government, financial services most targeted </td> </tr> <tr> <td> 5 Mar </td> <td> IRGC drone strikes hit 3 AWS data centers in UAE and Bahrain </td> <td> Kinetic </td> <td> First-ever kinetic attack on cloud infrastructure; 2 of 3 availability zones in AWS me-central-1 go offline </td> </tr> <tr> <td> 5–6 Mar </td> <td> Cisco SD-WAN zero-day exploitation begins spreading; The Register reports additional bugs under attack </td> <td> Cyber </td> <td> CVE-2026-20122 and CVE-2026-20128 confirmed actively exploited </td> </tr> <tr> <td> 8 Mar </td> <td> IRGC publicly states Bahrain AWS facility targeted because it hosts US military workloads </td> <td> Kinetic (declaration) </td> <td> Cloud providers reclassified as military targets by a nation-state </td> </tr> <tr> <td> 10–12 Mar </td> <td> CISA publishes 8 ICS advisories: Siemens S7-1500, Ignition SCADA, Honeywell BMS, Trane HVAC, Heliox EV chargers </td> <td> Vulnerability disclosure </td> <td> Critical attack surface expansion for ICS/OT environments </td> </tr> <tr> <td> 11 Mar </td> <td> CISA adds Cisco SD-WAN and Ivanti EPM to KEV catalog with enhanced reporting </td> <td> Cyber (regulatory) </td> <td> Federal agencies and CI operators under mandatory patching timelines </td> </tr> <tr> <td> 11–13 Mar </td> <td> Handala wiper attack on Stryker Corporation: 200K devices wiped, 50TB exfiltrated, global outage </td> <td> Cyber (destructive) </td> <td> Largest confirmed Iranian-linked destructive attack on a US company </td> </tr> <tr> <td> 12 Mar </td> <td> Mojtaba Khamenei (new Supreme Leader) vows continued Hormuz closure and attacks on US interests </td> <td> Geopolitical </td> <td> Diplomatic off-ramps eliminated; sustained escalation posture confirmed </td> </tr> <tr> <td> 13 Mar </td> <td> Iran publicly names AWS, Google, Microsoft, and Palantir as military targets (CBS News) </td> <td> Geopolitical (declaration) </td> <td> Doctrinal shift: tech companies themselves — not just their customers — are now declared targets </td> </tr> <tr> <td> 13 Mar </td> <td> Handala claims attack on Verifone (payment systems); Verifone denies breach </td> <td> Cyber (disputed) </td> <td> Conflicting reports — Handala claims breach; Verifone says “no evidence” </td> </tr> <tr> <td> 15 Mar </td> <td> BANISHED KITTEN threat actor record updated in ThreatStream </td> <td> Intelligence update </td> <td> Continued tracking of Iranian state-linked destructive operations </td> </tr> </tbody> </table> <h2>Threat Analysis: The Three Layers of Iran’s Cyber Campaign</h2> <h3>Layer 1 — The Hacktivist Shield (Loud, Visible, Deniable)</h3> The most visible activity comes from pro-Iran hacktivist groups, many of which serve as fronts for Iranian intelligence services. Handala — linked to MOIS/Emennet Pasargad — is the most capable, having executed the Stryker wiper attack using techniques consistent with BiBiWiper derivatives. Other active groups include DieNet, Keymous+, 313 Team, Cyber Toufan, Cyber Isnaad Front, and Nation of Saviors. The Russia-Iran convergence adds a new dimension. NoName057(16) and Z-Pentest — both Russian-aligned — have appeared on the Iranian cyber front. Whether this represents genuine operational coordination or opportunistic bandwagoning remains debated among analysts, but the effect is the same: a larger, more distributed attack surface for defenders to cover. The numbers are stark: 149 DDoS attacks against 110 organizations across 16 countries in the first week of the conflict alone, with three groups (Keymous+, DieNet, NoName057(16)) accounting for 74.6% of all activity. H-ISAC has issued a specific warning to US hospitals to prepare for DDoS. <h3>Layer 2 — The State APT Undercurrent (Quiet, Persistent, Dangerous)</h3> Here is the paradox that should keep CISOs awake: while hacktivist activity has spiked dramatically, state-sponsored APT activity has stayed conspicuously quiet. This is not reassuring — it is alarming. Iranian doctrine uses hacktivist proxies for visible, deniable disruption while state operators — MuddyWater (MOIS), APT42/CALANQUE (IRGC-IO), UNC1549/Imperial Kitten (IRGC), and BANISHED KITTEN (IRGC) — maintain quiet access for decisive strikes. MuddyWater’s Dindoor backdoor campaign against US airports, banks, software companies, and NGOs was one of the few state operations detected. The implication: other operations are likely ongoing but below the detection threshold. Key malware families in active use or assessed as deployment-ready include IOCONTROL (ICS-specific), ZeroCleare (wiper), Meteor (wiper), StrifeWater (RAT), and Dindoor (backdoor). The Handala/Stryker attack likely used a new wiper variant not yet publicly named by researchers. <h3>Layer 3 — Kinetic Strikes on Digital Infrastructure (Unprecedented)</h3> The IRGC drone strikes on three AWS data centers in UAE and Bahrain represent a first in the history of armed conflict: the deliberate kinetic destruction of cloud computing infrastructure. Iran’s subsequent public naming of AWS, Google, Microsoft, and Palantir as military targets represents a doctrinal shift — these companies are no longer collateral; they are declared combatants in Iran’s strategic calculus. This has immediate implications for any organization running workloads in Middle East cloud regions (AWS me-central-1, me-south-1; and potentially Azure/GCP equivalents). It also raises the question of whether Iran will extend targeting to these companies’ global infrastructure through cyber means. <h2>Vulnerability Landscape: What’s Being Exploited Right Now</h2> <table> <thead> <tr> <th> Vulnerability </th> <th> CVSS </th> <th> Status </th> <th> Risk Context </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-20122 — Cisco Catalyst SD-WAN Manager API file overwrite </td> <td> 5.4 </td> <td> Actively exploited; CISA KEV </td> <td> Privilege escalation to vmanage; part of 8-CVE SD-WAN campaign </td> </tr> <tr> <td> CVE-2026-20128 — Cisco Catalyst SD-WAN DCA credential exposure </td> <td> 7.5 </td> <td> Actively exploited; CISA KEV </td> <td> Credential harvesting enables lateral movement </td> </tr> <tr> <td> CVE-2025-68613 — n8n workflow automation RCE </td> <td> 9.9 </td> <td> Actively exploited; CISA KEV </td> <td> ZeroBot malware targeting n8n instances; full instance compromise </td> </tr> <tr> <td> CVE-2022-42475 — FortiOS/FortiGate heap overflow </td> <td> 9.8 </td> <td> Actively exploited (ongoing) </td> <td> Siemens RUGGEDCOM APE1808 advisory references this; Iranian actors have historically exploited FortiOS </td> </tr> <tr> <td> Inductive Automation Ignition RCE (ICSA-26-071-06) </td> <td> Critical </td> <td> Advisory published; exploitation imminent </td> <td> OS-level code execution on SCADA/HMI systems </td> </tr> <tr> <td> Siemens SIMATIC S7-1500 code injection (ICSA-26-071-04) </td> <td> High </td> <td> Advisory published </td> <td> Malicious project import enables PLC code injection </td> </tr> <tr> <td> Honeywell IQ4x BMS Controller (ICSA-26-069-03) </td> <td> High </td> <td> Advisory published </td> <td> Unauthorized access to building management systems </td> </tr> <tr> <td> Trane Tracer SC/SC+ (ICSA-26-071-01) </td> <td> High </td> <td> Advisory published </td> <td> Info disclosure + arbitrary command execution on HVAC controllers </td> </tr> </tbody> </table> <h2>Predictive Analysis: What Comes Next</h2> Based on the current trajectory of the conflict, Iranian operational patterns, and the expanding attack surface, the Anomali CTI Desk assesses the following probabilities over the next 7–30 days: <table> <thead> <tr> <th> Probability </th> <th> Scenario </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> ~70% </td> <td> Additional Handala wiper attacks against US companies in healthcare, defense supply chain, or financial services. Stryker was a proof of concept; the group will seek to replicate at scale. </td> <td> Handala’s operational tempo, MOIS backing, stated retaliatory intent, and demonstrated capability against hardened targets </td> </tr> <tr> <td> ~60% </td> <td> Iranian state APTs (MuddyWater, UNC1549) activate pre-positioned access in US critical infrastructure networks for disruptive operations, timed to kinetic escalation milestones. </td> <td> Quiet state APT posture is consistent with pre-positioning doctrine; MuddyWater/Dindoor already confirmed in US networks </td> </tr> <tr> <td> ~50% </td> <td> Russia-aligned hacktivists expand coordination with pro-Iran groups, broadening DDoS targeting to NATO member government services and critical infrastructure. </td> <td> NoName057(16) already active on Iran’s cyber front; geopolitical alignment of interests between Moscow and Tehran </td> </tr> <tr> <td> ~40% </td> <td> Iranian operators attempt exploitation of newly disclosed ICS vulnerabilities (Ignition RCE, S7-1500, Honeywell BMS) against US water or energy infrastructure within 30 days. </td> <td> Cyber Av3ngers/Unitronics precedent; IOCONTROL malware designed for ICS; 8 new advisories expand attack surface </td> </tr> <tr> <td> ~35% </td> <td> Cyber operations targeting cloud provider global infrastructure (not just ME-region physical assets) — OAuth token theft, API key compromise, or service account abuse against AWS, Azure, or GCP management planes. </td> <td> Iran’s public naming of cloud providers as targets signals intent beyond physical strikes; IRGC has demonstrated willingness to cross escalation thresholds </td> </tr> </tbody> </table> <h2>SOC Operational Guidance</h2> <h3>What to Hunt For Now</h3> Hypothesis 1: Wiper pre-staging in your environment Iranian-linked wipers (BiBiWiper variants, ZeroCleare, Meteor, StrifeWater) typically stage before detonation. Hunt for: - Mass file deletion patterns or MBR/VBR modification attempts (T1485 — Data Destruction, T1561.001 — Disk Wipe: MBR) - Unusual service stops across multiple endpoints simultaneously (T1489 — Service Stop) - New or modified scheduled tasks with destructive payloads (T1053.005 — Scheduled Task) - Lateral movement via valid accounts following credential theft (T1078 — Valid Accounts, T1021 — Remote Services) Hypothesis 2: Cisco SD-WAN compromise as a beachhead If your organization runs Cisco Catalyst SD-WAN, assume exploitation attempts are occurring: - Monitor SD-WAN Manager API endpoints for anomalous file write operations (T1190 — Exploit Public-Facing Application) - Audit DCA credential files for unauthorized access (T1083 — File and Directory Discovery, T1078 — Valid Accounts) - Look for lateral movement from SD-WAN management hosts to internal networks (T1021.001 — Remote Desktop Protocol, T1068 — Exploitation for Privilege Escalation) Hypothesis 3: ICS/OT reconnaissance and initial access Iranian ICS operators (Cyber Av3ngers, HYDRO KITTEN (IRGC-CEC)) have demonstrated capability against Unitronics PLCs and water systems. With 8 new ICS advisories: - Monitor for scanning of Ignition web interfaces (default port 8088/8043) (T1190) - Audit Siemens S7-1500 project imports for unauthorized modifications (T0839 — Module Firmware) - Check Honeywell BMS and Trane Tracer controllers for unauthorized sessions (T0816 — Device Restart/Shutdown) - Verify network segmentation between IT and OT/BMS/HVAC networks Hypothesis 4: DDoS as a smokescreen for intrusion The 149-attack hacktivist swarm is not just nuisance — DDoS often serves as cover for simultaneous intrusion attempts: - Correlate DDoS events with concurrent authentication anomalies (T1498 — Network Denial of Service + T1078) - Monitor for credential stuffing or brute-force attempts during DDoS windows (T1110 — Brute Force) - Watch for data exfiltration attempts timed to DDoS-induced monitoring blind spots (T1041 — Exfiltration Over C2 Channel) <h3>Prioritized IOC Watchlist</h3> <table> <thead> <tr> <th> Type </th> <th> Indicator / Family </th> <th> Context </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> Malware family </td> <td> BiBiWiper (and variants: ZeroShred, GoneXML) </td> <td> Handala’s primary destructive tool; likely used in Stryker attack </td> <td> Deploy signatures; hunt for artifacts </td> </tr> <tr> <td> Malware family </td> <td> ZeroCleare </td> <td> Iranian wiper historically used against energy sector </td> <td> Ensure detection rules current </td> </tr> <tr> <td> Malware family </td> <td> Meteor </td> <td> Iranian wiper used in rail/government attacks </td> <td> Ensure detection rules current </td> </tr> <tr> <td> Malware family </td> <td> IOCONTROL </td> <td> ICS-specific malware attributed to Iranian actors </td> <td> Priority for any OT environment </td> </tr> <tr> <td> Malware family </td> <td> StrifeWater </td> <td> RAT used by Moses Staff / Iranian operators </td> <td> Hunt for C2 beaconing patterns </td> </tr> <tr> <td> Malware family </td> <td> Dindoor </td> <td> MuddyWater (MOIS) backdoor; confirmed in US airport/bank/NGO networks </td> <td> Hunt for persistence mechanisms </td> </tr> <tr> <td> Malware family </td> <td> ZeroBot </td> <td> Actively targeting n8n instances (CVE-2025-68613) </td> <td> Block known C2 infrastructure </td> </tr> <tr> <td> CVE </td> <td> CVE-2026-20122, CVE-2026-20128 </td> <td> Cisco SD-WAN — actively exploited </td> <td> Patch immediately or mitigate </td> </tr> <tr> <td> CVE </td> <td> CVE-2025-68613 </td> <td> n8n RCE (CVSS 9.9) — actively exploited </td> <td> Patch to v1.122.0+ </td> </tr> <tr> <td> CVE </td> <td> CVE-2022-42475 </td> <td> FortiOS — Iranian actors have exploited historically </td> <td> Verify patched; hunt for post-exploitation </td> </tr> <tr> <td> Infrastructure </td> <td> AWS me-central-1 (UAE), me-south-1 (Bahrain) </td> <td> Degraded due to kinetic strikes; failover risk </td> <td> Assess workload dependencies </td> </tr> <tr> <td> Threat groups </td> <td> Handala, DieNet, Keymous+, NoName057(16), 313 Team, Cyber Toufan </td> <td> Most active hacktivist groups this conflict </td> <td> Monitor Telegram channels for targeting claims </td> </tr> </tbody> </table> <h3>Detection Engineering Priorities</h3> <ol> <li>Wiper detonation detection: Signature and behavioral rules for BiBiWiper, ZeroCleare, Meteor, and IOCONTROL. Supplement with behavioral detection for mass file system changes (>1,000 files modified in <60 seconds).</li> <li>SD-WAN API abuse: Custom detection for anomalous API calls to Cisco vManage endpoints, especially file write operations and credential file access.</li> <li>ICS protocol anomalies: If running Siemens S7 or Ignition, deploy OT-specific detection for unauthorized project uploads, firmware modifications, and anomalous Modbus/S7comm traffic.</li> <li>DDoS-correlated intrusion: Alert logic that triggers enhanced monitoring when DDoS events coincide with authentication spikes or VPN anomalies.</li> </ol> <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services</h3> Financial institutions are in the primary target set for both Iranian state APTs and hacktivist groups. MuddyWater’s (MOIS) Dindoor campaign has already confirmed compromises at US banks. <ul> <li>Immediate: Verify DDoS mitigation for online banking, payment processing, and API gateways. Hacktivist groups (DieNet, Keymous+) have specifically targeted financial services with volumetric and application-layer DDoS.</li> <li>This week: Hunt for Dindoor backdoor indicators across endpoint telemetry. Audit privileged access to SWIFT and core banking systems for anomalous sessions.</li> <li>This month: Conduct a wiper impact assessment — model the business impact of a Stryker-scale wiper event (200,000 endpoints) against your environment. Validate offline backup integrity and recovery time objectives.</li> <li>Executive action: Brief the board on the elevated threat to financial infrastructure. Coordinate with FS-ISAC for sector-specific indicators and defensive playbooks.</li> </ul> <h3>Energy</h3> Energy infrastructure — particularly oil and gas — faces the highest risk of Iranian ICS/OT targeting. The Strait of Hormuz closure has already disrupted global energy markets; cyber attacks on Western energy infrastructure would amplify this leverage. <ul> <li>Immediate: Patch or isolate Inductive Automation Ignition instances (critical RCE). Verify segmentation between IT and OT networks. Audit Siemens S7-1500 PLCs for unauthorized project modifications.</li> <li>This week: Deploy IOCONTROL malware signatures across OT monitoring infrastructure. Review Honeywell BMS and Trane HVAC controller access logs for unauthorized sessions. Patch Siemens RUGGEDCOM APE1808 FortiOS components (CVE-2022-42475 context).</li> <li>This month: Conduct an ICS-specific tabletop exercise simulating simultaneous cyber-kinetic disruption (e.g., wiper on IT + PLC manipulation on OT + physical supply chain disruption from Hormuz closure).</li> <li>Executive action: Engage with DOE/CESER and E-ISAC. Ensure OT incident response retainers are active and tested.</li> </ul> <h3>Healthcare</h3> Healthcare is explicitly in the crosshairs. Handala’s Stryker attack targeted a medical device company. H-ISAC has warned US hospitals to prepare for DDoS. Iranian actors have historically targeted healthcare as “soft” critical infrastructure. <ul> <li>Immediate: Verify DDoS protection for patient-facing portals, EHR systems, and telehealth platforms. Audit medical device network segmentation — Stryker’s 200,000-device wiper demonstrates the blast radius of connected medical devices.</li> <li>This week: Hunt for wiper pre-staging indicators (BiBiWiper, ZeroCleare signatures) across clinical and administrative networks. Review Stryker product advisories for any downstream impact to devices in your environment.</li> <li>This month: Assess medical device inventory for Iranian-targeted vulnerabilities (Siemens, Honeywell components in building management and clinical engineering). Update business continuity plans for extended IT outage scenarios.</li> <li>Executive action: Coordinate with H-ISAC. Brief clinical leadership on the potential for medical device disruption. Ensure downtime procedures are current and tested.</li> </ul> <h3>Government (Federal, State, Local)</h3> Government agencies are primary targets for both espionage (APT42 (IRGC-IO), MuddyWater (MOIS)) and disruptive operations (hacktivists). CISA’s enhanced reporting requirements for Cisco SD-WAN and Ivanti EPM apply directly. <ul> <li>Immediate: Comply with CISA KEV patching timelines for CVE-2026-20122, CVE-2026-20128 (Cisco SD-WAN), and CVE-2025-68613 (n8n). Verify .gov DDoS mitigation posture.</li> <li>This week: Hunt for MuddyWater/Dindoor and APT42 indicators across agency networks. Audit Ivanti Connect Secure and FortiGate VPN appliances for signs of compromise (these are historically favored Iranian initial access vectors).</li> <li>This month: Review cloud workload placement — any workloads in AWS me-central-1/me-south-1 or Azure/GCP Middle East regions require failover planning. Assess contractor and supply chain access for signs of pre-positioning (PIR-007 context: Iranian espionage via developer platforms and fake resume lures on GitHub).</li> <li>Executive action: Elevate to CISA Shield-Up posture. Ensure cross-agency coordination with FBI, NSA, and sector-specific ISACs.</li> </ul> <h3>Aviation & Logistics</h3> MuddyWater (MOIS) has confirmed compromises at US airports. The Strait of Hormuz closure is disrupting global shipping and logistics. Aviation and logistics companies face both direct cyber targeting and cascading supply chain disruption. <ul> <li>Immediate: Hunt for Dindoor backdoor across airport IT and OT systems. Verify DDoS protection for flight operations, booking systems, and cargo management platforms.</li> <li>This week: Audit SD-WAN infrastructure (widely deployed in distributed logistics networks) for CVE-2026-20122/20128 exploitation. Review building management systems (Honeywell, Trane) at airport and warehouse facilities.</li> <li>This month: Model supply chain disruption scenarios combining Hormuz closure (physical) with cyber attacks on logistics IT (wiper/DDoS). Assess single-cloud-provider risk for operations-critical workloads.</li> <li>Executive action: Coordinate with A-ISAC and TSA. Brief operations leadership on the dual kinetic-cyber threat to supply chain continuity.</li> </ul> <h2>Prioritized Defense Recommendations </h2> <h3>🔴 Immediate (Next 24–48 Hours)</h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> Patch Cisco Catalyst SD-WAN Manager for CVE-2026-20122 and CVE-2026-20128. If patching is not possible within 48 hours, restrict API access to trusted IPs only and audit DCA credential files for unauthorized access. </td> <td> Network Operations / Vulnerability Management </td> </tr> <tr> <td> 2 </td> <td> Patch or isolate Inductive Automation Ignition servers. This is a critical RCE with OS-level privileges on SCADA/HMI systems. No internet-facing Ignition instance should remain unpatched. </td> <td> ICS/OT Security </td> </tr> <tr> <td> 3 </td> <td> Verify DDoS mitigation is active and tested for all internet-facing services. Confirm CDN/WAF configurations. Brief SOC analysts on hacktivist DDoS patterns — expect both volumetric floods and application-layer attacks. </td> <td> SOC / Network Operations </td> </tr> <tr> <td> 4 </td> <td> Deploy wiper detection signatures for BiBiWiper (and variants ZeroShred, GoneXML), ZeroCleare, Meteor, and IOCONTROL. Supplement with behavioral detection for mass file system changes and MBR/VBR modifications. </td> <td> Threat Hunting / Detection Engineering </td> </tr> <tr> <td> 5 </td> <td> Validate offline backup integrity. Confirm that critical system backups are air-gapped, recent, and tested for restoration. A Stryker-scale wiper event (200,000 endpoints) will render online backups useless if they are reachable from the production network. </td> <td> IT Operations / Backup Administration </td> </tr> </tbody> </table> <h3>🟠 7-Day Actions</h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 6 </td> <td> Assess cloud provider concentration risk for workloads in AWS me-central-1, me-south-1, or any Middle East cloud region. Develop failover plans. Iran has physically struck these facilities and publicly declared cloud providers as military targets. </td> <td> Cloud Architecture / Business Continuity </td> </tr> <tr> <td> 7 </td> <td> Patch Siemens SIMATIC S7-1500 firmware and restrict project imports to trusted, verified sources. Patch RUGGEDCOM APE1808 FortiOS components. Audit Honeywell BMS and Trane Tracer controllers for unauthorized access and segment BMS/HVAC networks from IT. </td> <td> ICS/OT Security / Facilities </td> </tr> <tr> <td> 8 </td> <td> Patch n8n to version 1.122.0 or later (CVE-2025-68613, CVSS 9.9). ZeroBot malware is actively targeting exposed instances. If patching is delayed, restrict workflow creation to trusted users and harden OS-level privileges. </td> <td> DevOps / IT Operations </td> </tr> <tr> <td> 9 </td> <td> Conduct threat hunt for MuddyWater/Dindoor, APT42, and BANISHED KITTEN indicators across the enterprise. Focus on: VPN appliances (Ivanti, FortiGate), email infrastructure, and endpoints with privileged access to critical systems. </td> <td> Threat Hunting / IR </td> </tr> <tr> <td> 10 </td> <td> Review and test incident response playbooks for wiper, DDoS, and ICS/OT scenarios. Ensure playbooks account for simultaneous multi-vector attacks (wiper + DDoS + ICS disruption). </td> <td> CISO / IR Team </td> </tr> </tbody> </table> <h3>🟡 30-Day Actions</h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 11 </td> <td> Conduct a tabletop exercise simulating simultaneous kinetic-cyber attack: cloud region outage + enterprise wiper + DDoS + ICS disruption. Include business continuity, disaster recovery, legal, communications, and executive leadership. This is no longer a theoretical scenario. </td> <td> CISO / BCP / Executive Leadership </td> </tr> <tr> <td> 12 </td> <td> Audit DIB contractor access and developer platform security. Review GitHub-hosted development workflows for dormant accounts, unusual SSH keys, and anomalous repository access. Iranian espionage groups (UNC6446) have used fake resume lures and developer platform infiltration for pre-positioning. </td> <td> Supply Chain Security / Engineering </td> </tr> <tr> <td> 13 </td> <td> Establish monitoring for cloud management plane attacks. Implement detection for OAuth token theft, API key compromise, service account abuse, and anomalous cross-tenant activity. Iran’s public targeting of cloud providers signals potential operations against management infrastructure, not just customer workloads. </td> <td> Cloud Security / IAM </td> </tr> <tr> <td> 14 </td> <td> Reassess cyber insurance coverage in light of the conflict. Many policies contain war exclusion clauses. The Stryker attack — conducted by a group linked to Iranian intelligence during an active armed conflict — will test these exclusions. Engage legal counsel and your broker now, not after an incident. </td> <td> CISO / Legal / Risk Management </td> </tr> <tr> <td> 15 </td> <td> Engage with your sector ISAC (FS-ISAC, H-ISAC, E-ISAC, A-ISAC, IT-ISAC) for conflict-specific indicators, playbooks, and coordination. The threat is sector-wide; the defense must be too. </td> <td> CISO / Threat Intelligence </td> </tr> </tbody> </table> <h2>The Bottom Line</h2> We are 16 days into a conflict that has already produced the first kinetic attack on cloud infrastructure, the largest Iranian-linked destructive cyberattack against a US company, and a new Iranian Supreme Leader who has publicly declared American technology companies as military targets. The cyber dimension of this conflict is not a sideshow — it is a co-equal theater of operations. The most dangerous signal right now is the one you’re not seeing. While hacktivist groups generate headlines with DDoS and wipers, Iran’s state-sponsored APTs — MuddyWater (MOIS), APT42 (IRGC-IO), UNC1549, BANISHED KITTEN (IRGC) — are maintaining an unusually low profile. History and doctrine tell us what this means: they are preserving access, waiting for the order to strike. The quiet is not calm. The quiet is the warning. The Stryker attack proved that Iranian-linked actors can wipe 200,000 devices at a major US corporation. The AWS drone strikes proved that cloud data centers are not beyond physical reach. The eight ICS advisories published this week proved that the attack surface for industrial control systems is expanding faster than anyone can patch. Your 72-hour checklist: - ✅ Cisco SD-WAN patched or mitigated - ✅ Ignition SCADA patched or isolated - ✅ DDoS mitigation verified and tested - ✅ Wiper detection signatures deployed - ✅ Offline backups validated - ✅ IR playbooks reviewed for multi-vector scenarios The organizations that act on this intelligence today will be the ones still operating normally next week. The ones that wait for the next headline may become it.

FEATURED RESOURCES

March 17, 2026

Public Sector

Anomali Cyber Watch

Iranian Wiper Attacks Hit U.S. Soil, Chrome Zero-Days Multiply, and Your Building Systems May Be Wide Open: What State CISOs Need to Know This Week

March 16, 2026

Anomali Cyber Watch