The Cyber Front of Operation Epic Fury: What CISOs Need to Know Right Now

Anomali Threat Research

Published on

March 3, 2026

Table of Contents

The United States and Israel are four days into Operation Epic Fury — the most significant kinetic military campaign against Iran since the 1980s. But while the world watches missile strikes and carrier group movements, a second front is already open, and it runs through your network. US Cyber Command struck first. Iran's internet has been degraded to single-digit capacity. Iran's supreme leader is confirmed dead. Six US service members have been killed. And President Trump has announced the campaign will last four to five weeks. None of that has stopped Iranian cyber operators. They are online, they are adapting, and they are coming. If your organization touches the defense industrial base, government networks, critical infrastructure, energy, or financial services — this is your threat briefing. The window for preparation is closing. <h2>What Changed in the Last 72 Hours</h2> The situation has shifted materially since late February. Here is what is new: <ul> <li>US Cyber Command confirmed as "first mover." Joint Chiefs Chair Dan Caine publicly stated that offensive cyber operations preceded or accompanied kinetic strikes — the first official confirmation of cyber-kinetic synchronization doctrine in this campaign.</li> <li>The campaign timeline doubled. Trump's 4–5 week projection extends the expected Iranian cyber retaliation window from roughly three weeks to six weeks (through mid-April 2026).</li> <li>Iranian hackers are using Starlink to stay operational. Despite a near-total state internet blackout, at least one of Iran's most prominent hacking crews is using commercial satellite internet to maintain command-and-control and claim retaliatory attacks against the US.</li> <li>MuddyWater deployed three new malware families. Operation Olalampo — active since January 26 — introduced GhostFetch, CHAR, and HTTP_VIP, described as AI-assisted malware, targeting government, financial services, energy, and education organizations across the Middle East and North Africa.</li> <li>Active Iranian command-and-control infrastructure identified. A high-confidence C2 server (78.38.30.71) on Iran's state-controlled telecom network remains active during the blackout — meaning it is, by definition, a government-sanctioned operational asset.</li> </ul> <h2>Conflict & Threat Timeline</h2> <table> <tbody> <tr> <td> Date </td> <td> Event </td> <td> Cyber Significance </td> </tr> <tr> <td> 26 Jan 2026 </td> <td> MuddyWater begins Operation Olalampo </td> <td> GhostFetch, CHAR, HTTP_VIP malware deployed against MENA targets — pre-positioning before kinetic escalation </td> </tr> <tr> <td> 26 Feb 2026 </td> <td> CISA issues ICS advisories for Yokogawa CENTUM VP and Johnson Controls Frick </td> <td> Fresh attack surface for OT/SCADA targeting; relevant to IOCONTROL malware </td> </tr> <tr> <td> ~28 Feb 2026 </td> <td> Operation Epic Fury begins; US/Israeli kinetic strikes on IRGC command centers </td> <td> USCYBERCOM confirmed as "first mover" — offensive cyber preceded or accompanied strikes </td> </tr> <tr> <td> 1 Mar 2026 </td> <td> Iran's supreme leader confirmed dead; Iranian internet at 1–4% capacity </td> <td> Retaliation motivation at maximum; state internet degraded but not eliminated </td> </tr> <tr> <td> 1 Mar 2026 </td> <td> IOCONTROL (QUEUECAT) malware updated in threat intelligence feeds </td> <td> OT/SCADA-targeting malware actively maintained by Iranian operators </td> </tr> <tr> <td> 2 Mar 2026 </td> <td> Iranian hackers confirmed using Starlink for C2 resilience </td> <td> Commercial SATCOM bypasses state internet blackout — offensive operations continue </td> </tr> <tr> <td> 2 Mar 2026 </td> <td> MuddyWater Operation Olalampo publicly reported </td> <td> Three new AI-assisted malware families confirmed across multiple sources </td> </tr> <tr> <td> 3 Mar 2026 </td> <td> Trump confirms 4–5 week campaign; 6 US service members KIA </td> <td> Retaliation window extends to mid-April; Israeli strikes expand to Hezbollah in Lebanon </td> </tr> </tbody> </table> <h2>Threat Analysis: The Actors, the Tools, and the Targets</h2> <h3>1. MuddyWater's New Arsenal (Operation Olalampo)</h3> Actor: MuddyWater (also tracked as Mango Sandstorm, TEMP.Zagros, UNC3313, UNC5667) Affiliation: Iran's Ministry of Intelligence and Security (MOIS) MuddyWater has been one of Iran's most prolific cyber espionage groups for years. What's different now: they have new tools, and they appear to be using AI to build them faster. GhostFetch, CHAR, and HTTP_VIP are three previously unseen malware families deployed since late January against organizations in the Middle East and North Africa. Targeted sectors include government, financial services, energy, utilities, education, and insurance. The malware has been described as "AI-assisted" — suggesting the use of large language models to accelerate development and obfuscation. Why this matters to you: MuddyWater has historically expanded targeting from regional to Western organizations during periods of escalation. The jump from MENA government targets to US and European defense contractors is a matter of weeks, not months. AI-assisted development means new variants will arrive faster than your signature updates. <h3>2. The Wiper Arsenal — 30 Families and Counting</h3> Malware families: ZeroCleare, Meteor, DEADWOOD, Apostle, BFG Agonizer, MultiLayer, PartialWasher, and approximately two dozen more Iran maintains one of the world's deepest arsenals of destructive wiper malware. These tools are designed to do one thing: destroy data irreversibly. They are not ransomware — there is no decryption key, no negotiation, no recovery. The critical signal right now is silence. We are ten days into an active kinetic campaign and no confirmed wiper deployment has been reported against US or allied networks. Historically, Iran deployed the Shamoon wiper within two weeks of major escalations. The current absence likely means one of two things: <ul> <li>Iranian C2 infrastructure is too degraded to coordinate a wiper campaign (the optimistic read), or</li> <li>Iran is deliberately timing deployment for maximum psychological impact — perhaps to coincide with a major US casualty event or a symbolic date (the concerning read)</li> </ul> With the campaign now extended to 4–5 weeks, Iran has time to choose its moment. We assess a 65% probability of wiper deployment against Israeli or Gulf state targets within the next 14 days, potentially disguised as ransomware for plausible deniability. <h3>3. Pre-Positioned Access: The Doors Are Already Open</h3> Actor: Pioneer Kitten (also tracked as UNC757, Lemon Sandstorm, Fox Kitten) Active CVEs being exploited: <ul> <li>CVE-2023-3519 — Citrix ADC / NetScaler remote code execution (CVSS 9.8)</li> <li>CVE-2024-21887 — Ivanti Connect Secure command injection (CVSS 9.1)</li> </ul> Pioneer Kitten has been running a long-duration campaign exploiting these two vulnerabilities to establish persistent access in financial services, healthcare, manufacturing, and telecommunications networks. This group has a documented history of selling access to ransomware operators — and of acting as an initial access broker for more destructive IRGC operations. The wartime concern: Access that was established for espionage or monetization can be repurposed for destruction with a single command. If your Ivanti or Citrix appliances are unpatched, assume compromise until proven otherwise. <h3>4. Hacktivist Proxies: Plausible Deniability at Scale</h3> Groups: Handala, Cyber Toufan, and affiliated clusters Tactics: DDoS, website defacement, data leaks, cognitive warfare via Telegram Iran's hacktivist proxy ecosystem provides something invaluable to a state under military attack: plausible deniability. These groups operate semi-independently, claim attacks loudly on Telegram, and create noise that complicates attribution. The Forbes reporting that Iranian hackers are using Starlink to maintain operations despite the internet blackout confirms that these groups remain active and capable. We assess a 70% probability of DDoS and defacement campaigns against US government and defense industrial base websites within the next seven days. <h3>5. IOCONTROL: The OT/SCADA Threat</h3> Malware: IOCONTROL (also tracked as QUEUECAT, OrpraCab) Targets: Water systems, energy infrastructure, SCADA-connected industrial control systems IOCONTROL is purpose-built to target operational technology environments. It was updated as recently as March 1 in threat intelligence feeds, confirming active maintenance. Combined with fresh CISA ICS advisories for Yokogawa CENTUM VP (ICSA-26-057-09) and Johnson Controls Frick Controls (ICSA-26-057-01), the attack surface is real. We assess a 25% probability of IOCONTROL deployment against US water or energy SCADA systems within 21 days. The probability is low, but the impact would be catastrophic and the political symbolism — striking American critical infrastructure during a military campaign — would be enormous. <h3>6. The Starlink Paradox</h3> This deserves its own section because it represents a genuinely novel development. US and Israeli cyber operations successfully degraded Iran's state internet to 1–4% capacity. By traditional doctrine, this should have severely degraded Iranian offensive cyber capability. Instead, Iranian operators pivoted to Starlink — commercial satellite internet made freely available by SpaceX. The same infrastructure enabling Iranian civilians to communicate is enabling Iranian offensive cyber operations. This is a strategic irony with immediate tactical consequences: you cannot assume that degrading a nation's internet degrades its cyber attack capability. Iranian C2 infrastructure is now resilient against the very operations designed to suppress it. <h2>Predictive Analysis: What Comes Next</h2> <table> <tbody> <tr> <td> Threat Scenario </td> <td> Timeframe </td> <td> Probability </td> <td> Impact </td> </tr> <tr> <td> Hacktivist DDoS and defacement against US government/DIB websites (Handala, Cyber Toufan) </td> <td> 7 days </td> <td> 70% </td> <td> Moderate — reputational, operational disruption </td> </tr> <tr> <td> Wiper deployment against Israeli or Gulf state targets, possibly disguised as ransomware (ZeroCleare/Meteor variant) </td> <td> 14 days </td> <td> 65% </td> <td> Severe — data destruction, operational paralysis </td> </tr> <tr> <td> MuddyWater Operation Olalampo expands to US/European defense contractors via GhostFetch </td> <td> 14 days </td> <td> 40% </td> <td> High — espionage, potential pre-positioning for destructive follow-on </td> </tr> <tr> <td> IOCONTROL deployment against US water/energy SCADA systems </td> <td> 21 days </td> <td> 25% </td> <td> Critical — physical safety, national security </td> </tr> <tr> <td> Compromise of military AI/cloud infrastructure (AWS, OpenAI/Anthropic API endpoints) </td> <td> 30 days </td> <td> 15% </td> <td> Extreme — intelligence compromise, decision-support degradation </td> </tr> </tbody> </table> <h2>Defense Recommendations</h2> <h3>🔴 Immediate (Today)</h3> <table> <tbody> <tr> <td> Action </td> <td> Why </td> </tr> <tr> <td> Block Iranian C2 infrastructure at all perimeter firewalls: 78.38.30.71, 193.151.151.218, 151.245.110.39. Query SIEM for any historical connections to these IPs. </td> <td> Active, high-confidence C2 on Iranian state telecom — government-sanctioned operational infrastructure exposed during blackout. </td> </tr> <tr> <td> Emergency patch verification for Ivanti Connect Secure (CVE-2024-21887) and Citrix ADC/NetScaler (CVE-2023-3519). </td> <td> Pioneer Kitten is actively exploiting these vulnerabilities right now. CVSS scores of 9.1 and 9.8 respectively. If unpatched, assume compromise. </td> </tr> <tr> <td> Extend your cyber retaliation watch posture to 42 days (through mid-April). Communicate this to all partners, subsidiaries, and managed security providers. </td> <td> The 4–5 week campaign timeline means Iranian motivation for retaliatory cyber operations will be sustained far longer than initially modeled. </td> </tr> <tr> <td> Brief your executive team and board on the elevated threat environment. Ensure incident response retainers are active and contact trees are current. </td> <td> This is a wartime cyber posture. Decision-makers need to understand that destructive attacks — not just espionage — are a realistic near-term scenario. </td> </tr> </tbody> </table> <h3>🟡 Within 7 Days (by March 10)</h3> <table> <tbody> <tr> <td> Action </td> <td> Why </td> </tr> <tr> <td> Deploy behavioral detection rules for GhostFetch, CHAR, and HTTP_VIP malware families. Prioritize email gateway telemetry for MENA-themed phishing lures and endpoint detection for novel scripting-based payloads. </td> <td> MuddyWater's Operation Olalampo is active and expanding. AI-assisted development means signature-based detection alone will not be sufficient. </td> </tr> <tr> <td> Conduct a threat hunt for anomalous satellite-routed traffic in any forward-deployed or remote network segments. </td> <td> Iranian operators are confirmed using Starlink to bypass the internet blackout. Any environment with SATCOM connectivity is potentially exposed. </td> </tr> <tr> <td> Audit all OT/SCADA environments against CISA ICS advisories ICSA-26-057-09 (Yokogawa CENTUM VP) and ICSA-26-057-01 (Johnson Controls Frick). Cross-reference with IOCONTROL/QUEUECAT detection signatures. </td> <td> Fresh vulnerabilities in industrial control systems combined with an actively maintained OT-targeting malware family create a convergent risk. </td> </tr> <tr> <td> Validate offline backup integrity for all critical systems, with specific attention to domain controllers, identity infrastructure, and operational databases. </td> <td> If a wiper lands, your recovery time is determined by the quality of your backups. Test restores now, not during an incident. </td> </tr> </tbody> </table> <h3>🟢 Within 30 Days (by April 2)</h3> <table> <tbody> <tr> <td> Action </td> <td> Why </td> </tr> <tr> <td> Commission a red team exercise simulating an Iranian wiper attack: initial access via compromised Ivanti VPN, lateral movement through Windows domain, deployment of a ZeroCleare/Meteor-style wiper. Test detection, containment, and recovery. </td> <td> You need to know — before it happens — whether your defenses can detect and contain a wiper before it executes. The exercise should include your incident response plan, communication protocols, and backup restoration procedures. </td> </tr> <tr> <td> Develop a collection and monitoring plan for military AI/cloud dependencies. Specifically: monitor for adversary reconnaissance against cloud API endpoints, establish traffic baselines for cloud regions serving your operations, and assess data poisoning risk to any AI-assisted decision-support systems. </td> <td> This is the emerging attack surface that no one is adequately covering. The intersection of military AI dependence and Iranian offensive capability is a gap that adversaries will eventually find. </td> </tr> <tr> <td> Tabletop exercise with senior leadership: Scenario — simultaneous wiper attack on your network and DDoS against public-facing services during a period of heightened media attention on the conflict. Test decision-making under pressure, public communications, and coordination with government partners (CISA, FBI, sector ISAC). </td> <td> The most likely Iranian playbook combines destructive and disruptive attacks for maximum psychological impact. Your leadership needs to have rehearsed this scenario before it arrives. </td> </tr> </tbody> </table> <h2>The Bottom Line</h2> We are in the early days of what will be a sustained, multi-week period of elevated Iranian cyber threat activity. The kinetic campaign is escalating, not de-escalating. Iranian operators have demonstrated they can maintain offensive capability despite massive infrastructure degradation. New malware is already deployed and expanding. The wiper arsenal is loaded and the deployment window is wide open. The historical pattern is unambiguous: every major kinetic escalation with Iran has been followed by retaliatory cyber operations. The question is not whether — it is when, where, and how destructive. The organizations that will weather this period are the ones that act now: patch the known doors (Ivanti, Citrix), hunt for pre-existing access, validate their ability to survive a wiper, and extend their watch posture through mid-April. The organizations that treat this as routine will be the ones in the incident response retainer queue. The next six weeks will test whether our cyber defenses are as ready as our kinetic ones. Make sure yours are. Anomali Threat Research provides continuous threat intelligence monitoring and analysis. For questions about this assessment or to request tailored indicators of compromise for your environment, contact your Anomali representative.

FEATURED RESOURCES

March 3, 2026

Anomali Cyber Watch