When “Quiet" Means Pre-Positioned: Why Iranian Cyber Threats Are More Dangerous Than Headlines Suggest

Anomali Threat Research

Published on

March 6, 2026

Table of Contents

The headlines say Iranian state-sponsored hackers are "laying low." The intelligence says otherwise. On 28 February 2026, the United States and Israel launched Operation Epic Fury — a combined kinetic and cyber offensive against Iran that included strikes killing Ayatollah Khamenei and, according to Israeli officials, the physical destruction of Iran's cyber warfare headquarters. Iran's conventional command-and-control is degraded. Its internet has been running at 1–4% capacity for over a week. And multiple news outlets have concluded that Iranian state cyber actors have gone quiet. They haven't. They've gone dormant — on networks they already control. This week, Symantec confirmed that Seedworm (also known as MuddyWater, STATIC KITTEN, and Mango Sandstorm) — an Iranian Ministry of Intelligence-linked APT group — maintains active presence on the networks of a U.S. bank, a U.S. airport, and a U.S. software company. This is not a new intrusion. It is pre-positioned access, established before the conflict began, now sitting ready for activation. If your organization touches critical infrastructure, defense, financial services, or transportation, the next 7–14 days are the most dangerous window since the conflict began. Here's what you need to know now. <h2>What Changed This Week</h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 28 Feb </td> <td> CISA acting director reassigned; agency operating under partial DHS shutdown </td> <td> Federal cyber defense capacity degraded at worst possible moment </td> </tr> <tr> <td> 3 Mar </td> <td> FBI issues emergency reminder to critical infrastructure orgs on Iranian cyber mitigations </td> <td> Compensatory warning — FBI cannot replace CISA's incident response capability </td> </tr> <tr> <td> 3 Mar </td> <td> Reports surface of IRGC leveraging AI and stolen personal data for phishing operations </td> <td> Iranian social engineering becoming more sophisticated and automated </td> </tr> <tr> <td> 4 Mar </td> <td> 149 hacktivist DDoS attacks documented across 110 organizations in 16 countries </td> <td> Pro-Iran hacktivist campaign operating at industrial scale </td> </tr> <tr> <td> 4 Mar </td> <td> Check Point documents Iranian targeting of Hikvision and Dahua IP cameras across 7 countries </td> <td> Surveillance cameras weaponized for battle damage assessment and missile targeting </td> </tr> <tr> <td> 5 Mar </td> <td> Israel publicly claims kinetic destruction of Iran's cyber warfare headquarters </td> <td> Degrades but does not eliminate Iranian cyber capacity — decentralized operators unaffected </td> </tr> <tr> <td> 5 Mar </td> <td> Symantec confirms Seedworm (MuddyWater) on U.S. bank, airport, and software company networks </td> <td> Most critical finding of the week — pre-positioned state APT access on U.S. critical infrastructure </td> </tr> </tbody> </table> <h2>Conflict & Threat Timeline</h2> <table> <thead> <tr> <th> Date </th> <th> Kinetic Domain </th> <th> Cyber Domain </th> </tr> </thead> <tbody> <tr> <td> Jan 2026 </td> <td> U.S. issues nuclear threats against Iran </td> <td> APT42 (CALANQUE) nuclear sector espionage activity detected </td> </tr> <tr> <td> 28 Feb </td> <td> Operation Epic Fury launched — strikes kill Khamenei </td> <td> Internet blackout across Iran (1–4% capacity); CISA enters partial shutdown </td> </tr> <tr> <td> 1–3 Mar </td> <td> Coalition strikes continue against IRGC targets </td> <td> Hacktivist groups Keymous+, DieNet, NoName057(16) launch DDoS wave </td> </tr> <tr> <td> 3–4 Mar </td> <td> — </td> <td> Check Point documents Iranian IP camera exploitation in 7 Middle Eastern countries </td> </tr> <tr> <td> 5 Mar </td> <td> Israel claims destruction of Iran's cyber warfare HQ </td> <td> Seedworm confirmed pre-positioned on U.S. critical infrastructure networks </td> </tr> <tr> <td> 6 Mar </td> <td> — </td> <td> TWOSTROKE malware campaign detected targeting Azerbaijan and Turkey — possible retaliation against coalition-supporting neighbors </td> </tr> <tr> <td> 7–14 Mar </td> <td> — Projected critical window — </td> <td> Likely activation of pre-positioned access as Iran reconstitutes C2 </td> </tr> </tbody> </table> <h2>Threat Analysis: Four Converging Dangers</h2> <h3>1. Seedworm/MuddyWater — The Silent Foothold</h3> What it is: Seedworm (MuddyWater / STATIC KITTEN / Mango Sandstorm) is an Iranian Ministry of Intelligence-linked APT group with a long history of targeting government, defense, telecommunications, and critical infrastructure organizations. What happened: Symantec confirmed Seedworm's presence on networks belonging to a U.S. bank, a U.S. airport, and a U.S. software company. The group's known toolset includes BELLACIAO web shells, SHELLAFEL backdoors, and PowerShell-based SYNCRO RAT. A confirmed malicious file hash (SHA256: 0f9cf1cf8d641562053ce533aaa413754db88e60404cab6bbaa11f2b2491d542) has been independently flagged by multiple sources with high confidence. Why it matters: MuddyWater has historically served as an access broker — establishing footholds that are later handed off to destructive operators. The groups that deploy wipers (such as BANISHED KITTEN, responsible for BiBiWiper, ZeroShred, and GoneXML) rely on exactly this kind of pre-positioned access. The foothold is the precursor, not the attack itself. <h3>2. The Hacktivist Swarm — 149 Attacks and Counting</h3> What it is: A coordinated campaign by at least 12 pro-Iran and pro-Russia hacktivist groups, led by Keymous+, DieNet, and NoName057(16), which together account for nearly 75% of all documented attacks. What happened: 149 DDoS attacks against 110 organizations across 16 countries in a single reporting period. Targeted sectors include aerospace, defense, energy, financial services, government, healthcare, telecommunications, and utilities. Why it matters: These groups operate independently of Iran's state cyber apparatus. The kinetic destruction of Iran's cyber headquarters has zero effect on them. Even if every Iranian state APT were fully degraded, the hacktivist swarm would continue — and it is showing signs of escalating from DDoS toward destructive operations (wipers, data destruction).  <h3>3. The Bidirectional Cyber-Kinetic Kill Chain</h3> What it is: A novel operational pattern in which both sides of the conflict are using cyber operations to enable kinetic strikes — and kinetic strikes to degrade cyber capabilities. What happened: <ul> <li>Coalition offensive: Israel/U.S. hacked Iranian traffic cameras, hijacked television broadcasts, imposed internet blackouts, and ultimately struck Iran's cyber warfare headquarters with physical munitions.</li> <li>Iranian counter-offensive: Iranian operators are compromising Hikvision and Dahua IP cameras across Israel, Qatar, Bahrain, Kuwait, UAE, Cyprus, and Lebanon — the same countries in active missile engagement zones — to conduct battle damage assessment and feed targeting data to missile units via IRGC-MTN-Irancell telecommunications links.</li> </ul> Why it matters: Every internet-connected sensor in or near the conflict zone is now a dual-use intelligence asset. IP cameras, IoT devices, SCADA systems, and any network-connected sensor can be co-opted for targeting. This is not theoretical — Check Point documented hundreds of exploitation attempts using improper authentication bypasses, command injection, and remote code execution vulnerabilities in camera firmware. <h3>4. The Defender Gap — CISA Down When It's Needed Most</h3> What it is: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) — the primary federal agency responsible for critical infrastructure cyber defense — is operating at reduced capacity due to a partial DHS shutdown and leadership transition. What happened: CISA's acting director was reassigned on 28 February. Most of the workforce has been furloughed since mid-February. The FBI has issued compensatory warnings to critical infrastructure organizations, but the FBI cannot replicate CISA's incident response, threat hunting, or stakeholder coordination capabilities. Why it matters: Organizations that have historically relied on CISA for incident response support, threat briefings, or emergency coordination should assume that support will be delayed or unavailable for the next 2–4 weeks. This is happening at the exact moment when Iranian retaliation is most likely. <h2>Vulnerabilities Under Active Threat</h2> <table> <thead> <tr> <th> CVE </th> <th> Product </th> <th> CVSS </th> <th> Status </th> <th> Iranian Actor Relevance </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-1281 </td> <td> Ivanti EPMM </td> <td> 9.8 </td> <td> Patch available </td> <td> Iranian APTs have historically exploited Ivanti products within days of disclosure; Fox Kitten/Lemon Sandstorm known to target VPN/edge devices </td> </tr> <tr> <td> CVE-2026-1340 </td> <td> Ivanti EPMM </td> <td> 9.8 </td> <td> Patch available </td> <td> Same as above — unauthenticated RCE; likely initial access vector for Seedworm-style operations </td> </tr> <tr> <td> Hikvision firmware CVEs </td> <td> Hikvision IP cameras </td> <td> Various </td> <td> Firmware updates required </td> <td> Actively exploited by Iranian operators for BDA surveillance (Check Point confirmed) </td> </tr> <tr> <td> Dahua firmware CVEs </td> <td> Dahua IP cameras </td> <td> Various </td> <td> Firmware updates required </td> <td> Same campaign as Hikvision — command injection and improper authentication </td> </tr> <tr> <td> Unitronics PLC vulnerabilities </td> <td> Unitronics Vision/Samba PLCs </td> <td> Various </td> <td> Mitigations available </td> <td> Cyber Av3ngers (IRGC-linked) previously targeted U.S. water systems via Unitronics </td> </tr> </tbody> </table> <h2>Predictive Assessment: What Comes Next</h2> Based on the convergence of pre-positioned access, degraded defenses, and escalation dynamics, the following probability estimates apply to the next 14 days: <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> Hacktivist DDoS campaign expands to healthcare and financial sectors </td> <td> 70% </td> <td> 0–7 days </td> <td> Moderate — service disruption, reputational damage </td> </tr> <tr> <td> Seedworm access activated for data exfiltration or handed off to destructive operators </td> <td> 40% </td> <td> 7–14 days </td> <td> High — potential for espionage or destructive attack on U.S. critical infrastructure </td> </tr> <tr> <td> First confirmed wiper deployment against a Western target </td> <td> 25% </td> <td> 7–14 days </td> <td> Very High — BiBiWiper/ZeroShred/GoneXML capable of permanent data destruction </td> </tr> <tr> <td> Cyber Av3ngers activate IOCONTROL malware against U.S. water or energy ICS </td> <td> 15% </td> <td> 7–14 days </td> <td> Catastrophic — potential physical safety impact; low probability due to likely C2 degradation </td> </tr> <tr> <td> TWOSTROKE campaign expands to NATO/coalition partner networks </td> <td> 30% </td> <td> 7–30 days </td> <td> High — espionage against coalition-supporting nations (Azerbaijan, Turkey, Gulf states) </td> </tr> </tbody> </table> The key dynamic: the longer Iranian state APTs remain "quiet," the more likely the eventual action is destructive rather than espionage-focused. Silence is not safety. It is the sound of an adversary choosing its moment. <h2>Defense Recommendations          </h2> <h3>🔴 Immediate (0–48 Hours)</h3> <table> <thead> <tr> <th> Priority </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> Hunt for confirmed malicious hash SHA256 0f9cf1cf8d641562053ce533aaa413754db88e60404cab6bbaa11f2b2491d542 across all endpoints, proxy logs, and network telemetry. This indicator is confirmed malicious by three independent sources and linked to Iranian operations targeting U.S. entities. </td> <td> SOC / Threat Hunting </td> </tr> <tr> <td> 2 </td> <td> Audit and isolate all Hikvision and Dahua IP cameras on your network — especially at facilities in or connected to the Middle East. Restrict WAN access, place on dedicated VLANs, update firmware immediately. </td> <td> Physical Security / IT Operations </td> </tr> <tr> <td> 3 </td> <td> Verify patching for Ivanti EPMM CVE-2026-1281 and CVE-2026-1340 (both CVSS 9.8, unauthenticated RCE). If you run Ivanti products and have not patched, assume you are a target. </td> <td> Vulnerability Management </td> </tr> <tr> <td> 4 </td> <td> Brief your executive team and board that CISA support is degraded and your organization must be prepared to handle an Iranian cyber incident with internal resources and commercial partners for the next 2–4 weeks. </td> <td> CISO / Executive Leadership </td> </tr> </tbody> </table> <h3>🟠 This Week (7 Days)</h3> <table> <thead> <tr> <th> Priority </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> Conduct targeted threat hunt for MuddyWater/Seedworm indicators — focus on BELLACIAO web shells, SHELLAFEL backdoors, and PowerShell-based SYNCRO RAT. Prioritize financial, transportation, and software development environments. </td> <td> Threat Hunting / IR </td> </tr> <tr> <td> 6 </td> <td> Establish independent DDoS mitigation through commercial providers (Cloudflare, Akamai, or equivalent). Do not plan on federal assistance for DDoS response. </td> <td> Network Operations </td> </tr> <tr> <td> 7 </td> <td> Review and test your wiper incident response playbook. If you don't have one, build one this week. Key TTPs to prepare for: MBR overwriting, file system destruction, backup deletion, and Active Directory compromise as a distribution mechanism. </td> <td> CIRT / Incident Response </td> </tr> <tr> <td> 8 </td> <td> Share the bidirectional cyber-kinetic threat model with physical security teams and any partners operating IoT/sensor infrastructure in the Middle East. Any internet-connected device in theater is a potential intelligence collection platform. </td> <td> Intelligence Sharing / Security Leadership </td> </tr> </tbody> </table> <h3>🟡 This Month (30 Days)</h3> <table> <thead> <tr> <th> Priority </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 9 </td> <td> Establish an ICS/OT-specific threat intelligence feed if you operate industrial control systems. The absence of Cyber Av3ngers/IOCONTROL activity is not reassurance — it may indicate capability being held in reserve. Consider Dragos WorldView or Claroty xDome. </td> <td> OT Security / CTI </td> </tr> <tr> <td> 10 </td> <td> Develop a wiper-specific response playbook tailored to known Iranian destructive malware families: BiBiWiper, ZeroShred, GoneXML. Include offline backup verification, network segmentation validation, and golden image recovery procedures. </td> <td> CIRT / Business Continuity </td> </tr> <tr> <td> 11 </td> <td> Reassess your threat model for AI-enhanced social engineering. Iranian operators are reportedly leveraging AI and stolen personal data to automate phishing at scale. Traditional email security filters may not catch AI-generated, highly personalized lures. </td> <td> Email Security / Security Awareness </td> </tr> <tr> <td> 12 </td> <td> Conduct a tabletop exercise simulating a scenario where pre-positioned Iranian access on your network is activated for destructive purposes — during a period when federal incident response support is unavailable. </td> <td> CISO / Executive Leadership / IR </td> </tr> </tbody> </table> <h2> The Bottom Line</h2> The most dangerous narrative in cybersecurity right now is that Iranian state hackers have gone quiet. They haven't. Seedworm is sitting on U.S. critical infrastructure networks. Hacktivist proxies are executing attacks at industrial scale. IP cameras across seven countries are being weaponized for missile targeting. And the federal agency responsible for helping you respond is operating with a skeleton crew. The 7–14 day window ahead of us is critical. Iran's internet will eventually be restored. Decentralized operators will reconstitute command and control. And the pre-positioned access that Seedworm has established on U.S. networks — access that exists right now, today — will be activated. The question is not whether Iran will retaliate in cyberspace. It is whether your organization will have already hunted for the indicators, patched the vulnerabilities, isolated the cameras, tested the playbooks, and briefed the executives before that moment arrives. Don't wait for the headline. The intrusion already happened. The clock is running on the response.

FEATURED RESOURCES

March 6, 2026

Anomali Cyber Watch