When the Ceasefire Doesn't Apply to Cyberspace: Iran's Dual-Track Doctrine and What It Means for Your Defenses

Anomali Threat Research

Published on

April 22, 2026

Table of Contents

Threat Assessment Level: CRITICAL The ceasefire between the United States and Iran is now 53 days old. In the physical world, it is already fracturing — an IRGC gunboat fired on a container ship in the Strait of Hormuz hours after a ceasefire extension was announced. In cyberspace, the ceasefire never existed at all. Three independent investigations — from the New York Times, Yahoo News, and Fast Company — have converged on the same conclusion: Iranian state-sponsored cyber operations have continued without pause throughout ceasefire negotiations. Tehran's digital warriors are not standing down. They are pre-positioning, probing, and preparing for what comes next. For CISOs responsible for critical infrastructure, defense industrial base organizations, energy systems, or government networks, the message is stark: the diplomatic calendar is irrelevant to your threat model. The cyber threat from Iran is at its highest sustained level since the conflict began on February 28, 2026, and the kinetic escalation on April 22 has started a 48–72 hour countdown during which retaliatory cyber operations are historically most likely. This blog provides the latest intelligence, specific threat actor activity, and concrete defensive actions your teams should take — today, this week, and this month. <h2>What Changed                                  </h2> The past 72 hours have produced six developments that collectively raise the threat posture: <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 22 Apr 2026 </td> <td> IRGC gunboat fires on Liberian-flagged container ship off Oman coast, causing heavy bridge damage </td> <td> Ceasefire is functionally collapsing. Historical pattern: Iranian cyber operations spike 24–72 hours after kinetic escalation </td> </tr> <tr> <td> 22 Apr 2026 </td> <td> Censys research confirms 5,219 internet-exposed Rockwell Allen-Bradley PLCs globally, 74.6% in the U.S. — Iranian actors confirmed using legitimate vendor tools to manipulate SCADA displays </td> <td> Transforms theoretical OT risk into a quantified, actionable crisis. Operational disruption and financial losses already occurring </td> </tr> <tr> <td> 22 Apr 2026 </td> <td> UNC1549 (Imperial Kitten / TA455 / Smoke Sandstorm) actor profile updated — active aerospace targeting via fake GitHub resume lures </td> <td> First confirmed defense industrial base pre-positioning activity in 43 days. IRGC-linked espionage against aerospace is live </td> </tr> <tr> <td> 21 Apr 2026 </td> <td> MOIS-operated MuddyWater registers fresh DinDoor/DinoDance C2 infrastructure and goes operationally silent — assessed as infrastructure rotation preceding activation </td> <td> The most active MOIS cyber espionage group going quiet during active hostilities is anomalous and historically precedes operational surges </td> </tr> <tr> <td> 21 Apr 2026 </td> <td> CISA publishes 12 ICS advisories in a single batch, including Siemens SINEC NMS authentication bypass and SCALANCE wireless vulnerabilities </td> <td> Network management and industrial wireless platforms used across OT environments now have remotely exploitable flaws </td> </tr> <tr> <td> 19 Apr 2026 </td> <td> UNC5866 (Emennet Pasargad) last observed deploying wipers against Israeli targets while masquerading as ESET; Homeland Justice, Karma, and Handala confirmed as unified MOIS operation ("Void Manticore") </td> <td> Iran's wiper arsenal is loaded and aimed. Restraint is holding but assessed as fragile under current kinetic pressure </td> </tr> </tbody> </table> <h2>Conflict and Threat Timeline            </h2> The following timeline captures the key cyber and kinetic events since the conflict began, illustrating how physical escalation and cyber operations are interleaved: <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Domain </th> </tr> </thead> <tbody> <tr> <td> 28 Feb 2026 </td> <td> U.S. begins major combat operations against Iran </td> <td> Kinetic </td> </tr> <tr> <td> Mar 2026 (ongoing) </td> <td> Iranian actors begin causing operational disruption and financial loss via PLC manipulation </td> <td> Cyber </td> </tr> <tr> <td> 07 Apr 2026 </td> <td> Reuters confirms Russia providing satellite ISR and cyber support to Iran; APT28 (GRU) infrastructure observed on Iranian ASN 213790 </td> <td> Cyber / Geopolitical </td> </tr> <tr> <td> 08 Apr 2026 </td> <td> SecurityWeek reports on Iranian OT targeting campaigns </td> <td> Cyber </td> </tr> <tr> <td> 13 Apr 2026 </td> <td> Fast Company: "Why the Iran Cyberattack Everyone Warned About Hasn't Really Happened Yet" — documents ongoing below-threshold operations </td> <td> Cyber / OSINT </td> </tr> <tr> <td> 16 Apr 2026 </td> <td> New York Times: "Iran's Hackers Haven't Logged Off" — confirms digital operations continue during ceasefire </td> <td> Cyber / OSINT </td> </tr> <tr> <td> 17 Apr 2026 </td> <td> CISA Advisory AA26-097A confirms IRGC-affiliated CyberAv3ngers actively exploiting Rockwell/Allen-Bradley PLCs; TRK25-ADVANCED malware deployed beyond reconnaissance into active process interference </td> <td> Cyber </td> </tr> <tr> <td> 17–21 Apr 2026 </td> <td> APT42 (Charming Kitten) credential harvesting campaigns updated — no new IOCs but infrastructure refreshed </td> <td> Cyber </td> </tr> <tr> <td> 18 Apr 2026 </td> <td> Yahoo News: "A Ceasefire That Ignores Cyber Is Not a Real Ceasefire" </td> <td> OSINT </td> </tr> <tr> <td> 19 Apr 2026 </td> <td> UNC5866 (Emennet Pasargad) last IOC observed — wiper and IO operations against Israeli targets via ESET masquerade campaign </td> <td> Cyber </td> </tr> <tr> <td> 21 Apr 2026 </td> <td> MOIS-operated MuddyWater registers fresh DinDoor/DinoDance C2 infrastructure; analysts confirm Homeland Justice, Karma, and Handala are a unified MOIS operation ("Void Manticore") </td> <td> Cyber </td> </tr> <tr> <td> 21 Apr 2026 </td> <td> CISA publishes 12 ICS advisories (Siemens SINEC NMS, SCALANCE, RUGGEDCOM, SenseLive, EV chargers) </td> <td> Vulnerability </td> </tr> <tr> <td> 22 Apr 2026 </td> <td> IRGC gunboat fires on container ship in Strait of Hormuz hours after ceasefire extension announced </td> <td> Kinetic </td> </tr> <tr> <td> 22 Apr 2026 </td> <td> Censys confirms 5,219 internet-exposed Rockwell PLCs; 62% via cellular modems </td> <td> Cyber / Exposure </td> </tr> <tr> <td> 22 Apr 2026 </td> <td> UNC1549 (Imperial Kitten / TA455) confirmed targeting aerospace via fake GitHub resume lures </td> <td> Cyber </td> </tr> </tbody> </table> <h2>Key Threat Analysis                       </h2> <h3>1. The Rockwell PLC Crisis: 5,219 Exposed Devices, Most Beyond Your SOC's Visibility</h3> The single most actionable finding this cycle is the Censys quantification of internet-exposed Rockwell Automation Allen-Bradley PLCs. The numbers are sobering: <ul> <li>5,219 devices exposed to the internet globally, 74.6% in the United States</li> <li>49.1% connected via Verizon cellular modems, 13.3% via AT&T — field-deployed devices using consumer cellular as their sole internet path</li> <li>24 hosts on Starlink — satellite-connected ICS that is effectively unmonitorable by most defenders</li> <li>771 instances of VNC exposed (direct HMI remote desktop access)</li> <li>280 instances of Telnet — cleartext legacy protocol on internet-facing OT</li> <li>530 instances of SSH exposed as remote access pathways</li> </ul> Iranian-affiliated actors — specifically the IRGC-linked CyberAv3ngers — are confirmed using legitimate vendor software (Rockwell Studio 5000 Logix Designer) to interact with project files and manipulate HMI/SCADA displays. This is a "living off the land" approach in OT environments: the tools are legitimate, the intent is not. Confirmed targeted device families include CompactLogix (1769-L30ER/A), Micro850 (2080-), and MicroLogix 1400 (1766-) running end-of-sale firmware. Since March 2026, this activity has caused confirmed operational disruption and financial loss. The critical architectural insight: 62% of these devices are not on your enterprise network. They reach the internet through cellular modems that bypass your SIEM, your NDR, and your firewall policies. Your SOC cannot see what it cannot reach. <h3>2. UNC1549 (Imperial Kitten / TA455): The Aerospace Recruiter You Didn't Apply To</h3> UNC1549 — tracked as Imperial Kitten (CrowdStrike), Smoke Sandstorm (Microsoft), TA455 (ClearSky), and Nimbusmanticore (Check Point) — is an IRGC-linked espionage group that has resumed active targeting of the aerospace and defense industrial base using a social engineering vector that exploits the hiring process. The campaign distributes malware through fake resume lures hosted on GitHub, specifically through coding challenge repositories. The target set spans aerospace, energy, technology, transportation, and utilities across seven or more countries. This is not a new technique for this group, but its reactivation during active hostilities — after 43 days of silence — signals that IRGC espionage operations against DIB contractors are being prioritized alongside the kinetic campaign. For organizations in the aerospace supply chain, this means your recruiting pipeline is an attack surface. <h3>3. The Wiper Arsenal: Loaded, Aimed, Not Yet Fired</h3> Iran's undeployed wiper arsenal — BiBiWiper, ZeroShred, GoneXML, and Meteor — represents the highest-impact, condition-dependent threat in the current landscape. Notably, no new wiper deployments have been detected during the ceasefire window. This restraint is deliberate, not incidental. UNC5866 (assessed as linked to Emennet Pasargad, an IRGC contractor) was last observed on April 19 deploying wipers against Israeli technology and manufacturing organizations while masquerading as security company ESET. The group conducts both destructive malware operations and cyber-enabled information operations using multiple online personas. Analysts have confirmed that Homeland Justice, Karma, and Handala are a unified MOIS operation operating under the umbrella designation "Void Manticore" — collapsing three previously distinct hacktivist personas into one coordinated threat. The wiper restraint is fragile. If the ceasefire collapses — an increasingly likely scenario given the gunboat incident — wiper deployment against energy, water, and government targets is the most probable immediate cyber response, assessed to occur within 48–72 hours of kinetic escalation. <h3>4. MuddyWater's Silence Is Not Reassuring</h3> MuddyWater (UNC3313 / UNC5667), the most operationally active MOIS cyber espionage group, registered fresh DinDoor/DinoDance C2 infrastructure on April 21 but has gone operationally silent since. For the most active Iranian cyber unit to go quiet during active hostilities is anomalous. The most likely explanation: C2 infrastructure rotation preceding operational activation. When MuddyWater goes quiet, it is typically preparing to go loud. <h3>5. Russia's Hand: APT28 on Iranian Infrastructure</h3> Confirmed on April 7 by Reuters: Russia is providing satellite ISR and cyber support to Iran. APT28 (GRU Unit 26165 / Fancy Bear) infrastructure has been observed on Iranian ASN 213790. This Russia-Iran cyber convergence means defenders must account for Russian TTPs being deployed in service of Iranian targeting objectives — a significant complication for attribution and detection. <h3>6. Siemens ICS Vulnerabilities: 12 Advisories in One Day</h3> CISA published 12 ICS advisories on April 21, several of which are directly relevant to environments targeted by Iranian actors: <table> <thead> <tr> <th> Advisory </th> <th> Product </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> ICSA-26-111-03 </td> <td> Siemens SINEC NMS (pre-V4.0 SP3) </td> <td> Authentication bypass — network management platform used across OT </td> </tr> <tr> <td> ICSA-26-111-09 </td> <td> Siemens SINEC NMS </td> <td> Authorization bypass — second vulnerability in same product </td> </tr> <tr> <td> ICSA-26-111-02 </td> <td> Siemens RUGGEDCOM CROSSBOW SAM-P </td> <td> Privilege escalation — deployed in substations, pipeline monitoring </td> </tr> <tr> <td> ICSA-26-111-07 </td> <td> Siemens SCALANCE W-700 (pre-V6.6.0) </td> <td> Multiple vulnerabilities in industrial wireless infrastructure </td> </tr> <tr> <td> ICSA-26-111-04 </td> <td> Siemens Analytics Toolkit </td> <td> Improper certificate validation — unauthenticated access risk </td> </tr> <tr> <td> ICSA-26-111-12 </td> <td> SenseLive X3050 </td> <td> Complete device takeover — IoT/ICS sensor platform </td> </tr> <tr> <td> ICSA-26-111-05 </td> <td> Hardy Barth Salia EV Charge Controller </td> <td> Buffer overflow enabling remote code execution </td> </tr> </tbody> </table> Iranian actors have demonstrated consistent interest in Siemens products (dating back to Stuxnet and continuing through current campaigns). The SINEC NMS authentication bypass is particularly concerning — compromising a network management system gives an attacker visibility and control over the entire OT network it manages. <h2>Predictive Analysis: What Comes Next</h2> Based on the convergence of kinetic escalation, confirmed cyber pre-positioning, and historical Iranian operational patterns, the following assessments reflect the most likely developments in the near term: <table> <thead> <tr> <th> Timeframe </th> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> 24–48 hours </td> <td> Pro-Iran hacktivist groups (Handala / Void Manticore, Ababil of Minab) claim cyber operations related to the Strait of Hormuz gunboat incident. Expect Telegram-based information operations and DDoS against maritime/logistics targets. </td> <td> HIGH (70%) </td> <td> Historical pattern: IO claims follow kinetic events within 48 hours. Void Manticore has demonstrated this cadence repeatedly. </td> </tr> <tr> <td> 48–72 hours </td> <td> If ceasefire negotiations fail, MuddyWater and APT34 (OilRig) activate pre-positioned access in energy and government networks. Current C2 silence is assessed as infrastructure rotation preceding activation. </td> <td> MODERATE-HIGH (55%) </td> <td> MuddyWater C2 refresh on Apr 21 + operational silence = preparation pattern. Iran sending "mixed messages" per Al Jazeera. </td> </tr> <tr> <td> 48–72 hours </td> <td> Wiper deployment (BiBiWiper, ZeroShred, GoneXML, or Meteor) against Israeli, Gulf state, or U.S.-allied targets if kinetic escalation continues. </td> <td> MODERATE (45%) </td> <td> Wiper restraint is holding but under stress. Gunboat incident + ceasefire collapse = threshold conditions for destructive operations. </td> </tr> <tr> <td> 1–2 weeks </td> <td> UNC1549 (TA455) expands fake resume campaign beyond aerospace to energy and technology sectors, leveraging GitHub and LinkedIn as delivery platforms. </td> <td> MODERATE (50%) </td> <td> Campaign reactivation after 43-day pause suggests renewed tasking. Historical pattern shows target expansion after initial sector focus. </td> </tr> <tr> <td> 1–2 weeks </td> <td> APT42 (Charming Kitten) intensifies credential harvesting against universities, think tanks, and Iranian diaspora as ceasefire talks progress or collapse. </td> <td> MODERATE (50%) </td> <td> Campaign infrastructure refreshed Apr 17–21 without new IOCs — consistent with preparation phase. </td> </tr> <tr> <td> 2–4 weeks </td> <td> CyberAv3ngers escalate from SCADA display manipulation to process interference causing physical effects (e.g., pressure/flow manipulation in water treatment or pipeline systems). </td> <td> MODERATE (40%) </td> <td> TRK25-ADVANCED malware confirmed beyond reconnaissance. Censys data shows 5,219 accessible targets. Escalation ladder has room to climb. </td> </tr> </tbody> </table> <h2>SOC Operational Guidance                 </h2> <h3>What to Monitor</h3> OT/ICS Network Traffic: <ul> <li>Connections to TCP 44818 (EtherNet/IP), TCP 502 (Modbus), TCP 102 (Siemens S7) from any non-engineering workstation or external IP</li> <li>Rockwell Studio 5000 Logix Designer sessions originating from unexpected hosts — this is the confirmed "living off the land" tool being used by CyberAv3ngers (T0890 — Exploitation of Remote Services)</li> <li>VNC (TCP 5900+), Telnet (TCP 23), and SSH (TCP 22) connections to any PLC or HMI system (T1021 — Remote Services)</li> <li>EtherNet/IP identity enumeration requests from external IP ranges (T1046 — Network Service Discovery)</li> </ul> Cellular and Satellite Connectivity: <ul> <li>Audit all cellular modem gateways (Verizon, AT&T, T-Mobile) providing internet access to field-deployed PLCs</li> <li>Inventory Starlink-connected ICS devices — these represent an unmonitored attack surface</li> <li>Implement allowlist-only firewall rules on cellular gateways where possible</li> </ul> Identity and Access: <ul> <li>Failed authentication attempts against Siemens SINEC NMS consoles (T1190 — Exploit Public-Facing Application)</li> <li>OAuth application consent requests in Azure AD / Entra ID from unfamiliar applications (T1078 — Valid Accounts)</li> <li>Anomalous service principal activity in cloud environments</li> </ul> Email and Social Engineering: <ul> <li>GitHub repository links in unsolicited job applications, particularly for aerospace and defense roles (T1566.002 — Spearphishing Link, T1204.002 — User Execution: Malicious File)</li> <li>Emails impersonating ESET or other security vendors (T1036 — Masquerading)</li> </ul> <h3>Hunting Hypotheses</h3> <table> <thead> <tr> <th> Hypothesis </th> <th> ATT&CK Technique </th> <th> Data Source </th> <th> What to Look For </th> </tr> </thead> <tbody> <tr> <td> CyberAv3ngers are using legitimate Rockwell tools to modify PLC project files </td> <td> T0890, T0816 </td> <td> OT network logs, PLC audit logs </td> <td> Studio 5000 connections from non-engineering subnets; project file modifications outside change windows </td> </tr> <tr> <td> MuddyWater is rotating C2 infrastructure and will beacon from pre-positioned implants </td> <td> T1071 (Application Layer Protocol), T1573 (Encrypted Channel) </td> <td> DNS logs, proxy logs, EDR </td> <td> STARWHALE/GRAMDOOR beaconing patterns; DNS queries to recently registered domains with DGA-like characteristics </td> </tr> <tr> <td> UNC1549 has delivered malware via GitHub coding challenge repos to aerospace employees </td> <td> T1195.001, T1204.002 </td> <td> Endpoint telemetry, GitHub access logs </td> <td> Execution of binaries downloaded from GitHub repos not in the organization's approved list; new repos cloned by employees in aerospace programs </td> </tr> <tr> <td> Void Manticore (Handala/Karma/Homeland Justice) is preparing IO + DDoS related to Strait of Hormuz </td> <td> T1498 (Network Denial of Service), T1491.002 (External Defacement) </td> <td> WAF logs, DDoS mitigation telemetry, Telegram OSINT </td> <td> Volumetric traffic spikes against maritime/logistics web properties; Telegram channel posts claiming operations </td> </tr> <tr> <td> Iranian actors are probing Siemens SINEC NMS for authentication bypass </td> <td> T1190, T1068 </td> <td> SINEC NMS access logs, network IDS </td> <td> Unauthenticated API calls to SINEC NMS User Management Component; privilege escalation attempts on RUGGEDCOM CROSSBOW </td> </tr> </tbody> </table> <h3>Detection Priorities</h3> <ol> <li>Deploy Sigma/YARA rules for Rockwell Studio 5000 Logix Designer connections from non-engineering workstations</li> <li>Alert on EtherNet/IP identity enumeration (CIP List Identity requests) from external or unexpected internal IPs</li> <li>Monitor for DinDoor/DinoDance C2 patterns — MuddyWater's known beaconing intervals and domain generation characteristics</li> <li>Flag any ESET-branded email or download that does not originate from verified ESET infrastructure — UNC5866's masquerade campaign is active</li> </ol> <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services</h3> Iranian cyber operations have historically targeted financial institutions for both espionage and destructive purposes (the 2012–2013 DDoS campaign against U.S. banks remains a precedent). In the current conflict: <ul> <li>Priority: Protect SWIFT messaging infrastructure and core banking platforms from wiper deployment. BiBiWiper and ZeroShred are designed for maximum data destruction with minimal dwell time.</li> <li>Action: Verify offline backup integrity for all transaction processing systems. Test restoration procedures — do not assume backups are clean.</li> <li>Action: Monitor for credential harvesting campaigns by APT42 (Charming Kitten, IRGC-IO) targeting financial sector employees, particularly those involved in sanctions compliance or Iran-related transactions.</li> <li>Action: Review DDoS mitigation capacity. Pro-Iran hacktivist groups (Void Manticore, Ababil of Minab) have historically targeted financial sector web properties as part of information operations.</li> </ul> <h3>Energy</h3> Energy is the primary target sector in the current threat landscape. CyberAv3ngers' confirmed exploitation of Rockwell PLCs, combined with the Censys exposure data, makes this the most urgent defensive priority. <ul> <li>Priority: Audit every internet-facing PLC, RTU, and HMI in your environment — including those connected via cellular modems. The Censys data shows 62% of exposed devices reach the internet through Verizon and AT&T cellular connections that bypass enterprise security controls.</li> <li>Action: Set physical mode switches to RUN on all CompactLogix and MicroLogix PLCs equipped with hardware key switches. This is the single most effective mitigation — it cannot be overridden remotely.</li> <li>Action: Block inbound connections to TCP 44818, 502, 102, and 2222 from non-whitelisted IPs on all internet-facing OT segments.</li> <li>Action: Patch Siemens SINEC NMS to V4.0 SP3 or later (ICSA-26-111-03, ICSA-26-111-09). If SINEC NMS manages your OT network, an authentication bypass gives an attacker the keys to the kingdom.</li> <li>Action: Audit RUGGEDCOM CROSSBOW deployments in substations and pipeline monitoring for privilege escalation exposure (ICSA-26-111-02).</li> </ul> <h3>Healthcare</h3> Healthcare has not been a primary target in this conflict cycle, but Iranian actors have demonstrated willingness to target healthcare in past campaigns (Orangeworm, Fox Kitten ransomware operations). The wiper threat is sector-agnostic. <ul> <li>Priority: Ensure medical device networks are segmented from IT networks and from the internet. Any Rockwell or Siemens controllers in building management or medical gas systems should be audited.</li> <li>Action: Verify that ransomware/wiper response playbooks include procedures for maintaining patient care during IT system outages.</li> <li>Action: Monitor for Pay2Key ransomware-as-a-service activity — this is a MOIS-cybercrime convergence operation that has targeted healthcare in the past.</li> <li>Action: Brief clinical engineering teams on the Siemens ICS advisory batch — medical facilities often run Siemens building automation systems.</li> </ul> <h3>Government</h3> Government networks — federal, state, and local — are confirmed targets of CyberAv3ngers' PLC exploitation campaign (CISA AA26-097A specifically names government facilities). Water and wastewater systems operated by municipalities are at particular risk. <ul> <li>Priority: Municipal water and wastewater utilities must immediately audit Rockwell PLC connectivity. The CyberAv3ngers campaign has specifically targeted water sector infrastructure.</li> <li>Action: Implement CISA's AA26-097A mitigations without delay. This is not a theoretical advisory — it describes active exploitation.</li> <li>Action: Audit Entra ID / Azure AD conditional access policies. Iranian actors (particularly MuddyWater and APT42) target government cloud identity infrastructure for persistent access.</li> <li>Action: Brief election infrastructure teams — while not a primary vector in this conflict, Iranian IO operations have historically targeted election-related systems and public confidence.</li> </ul> <h3>Aviation and Logistics</h3> The IRGC gunboat attack on a container ship in the Strait of Hormuz directly elevates the threat to maritime logistics and aviation. Pro-Iran hacktivist groups are assessed with high probability (70%) to claim cyber operations against maritime/logistics targets within 48 hours. <ul> <li>Priority: Harden public-facing web applications and APIs against DDoS and defacement. Void Manticore's IO playbook includes website defacement as a propaganda tool.</li> <li>Action: Brief aerospace recruiting and HR teams on UNC1549/TA455 fake GitHub resume campaign. Do not execute code from unsolicited applicant repositories. Verify all coding challenge repos before any employee interaction.</li> <li>Action: Audit supply chain dependencies on Strait of Hormuz transit. If your logistics depend on this chokepoint, develop contingency routing and monitor for disruption indicators.</li> <li>Action: Review ADS-B, ACARS, and flight operations network segmentation. While no direct targeting of aviation control systems has been confirmed in this cycle, Iranian actors have demonstrated interest in transportation infrastructure.</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>IMMEDIATE (Within 24 Hours)</h3> <table> <thead> <tr> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> SOC </td> <td> Block inbound connections to TCP 44818, 2222, 502, and 102 from non-whitelisted IPs on all internet-facing OT segments. Audit Rockwell CompactLogix and MicroLogix 1400 devices for unexpected project file modifications since March 2026. </td> </tr> <tr> <td> IT Ops </td> <td> Disable VNC (port 5900+), Telnet (23), and FTP (21) on all systems connected to PLCs. If VNC is required for HMI access, restrict to a jump host with MFA. </td> </tr> <tr> <td> SOC </td> <td> Set physical mode switches to RUN on all CompactLogix and MicroLogix PLCs equipped with hardware key switches — this cannot be overridden remotely and is the single most effective mitigation available. </td> </tr> <tr> <td> SOC </td> <td> Activate cyber incident response standby posture. The IRGC gunboat attack creates a 48–72 hour window of elevated cyber retaliation risk. Ensure wiper response playbooks are accessible and IR retainers are confirmed. </td> </tr> <tr> <td> SOC </td> <td> Monitor Telegram channels associated with Handala, Cyber Toufan, and Ababil of Minab for claims related to the Strait of Hormuz incident or maritime targeting. </td> </tr> </tbody> </table> <h3>7-DAY</h3> <table> <thead> <tr> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IT Ops </td> <td> Patch Siemens SINEC NMS to V4.0 SP3 or later to remediate authentication bypass (ICSA-26-111-03) and authorization bypass (ICSA-26-111-09). Audit RUGGEDCOM CROSSBOW SAM-P for privilege escalation exposure (ICSA-26-111-02). </td> </tr> <tr> <td> SOC </td> <td> Audit all cellular modem connections (Verizon, AT&T, T-Mobile, Starlink) providing internet access to field-deployed PLCs. Implement allowlist-only firewall rules on cellular gateways. Inventory all satellite-connected ICS devices. </td> </tr> <tr> <td> HR / Recruiting </td> <td> Brief aerospace and DIB hiring teams on UNC1549/TA455 fake resume campaign. Verify all GitHub coding challenge repositories before execution. Do not run code from unsolicited applicant repos. </td> </tr> <tr> <td> SOC </td> <td> Deploy Sigma/YARA detection rules for Rockwell Studio 5000 Logix Designer connections from non-engineering workstations. Alert on any EtherNet/IP identity enumeration from external IPs. </td> </tr> <tr> <td> SOC </td> <td> Conduct proactive hunt for MuddyWater STARWHALE/GRAMDOOR beaconing patterns. The current C2 silence may indicate infrastructure rotation preceding operational activation. </td> </tr> </tbody> </table> <h3>30-DAY</h3> <table> <thead> <tr> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> CISO </td> <td> Commission assessment of cloud/OAuth attack surface for Iranian actor TTPs. The 43-day absence of cloud-focused Iranian activity may indicate operations held in reserve or a collection gap. Audit Entra ID conditional access policies and OAuth app consent flows. </td> </tr> <tr> <td> CISO </td> <td> Develop and tabletop a ceasefire-collapse cyber response playbook. If kinetic hostilities resume, expect wiper deployment within 48–72 hours targeting energy, water, and government sectors. Pre-stage incident response retainers and confirm offline backup integrity. </td> </tr> <tr> <td> CISO </td> <td> Engage Censys or equivalent external attack surface management platform to establish continuous monitoring of internet-exposed ICS/OT devices, including those on cellular and satellite connections outside traditional enterprise network visibility. </td> </tr> <tr> <td> CISO </td> <td> Review and update third-party risk assessments for any suppliers with Rockwell, Siemens, or Fortinet OT deployments. Supply chain compromise through a less-defended partner is a viable Iranian escalation path. </td> </tr> <tr> <td> Executive </td> <td> Brief the board on the Iran cyber conflict posture. Key message: the ceasefire does not extend to cyberspace, confirmed operational disruption is already occurring, and the probability of destructive cyberattacks increases materially if kinetic hostilities resume. </td> </tr> </tbody> </table> <h2>The Bottom Line                         </h2> Fifty-three days into this conflict, the intelligence picture is unambiguous on three points: First, the ceasefire is a fiction in cyberspace. Iranian state-sponsored cyber operations — from IRGC-affiliated CyberAv3ngers manipulating PLCs to MOIS-operated MuddyWater refreshing C2 infrastructure to UNC1549 targeting aerospace through fake GitHub resumes — have continued without interruption. Any security posture calibrated to diplomatic timelines is miscalibrated. Second, the OT exposure is worse than anyone assumed. Five thousand two hundred nineteen internet-exposed Rockwell PLCs, the majority accessible through cellular modems that bypass every traditional security control your SOC operates. Iranian actors are already exploiting this with legitimate vendor tools. Operational disruption and financial losses are not theoretical — they are confirmed and ongoing. Third, the escalation clock is ticking. The IRGC gunboat attack on April 22 — hours after a ceasefire extension was announced — signals that the kinetic restraint is breaking down. When kinetic restraint breaks, cyber restraint follows. Iran's wiper arsenal (BiBiWiper, ZeroShred, GoneXML, Meteor) is loaded and aimed. The 48–72 hour window after kinetic escalation is when destructive cyber operations are historically most likely. The ceasefire-collapse cyber response playbook is no longer a 30-day planning exercise. It is a near-term operational necessity. The question is not whether Iranian cyber operations will escalate — it is whether your organization will be ready when they do.

FEATURED RESOURCES

April 22, 2026

Anomali Cyber Watch