CRITICALSTART® Security Advisory TLP CLEAR // [CS-SA-26-0301] Security Advisory on Escalating Iranian Conflicts

Executive Summary

On February 28, 2026, the United States and Israel initiated coordinated airstrikes across Iran under Operation Epic Fury, targeting defense infrastructure, and senior leadership including Supreme Leader Ali Khamenei. This attack represents a significant escalation with implications for near-term cyber risk. Based on historical Iran-aligned cyber behavior during periods of geopolitical escalation, and current public reporting, organizations should anticipate opportunistic and potentially disruptive cyber activity in the immediate-to-short term (days to weeks) as retaliatory moves by Iran and affiliates.

Observed and anticipated cyber threat activity associated with Iran-aligned actors frequently includes credential-driven attacks, phishing, exploitation of vulnerable internet-facing systems, and disruptive 'hack-and-leak' or wiper operations conducted directly or via proxy personas. The Critical Start Cyber Research Unit (CRU) assesses with medium to high confidence that Iranian state-directed APT groups will intensify targeted intrusions and disruptive attacks against U.S. and allied organizations in the near term. Organizations in critical U.S. sectors are advised to prepare for retaliatory cyberattacks and elevate monitoring.

Introduction

In the wake of heightened geopolitical tensions following Operation Epic Fury, organizations face a rapidly evolving cyber threat environment. Iran-aligned actors have historically exploited such periods to conduct opportunistic and targeted attacks, leveraging phishing, credential-based access, and disruptive malware campaigns. Iranian cyber forces operate through both the Ministry of Intelligence and Security (MOIS) and the Islamic Revolutionary Guard Corps (IRGC), and their activities span espionage, influence campaigns, and disruptive operations against foreign governments, critical infrastructure, and private sectors. Critical Start published a Security Advisory on "Iranian Cyber Threat Activity on U.S. Financial Institutions" for additional reference. This advisory provides context and outlines prioritized mitigation strategies designed to help organizations reduce exposure, detect suspicious activity early, and maintain operational resilience during this elevated threat period.

Historical Context

Iran has a well-documented pattern of responding to geopolitical escalation with cyber operations. Key prior campaigns targeting U.S. interests include:

• Operation Ababil (2012–2014): Sustained DDoS campaigns targeting U.S. banking portals.
• Las Vegas Sands Corporation (2014): Destructive wiper malware deployed in retaliation for statements by the casino's owner.
• Boston Children's Hospital (2014): Thwarted intrusion attempt targeting healthcare critical infrastructure.
• Municipal Ransomware (2016–present): Iranian nationals have been charged with ransomware attacks crippling U.S. city services.
• June 2025 (12-Day War): Cyberattacks against Israel surged within 48 hours of Israeli military strikes on Iran.

The consistent thread across each episode: Iranian cyber retaliation is not immediate, it is staged. Actors conduct reconnaissance and pre-positioning first, then execute.

Top Iranian Threat Groups

This section highlights the most active and notable Iranian-aligned threat groups currently posing significant cyber risks. Understanding their tactics, techniques, procedures (TTPs) and targets is crucial for anticipating potential attacks and strengthening defensive measures against their evolving operations.

MuddyWater (Primary Threat)

PIONEER KITTEN (Secondary Threat)

Nimbus Manticore (Emerging Threat)

While MuddyWater, Pioneer Kitten, and Nimbus Manticore are highlighted, other actors also contribute to the broader cyber threat activity linked to Iran. These include APT42, APT33 (also known as Elfin, MAGNALLIUM, Refined Kitten, HOLMIUM), Curium (UNC1549, IMPERIAL KITTEN, Tortoiseshell), MalKamak, Storm-1084 (DEV-1084), GreenCharlie, and Ferocious Kitten. Many of these groups share tradecraft and collaborate operationally, so attribution should be approached carefully. Collectively, they employ a wide range of espionage and disruptive tactics, emphasizing the need for comprehensive defense strategies.

Tactics, Techniques, and Procedures

The table below consolidates the known TTPs of MuddyWater, Pioneer Kitten and other Iran-affiliated cyber threat actors to help frame how Iranian-aligned groups typically operate. This is not an exhaustive list of all methods employed by Iranian-aligned threat actors but a starting point.

The named actors have distinct labels but often share tradecraft and operational methods, so historical behaviors, such as spear-phishing, credential harvesting, exploitation of unpatched services, and custom malware deployment, are useful for understanding likely adversary actions.

What to Watch For

The following activities reflect the types of operations Iranian-aligned threat actors are likely to pursue in the current environment. Organizations should monitor these behaviors closely to identify potential threats early and guide defensive actions:

Pre-Positioning and Reconnaissance Activity

Elevated scanning of internet-facing infrastructure, VPN appliances, and network edge devices for vulnerabilities is expected. Threat actors are identifying targets of opportunity prior to executing more disruptive operations. Unusual authentication attempts, abnormal MFA push activity, and attempts to exploit known CVEs should be treated as precursors.

Increased Targeting of Critical Infrastructure

Energy grids, water utilities, transportation networks, telecommunications providers, and defense industrial base organizations should expect heightened targeting. Iranian actors have previously probed U.S. water utility SCADA and ICS systems. With conventional military options degraded, disrupting essential services carries high strategic value as a signaling mechanism.

Destructive Malware and Wiper Deployments

Iranian actors are known to deploy wiper malware and ransomware during periods of high escalation. Organizations should watch for indicators including rapid mass file deletion or encryption, volume shadow copy deletion, Master Boot Record (MBR) modification attempts, and lateral movement from previously dormant footholds. The goal of these operations is disruption and economic damage, not just data theft.

DDoS and Service Disruption Campaigns

Pro-Iranian hacktivist groups and botnet infrastructure (notably HydraC2 and groups associated with the Handala and Sicarii clusters) are actively mobilizing. DDoS attacks represent the most immediately available retaliatory tool across the hacktivist ecosystem. Pro-Russian groups including Noname057(16) have joined in support, expanding available botnet capacity. Customer-facing services and public-sector portals are likely targets.

Ransomware and Extortion

PIONEER KITTEN has been linked to ransomware operations in collaboration with affiliates not limited to ALPHV/BlackCat, DEV-1084, NoEscape. Post-strike, financially motivated ransomware operations against U.S. targets may serve dual purposes of revenue generation and operational disruption.

Iran-Themed Phishing Lures

Social engineering campaigns will align with the current news cycle. Watch for phishing emails using themes such as:

• Breaking news alerts about the Iran conflict prompting users to click links or open attachments.
• Fake government notifications, emergency alerts, or security warnings tied to the strikes.
• Recruitment-themed lures impersonating aerospace, defense, and government contractors.
• Credential-harvesting pages mimicking VPN portals, Microsoft 365, or corporate SSO login screens.

What Critical Start Is Doing

The Critical Start CRU and Security Operations Center are operating at heightened vigilance in response to the current threat environment. Specific actions underway include:

• Increased Monitoring: SOC analysts are operating with an elevated monitoring posture to observe for anomalous authentication events, lateral movement patterns, unusual outbound connections, and PowerShell-based execution chains commonly associated with Iranian actor tradecraft. Alerts will be investigated according to established SLAs.
• IOC Deployment: Indicators of compromise are being gathered and prepared for operationalization. Threat hunts using these IOCs will be conducted in the coming days.
• Intelligence Monitoring: The CRU is maintaining continuous monitoring of threat intelligence sources, government advisories (CISA, FBI, CYBERCOM), and ISAC feeds for emerging indicators and actor activity updates related to this conflict.
• Detection Uplift: The SOC and Security Engineering teams are actively reviewing and expanding detection coverage aligned to MuddyWater, PIONEER KITTEN, and Nimbus Manticore TTPs, IOCs, and behavioral indicators documented in this advisory. The table below gives a summary:

Detection Coverage Summary

Organizational Mitigation Strategies

In light of the elevated threat environment following Operation Epic Fury, organizations should implement or validate the following mitigation strategies, prioritized by recommended timeframes:

24–48 Hours

• Audit MFA configurations and disable legacy authentication protocols.
• Patch the CVEs listed in the advisory and further reading links, prioritizing any internet-facing VPNs and network appliances. If you have VMS, expect an outreach from the team.
• Send employee awareness communications specifically about conflict-themed phishing lures.
• Validate rules of engagement (ROE) in place to allow Critical Start to take remediation actions, and ensure your notification groups are up-to-date for proper escalation.

1 Week

• Audit VPN, firewall, and appliance configurations for unauthorized access.
• Block or sandbox macro-enabled attachments and validate email security controls (DMARC/DKIM/SPF).
• Audit all RMM tools (ScreenConnect, Atera, AnyDesk) for unauthorized instances. Detection opportunities exist. Feel free to reach out to CSM for customization and deployment.
• Validate DDoS mitigation capabilities and upstream provider agreements.

30 Days

• Implement or review network segmentation to limit lateral movement from compromised edge devices.
• Conduct phishing simulations reflecting Iranian APT lure styles.
• Develop and test incident response playbooks for sustained DDoS scenarios.
• Review service account permissions and enforce least-privilege access broadly.

Conclusion

Iranian cyber actors have a proven, consistent track record of responding to kinetic escalation with cyber operations targeting U.S. and allied critical infrastructure. Operation Epic Fury represents a significant escalation that eliminates Iran's conventional deterrence, making cyber the primary remaining tool of retaliation. The threat is active, the actors are capable, and the targeting is broad across all critical infrastructure sectors. The Critical Start CRU will continue to monitor developments and publish updates via the Intelligence Hub and CORR Bulletins. Customers with questions should feel free to engage with their Customer Success Managers.

Further Reading

1. Critical Start – Iranian Cyber Threat Activity on U.S. Financial Institutions
2. Google – Tool of First Resort: Israel-Hamas War in Cyber
3. Infosecurity Magazine – Iran: Nimbus Manticore (European targets)
4. CISA Cybersecurity Advisory AA24-290A
5. Sophos – Cyber advisory: increased cyber risk amid U.S.-Israel-Iran escalation
6. FBI IC3 CSA (220914) PDF
7. FBI – The Iran Threat
8. Microsoft – MERCURY and DEV-1084: Destructive attack on hybrid environment
9. Unit42 – Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran
10. CISA – Iran State-Sponsored Cyber Threat: Advisories
11. Washington Institute – Iran Crisis Moves Into Cyberspace