![[CS-SA-26-0301] Security Advisory on Escalating Iranian Conflicts](https://cdn.prod.website-files.com/69d6c7e72a86da6e2a10306c/6a0b2029342fd74f0e042f15_Threat%20Intel.png)
Cyber Threat Intelligence | Critical Start Security Advisory
Download the Security Advisory (PDF)On February 28, 2026, the United States and Israel initiated coordinated airstrikes across Iran under Operation Epic Fury, targeting defense infrastructure, and senior leadership including Supreme Leader Ali Khamenei. This attack represents a significant escalation with implications for near-term cyber risk. Based on historical Iran-aligned cyber behavior during periods of geopolitical escalation, and current public reporting, organizations should anticipate opportunistic and potentially disruptive cyber activity in the immediate-to-short term (days to weeks) as retaliatory moves by Iran and affiliates.
Observed and anticipated cyber threat activity associated with Iran-aligned actors frequently includes credential-driven attacks, phishing, exploitation of vulnerable internet-facing systems, and disruptive ‘hack-and-leak’ or wiper operations conducted directly or via proxy personas. The Critical Start Cyber Research Unit (CRU) assesses with medium to high confidence that Iranian state-directed APT groups will intensify targeted intrusions and disruptive attacks against U.S. and allied organizations in the near term. Organizations in critical U.S. sectors are advised to prepare for retaliatory cyberattacks and elevate monitoring.
In the wake of heightened geopolitical tensions following Operation Epic Fury, organizations face a rapidly evolving cyber threat environment. Iran-aligned actors have historically exploited such periods to conduct opportunistic and targeted attacks, leveraging phishing, credential-based access, and disruptive malware campaigns. Iranian cyber forces operate through both the Ministry of Intelligence and Security (MOIS) and the Islamic Revolutionary Guard Corps (IRGC), and their activities span espionage, influence campaigns, and disruptive operations against foreign governments, critical infrastructure, and private sectors. Critical Start published a Security Advisory on “Iranian Cyber Threat Activity on U.S. Financial Institutions” for additional reference. This advisory provides context and outlines prioritized mitigation strategies designed to help organizations reduce exposure, detect suspicious activity early, and maintain operational resilience during this elevated threat period.
Iran has a well-documented pattern of responding to geopolitical escalation with cyber operations. Key prior campaigns targeting U.S. interests include:
This section highlights the most active and notable Iranian-aligned threat groups currently posing significant cyber risks. Understanding their tactics, techniques, procedures (TTPs) and targets is crucial for anticipating potential attacks and strengthening defensive measures against their evolving operations.
| Affiliation | Iranian Ministry of Intelligence and Security (MOIS) |
| Also Known As | Seedworm, MERCURY, Earth Vetala, TA450, Boggy Serpens, Static Kitten |
| Primary Targets | Government, Energy, Telecommunications, Critical Infrastructure |
| Key Tradecraft | Spear-phishing with macro-enabled documents, RMM tool abuse (ScreenConnect, Atera), password spraying, MFA fatigue, custom backdoors (BugSleep, LiteInject) |
| Affiliation | Islamic Revolutionary Guard Corps (IRGC) |
| Also Known As | Fox Kitten, UNC757, Parisite |
| Primary Targets | Technology, Government, Defense, Healthcare, Energy |
| Key Tradecraft | Exploitation of internet-facing VPNs and network appliances, SSH tunneling via Ngrok/SSHMinion, web shell deployment, hands-on-keyboard via RDP |
| Affiliation | IRGC-aligned |
| Also Known As | Related to Educated Manticore cluster |
| Primary Targets | Aerospace, Telecommunications, Defense |
| Key Tradecraft | Fake recruiter personas and fraudulent career portals, multi-stage DLL sideloading into legitimate Windows executables, custom backdoors (Minibike, MiniJunk, MiniBrowse), cloud C2 via Azure/Cloudflare |
While MuddyWater, Pioneer Kitten, and Nimbus Manticore are highlighted, other actors also contribute to the broader cyber threat activity linked to Iran. These include APT42, APT33 (also known as Elfin, MAGNALLIUM, Refined Kitten, HOLMIUM), Curium (UNC1549, IMPERIAL KITTEN, Tortoiseshell), MalKamak, Storm-1084 (DEV-1084), GreenCharlie, and Ferocious Kitten. Many of these groups share tradecraft and collaborate operationally, so attribution should be approached carefully. Collectively, they employ a wide range of espionage and disruptive tactics, emphasizing the need for comprehensive defense strategies.
The table below consolidates the known TTPs of MuddyWater, Pioneer Kitten and other Iran-affiliated cyber threat actors to help frame how Iranian-aligned groups typically operate. This is not an exhaustive list of all methods employed by Iranian-aligned threat actors but a starting point.
| Tactic | Technique ID | Technique Name | Actor |
|---|---|---|---|
| Resource Development | T1583.001 | Acquire Infrastructure: Domains | MuddyWater, APT35 |
| Resource Development | T1587.001 | Develop Capabilities: Malware | MuddyWater |
| Reconnaissance | T1595.002 | Active Scanning: Vulnerability Scanning | PIONEER KITTEN |
| Initial Access | T1566.001 | Phishing: Spearphishing Attachment | MuddyWater, APT35 |
| Initial Access | T1190 | Exploit Public-Facing Application | PIONEER KITTEN |
| Initial Access | T1078 | Valid Accounts (Credential Abuse) | MuddyWater, PIONEER KITTEN |
| Execution | T1059.001 | Command and Scripting: PowerShell | MuddyWater, APT35 |
| Execution | T1204.002 | User Execution: Malicious Macro | MuddyWater |
| Persistence | T1547.001 | Boot/Logon: Registry Run Keys | MuddyWater |
| Persistence | T1505.003 | Server Software Component: Web Shell | PIONEER KITTEN |
| Defense Evasion | T1055 | Process Injection | MuddyWater |
| Defense Evasion | T1078.002 | Valid Accounts: Domain Accounts | PIONEER KITTEN |
| Credential Access | T1110.003 | Brute Force: Password Spraying | MuddyWater |
| Credential Access | T1621 | Multi-Factor Authentication Request Gen. | MuddyWater |
| Collection | T1114 | Email Collection (HYPERSCRAPE) | APT35 |
| Command & Control | T1219 | Remote Access Software (RMM Tools) | MuddyWater |
| Command & Control | T1090 | Proxy: External Proxy (Ngrok/SSHMinion) | PIONEER KITTEN |
| Command & Control | T1071.001 | Application Layer Protocol: Web Protocols | PIONEER KITTEN |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | MuddyWater |
| Exfiltration | T1005 | Data from Local System | IRGC-affiliated actors |
| Impact | T1485 | Data Destruction (Wiper Malware) | IRGC-affiliated actors |
| Impact | T1498 | Network Denial of Service (DDoS) | Handala Hack, proxies |
While the named actors have distinct labels, they often share tradecraft and operational methods, so historical behaviors, such as spear-phishing, credential harvesting, exploitation of unpatched services, and custom malware deployment, are useful for understanding likely adversary actions.
The following activities reflect the types of operations Iranian-aligned threat actors are likely to pursue in the current environment. Organizations should monitor these behaviors closely to identify potential threats early and guide defensive actions:
Elevated scanning of internet-facing infrastructure, VPN appliances, and network edge devices for vulnerabilities is expected. Threat actors are identifying targets of opportunity prior to executing more disruptive operations. Unusual authentication attempts, abnormal MFA push activity, and attempts to exploit known CVEs should be treated as precursors.
Energy grids, water utilities, transportation networks, telecommunications providers, and defense industrial base organizations should expect heightened targeting. Iranian actors have previously probed U.S. water utility SCADA and ICS systems. With conventional military options degraded, disrupting essential services carries high strategic value as a signaling mechanism.
Iranian actors are known to deploy wiper malware and ransomware during periods of high escalation. Organizations should watch for indicators including rapid mass file deletion or encryption, volume shadow copy deletion, Master Boot Record (MBR) modification attempts, and lateral movement from previously dormant footholds. The goal of these operations is disruption and economic damage, not just data theft.
Pro-Iranian hacktivist groups and botnet infrastructure (notably HydraC2 and groups associated with the Handala and Sicarii clusters) are actively mobilizing. DDoS attacks represent the most immediately available retaliatory tool across the hacktivist ecosystem. Pro-Russian groups including Noname057(16) have joined in support, expanding available botnet capacity. Customer-facing services and public-sector portals are likely targets.
PIONEER KITTEN has been linked to ransomware operations in collaboration with affiliates not limited to ALPHV/BlackCat, DEV-1084, NoEscape. Post-strike, financially motivated ransomware operations against U.S. targets may serve dual purposes of revenue generation and operational disruption.
Social engineering campaigns will align with the current news cycle. Watch for phishing emails using themes such as:
The Critical Start CRU and Security Operations Center are operating at heightened vigilance in response to the current threat environment. Specific actions underway include:
| Behavioral Layer | MITRE Techniques | Description | What We Monitor For | Typical Telemetry Sources |
|---|---|---|---|---|
| Pre-Compromise & Reconnaissance | T1583.001, T1587.001, T1595.002 | Domain registration, malware development, and external vulnerability scanning | Malicious domain activity, scanning patterns, reconnaissance traffic, threat intel correlations | Threat intel, DNS, firewall, web server logs |
| Initial Access & Identity Abuse | T1566.001, T1190, T1078, T1110.003, T1621 | Phishing, public-facing application exploitation, credential abuse, password spraying, MFA fatigue | Suspicious attachments, anomalous authentication attempts, MFA push abuse, web exploitation patterns | Endpoint EDR, identity provider logs, email security, WAF |
| Execution & Persistence | T1059.001, T1204.002, T1547.001, T1505.003 | PowerShell abuse, macro execution, registry persistence, web shell deployment | Abnormal scripting activity, Office child process spawning, persistence registry changes, web shell artifacts | Endpoint EDR, OS event logs, web server logs |
| Defense Evasion & Privilege Abuse | T1055, T1078.002 | Process injection and misuse of privileged/domain accounts | Suspicious parent-child processes, injection behavior, abnormal privileged account usage, lateral movement indicators | Endpoint EDR, AD logs, identity telemetry |
| Command & Control | T1219, T1090 | Remote management tools and encrypted tunneling/proxy services | Unauthorized RMM tool execution, rare outbound connections, encrypted tunnel creation, anomalous DNS patterns | Endpoint EDR, DNS, firewall, proxy logs |
| Collection & Exfiltration | T1114, T1041 | Email harvesting and data theft over command-and-control channels | Mailbox access anomalies, bulk export behavior, large outbound encrypted transfers | Email logs, cloud audit logs, proxy/firewall telemetry |
| Impact | T1485, T1498 | Destructive malware (wipers) and denial-of-service activity | Mass file deletion, disk overwrite patterns, service disruption activity, network saturation events | Endpoint EDR, server logs, network telemetry |
In light of the elevated threat environment following Operation Epic Fury, organizations should implement or validate the following mitigation strategies, prioritized by recommended timeframes:
Iranian cyber actors have a proven, consistent track record of responding to kinetic escalation with cyber operations targeting U.S. and allied critical infrastructure. Operation Epic Fury represents a significant escalation that eliminates Iran’s conventional deterrence, making cyber the primary remaining tool of retaliation. The threat is active, the actors are capable, and the targeting is broad across all critical infrastructure sectors. The Critical Start CRU will continue to monitor developments and publish updates via the Intelligence Hub and CORR Bulletins. Customers with questions should feel free to engage with their Customer Success Managers.
