cyber threat intelligence – The Security Brief

A Technical Post-Mortem of the Notepad++ Supply Chain Compromise

The modern software supply chain is built on a foundation of implicit trust; a trust that users and systems place in update mechanisms to deliver secure patches. When this trust is weaponized, the resulting compromise can bypass even the most robust perimeter defenses. Between June and December 2025, the Notepad++ project became the target of a sophisticated infrastructure-level supply chain compromise attributed to a People’s Republic of China (PRC)-aligned threat actor. The operation, characterized by its selective targeting and operational stealth, used a compromise of the project’s shared hosting environment to manipulate the software’s update mechanism, WinGUp.

This post will break down the technical specifics of the breach, the on-path hijacking mechanism, and the custom malware deployed against high-value targets.

The Infrastructure Breach

The compromise did not originate from a vulnerability in the Notepad++ source code itself, but from a fundamental weakness in the hosting infrastructure. On 2 February 2026, Notepad++ maintainer Don Ho disclosed that the project’s official domain was targeted through an infrastructure-level compromise at their former shared hosting provider.

According to their investigations, the threat actor specifically searched for an targeted the notepad-plus-plus.org domain within the shared environment, ignoring other tenants. This targeted approach allowed the threat actor to intercept and manipulate the server-side logic responsible for handling update requests.

Six-Month Dwell Time

The timeline shows a patient adversary who maintained a foothold for half a year:

June 2025: Initial compromise of the shared hosting server.
Sept 2, 2025: Attackers lost direct server access following scheduled maintenance that updated the system’s kernel and firmware.
Sept – Dec. 2, 2025: Despite losing server access, the attackers retained stolen credentials for internal service accounts. This allowed them to continue redirecting update traffic for an additional three months.

On-Path Redirection

The mechanism for the delivery was a classic on-path infrastructure manipulation. When a user running an older version of Notepad++ checked for updates, the built-in Windows Generic Update Program (WinGUp, or gup.exe) would query the official website.

Request > Redirection > Poisoned manifest > Unverified Execution

This method was highly selective. Rather than a mass infection event, the attackers only redirected specific traffic likely based on the victim’s IP address or organizational profile.

Chrysalis Payload and Multiple Infection Chains

Technical analysis by Rapid7 and Kaspersky has identified at least three distinct infection chains used throughout the campaign to deliver various payloads, most notably a previously undocumented custom backdoor tracked as Chrysalis.

The Chrysalis Backdoor

Chrysalis is a sophisticated, feature-rich implant meant for long-term espionage. It’s capabilities include:

Uses Microsoft Warbird code protection and custom API hashing to evade detection.
Supports remote command execution, file system and registry enumeration, and process management.
Implements a chunked file transfer protocol over its C2 channel to bypass network size limits and mimic legitimate traffic.

Infection Chain Summary

Phase	Technique	Payload
Chain 1 (July/Aug)	ProShow DLL sideloading	Cobalt Strike Beacon
Chain 2 (Sept)	Lua-based execution using legit Lua interpreter dropped in an Adobe themed folder	Cobalt Strike Beacon
Chain 3 (Oct/Nov)	Trojanized installer dropping a renamed Bitdefender binary to sideload log.dll	Chrysalis Backdoor

Attribution

Several researchers, including Kevin Beaumont (who first reported the issue in December 2025) and Rapid7, have attributed this activity to Lotus Blossom (aka Billbug, Violet Typhoon, APT31).

Lotus Blossom is a Chinese state-sponsored group active since at least 2009, known for targeting government, telecommunications, and finance sectors across Southeast Asia. The precision of the Notepad++ targeting is highly consistent with the group’s historical intelligence requirements.

Targets

The campaign’s impact was concentrated in:

Sectors: Telecom, Financial Services, IT Services, Government
Regions: Vietnam, Philippines, El Salvador, Australia

By compromising network administrators or engineers at a telecom provider via a trusted tool like Notepad++, the threat actors gain a vantage point for deep reconnaissance across the provider’s entire infrastructure, potentially facilitating further access to downstream high-value targets.

Mitigation and Defense

The Notepad++ maintainers have since migrated to a hardened hosting provider and released security-focused updates.

Recommendations

Ensure all Notepad++ installations are upgraded to version 8.9.1 or later. Versions 8.8.9 implement mandatory signature and certificate verification for all updates.
Remove any custom root certificates that were required for older Notepad++ installations. Official binaries are now signed with valid GlobalSign certificates.
Scan systems for files named AutoUpdater.exe or update.exe in the %TEMP% directory, as these are not legitimate Notepad++ filenames.
Restrict gup.exe from connecting to any domain other than notepad-plus-plus.org or github.com.
Enforce allow-listing for update mechanisms. Consider centrally managing developer utilities rather than allowing unverified, internet-initiated auto-updates.

Technical Indicators of Compromise (IOCs)

Type	Value
C2 Domain	api.skycloudcenter[.]com
C2 Domain	api.wiresguard[.]com
C2 Domain	cdncheck.it[.]com
C2 Domain	safe-dns.it[.]com
Exfil Host	temp[.]sh
Malicious URL	http://95.179.213%5B.%5D0/update/update.exe
Installer Hash (SHA1)	8e6e505438c21f3d281e1cc257abdbf7223b7f5a
Chrysalis Loader Path	%AppData%\Bluetooth\log.dll

Works cited

February 3, 2026

DynoWiper and the Polish Energy Sector

In late-December 2025, the Polish energy sector was targeted by a coordinated series of destructive cyberattacks using a new malware tracked as DynoWiper [1]. The operation affected over 30 renewable energy sites and a major combined heat and power plant during a period of extreme cold.

Key Technical Observations:

DynoWiper is a destructive tool designed to overwrite or delete data. It shares significant code overlaps with the “ZOV” wiper previously used in Ukraine [2].
The attack focused on the distributed edge, specifically targeting Remote Terminal Units (RTUs) at wind and solar farms. Attackers damaged firmware to disable remote communication with the grid operator.
In several instances, access was gained via internet-exposed edge devices lacking multi-factor authentication (MFA).

Attribution Discrepancy

A fairly uncommon disagreement exists between private industry and Polish officials regarding the actor:

Sandworm (GRU): Linked by ESET and Dragos due to technical malware lineage and the 10th anniversary of the 2015 Ukraine blackout [3].
Dragonfly/Berserk Bear (FSB): Formally attributed by CERT.PL based on specific C2 infrastructure overlaps with current FSB espionage operations [4].

The evidence suggests a collaborative model or shared contractor network. One agency likely provided the initial access/infrastructure while the other provided the specialized destructive tradecraft. The targeting of Polish critical infrastructure is a shift for FSB-aligned actors from long-term pre-positioning to active destruction against NATO critical infrastructure.

References

[1] https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/

[1] https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/

[3] https://pylos.co/2026/01/31/attributive-questions-in-high-profile-incidents/

[4] https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/

February 2, 2026

Iranian Hybrid Warfare: Internal Suppression and Transnational Influence Operations

BLUF:

The Iranian regime is transitioning from reactive crisis management to a proactive digital isolation strategy to secure domestic stability. Recent breaches of state media and renewed civil unrest have accelerated plans for a “Barracks Internet,” while simultaneous offensive cyber operations and foreign influence campaigns indicate Tehran is increasingly weaponizing digital infrastructure to suppress dissent at home and sow discord within Western adversaries.

Key Judgements:

KJ-1: The Iranian government is highly likely to implement a permanent, tiered national internet by late-2026. This “whitelist” system will designate global internet access as a state-vetted privilege, effectively severing the general population from unmonitored external communication.
KJ-2: Recent inauthentic behavior clusters targeting French and Scottish independence movements are likely part of a broader IRGC-led influence operation designed to exploit Western sociopolitical fractures. The synchronization of these accounts with Iranian domestic internet outages confirms an Iran-based point of origin.
KJ-3: The sophisticated phishing campaign targeting the Iranian diaspora and Middle Eastern officials represents a shift toward high-precision intelligence collection. I assess with moderate confidence that these operations aim to map opposition networks and preemptively disrupt coordination between domestic activists and external supporters.

Intelligence Analysis

I. Domestic Instability and the Media Breach

On Sunday, 18 January 2026, the Islamic Republic of Iran Broadcasting (IRIB) suffered a significant technical breach. Activists hijacked the Badr satellite feed to air footage of exiled Crown Prince Reza Pahlavi. The broadcast, which lasted approximately ten minutes, specifically called for the defection of military and security forces, a direct strike at the regime’s “center of gravity.” This incident demonstrates persistent vulnerabilities in state-controlled infrastructure despite heavy investment in cyber defense.

II. The “Barracks Internet” Initiative

In response to the December 2025-January 2026 protest wave, Tehran has accelerated the “National Information Network” (NIN). Reporting indicates a move toward “Absolute Digital Isolation,” where the general public is routed through a domestic intranet, while “White SIM cards” (unfiltered lines) are reserved for regime loyalists and security officials.

This architecture allows the regime to maintain economic functions (banking and logistics) during unrest while completely darkening the digital environment for protestors.

III. Transnational Influence Operations (France and Scottland)

Open-source evidence from 2025 and early-2026 reveals that clusters of “patriotic” accounts in France and “Scottish Independence” personas on X (formerly Twitter) are operated by Iranian cyber units. These accounts:

Mimic local identities
Go silent instantly when Iran suffers domestic internet or power outages
In some cases, have pivoted to pro-Tehran messaging upon restoration of services

The primary objective is not the success of these movements, but the erosion of social cohesion within NATO and EU member states as a retaliatory measure for Western support of Iranian dissidents.

IV. Targeted Cyber Espionage

The recent phishing wave utilized the Phoenix backdoor and QR-code-based WhatsApp hijacking. Unlike broad cybercrime, this campaign is surgically focused on:

Iranian experts/dissidents: To monitor regime change discourse.
Regional officials: Including a Lebanese cabinet minister, to collect intelligence on regional shifting alliances.
US-based experts: To identify potential channels of influence or intelligence being fed to Western governments.

Analysis of Alternatives (AoA)

Alternative 1: Independent Non-State Actors. The TV hack and phishing could be the work of decentralized hacktivist groups (e.g., Edalat-e Ali) acting without foreign state support. While plausible for the breach, the scale and sustained nature of the “Barracks Internet” and the global IO clusters suggest state-level resources and strategic intent.
Alternative 2: Technical Coincidence. The silencing of French/Scottish accounts could be attributed to platform-wide bot purges rather than Iranian internet outages. However, the exact temporal correlation with Iranian kinetic incidents (e.g., the June 2025 strikes) makes this highly improbable.

Final Assessment

The regime is entering a “Fortress Iran” phase. By decoupling from the global web, Tehran aims to make domestic coordination impossible while maintaining a digital sniper capability to target enemies abroad. Analysts should expect increased friction between the regime’s need for global economic integration and its survivalist need for total information control.

January 19, 2026

Controlled Impunity in Russia’s Cyber Underground

On 23 October 2025, Recorded Future assessed that Russia has shifted from a largely permissive “safe haven” model for cybercriminals to a managed cybercrime ecosystem. This evolution reflects a strategy of controlled impunity, where Kremlin authorities selectively tolerate, leverage, or regulate cybercriminal actors based on intelligence value, geopolitical utility, and risk of international pressure. State-linked or state-aligned operators remain insulated, while lower-tier enablers, money-laundering intermediaries, and infrastructure providers have faced increased arrests, disruption, and publicity-driven crackdowns. The report notes growing mistrust inside the criminal underground, leading to closed recruitment, collateral requirements, affiliate vetting, and frequent rebranding. Ransomware activity remains steady, with hundreds of new variants emerging as operators fragment and adapt to law-enforcement pressure. Western counter-ransomware operations, sanctions, payment restrictions, and coordinated takedowns continue to raise operational risk and cost for Russia-based cybercriminal groups.

Analysis: Russia’s cyber ecosystem is entering a state-directed equilibrium where criminal capability remains accessible to the government while the Kremlin applies selective enforcement to maintain plausible deniability and political signaling. This model resembles a regulated illicit market as opposed to a laissez-faire sanctuary. Expect continued fragmentation, OPSEC tightening, and increased friction in monetization pipelines, but not any meaningful reduction in Russian-nexus cyber operations. Western pressure is reshaping incentives without removing cybercrime’s value as an instrument of state power. Network defenders should prioritize disruption of enabling services and financial channels, not anticipate Russian law enforcement to meaningfully degrade core ransomware operators.

October 30, 2025

Leaked Files Expose Iranian Charming Kitten Operations (Cont.)

On 28 October 2025, researcher Nariman Gharib detailed leaked CSV files reportedly tied to Charming Kitten containing domain registrations, hosting activity, payment records, and operational email infrastructure spanning 2023 to 2024, along with references to Iranian telecom blocks and suspected IRGC-aligned procurement channels. The disclosure appears to map core service providers, cryptocurrency-based payments, and active operator accounts used to support phishing and infrastructure rotation.

Analysis: If authentic, these files provide actionable insight into Charming Kitten’s procurement and infrastructure lifecycle, including financial flows and service dependencies that could accelerate attribution, blocking, and proactive disruption. Public exposure of operators, service vendors, and domestic network blocks may pressure Tehran’s cyber units to retool, yet historical behavior suggests Iran will likely maintain tempo and diversify infrastructure rather than cease activity. This case underscores the importance of tracking adversary logistics and payment mechanisms as a means of degrading persistent state-aligned access operations.

October 30, 2025

Adversaries Intensify Scanning and Brute Force Activity Against Perimeter Devices

On 3 October 2025, GreyNoise reported a ~500% increase in unique IPs scanning Palo Alto Networks GlobalProtect/PAN-OS login portals, the highest level in 90 days; open-source coverage between 4–8 October corroborated elevated reconnaissance volumes and noted US-heavy scanning with additional clusters hitting Pakistan. In parallel, Cisco has warned of a large-scale brute-force campaign against VPN, web auth, and SSH services tracked by Talos since 18 March 2024, and with active exploitation of Cisco ASA/FTD VPN web services disclosed 25 September 2025.

Analysis: The GlobalProtect scan spike is highly likely preparatory reconnaissance for credential-stuffing or exploit development rather than noise, based on the scale and concentration GreyNoise reported. It is likely that cross-vendor VPN and portal infrastructure will face elevated probing in the near term given the concurrent, actively exploited Cisco ASA and FTD web-services flaws and the US government’s emergency order on 25 September 2025 requiring agencies to immediately hunt for and mitigate compromise on those Cisco ASA/FTD devices.

October 8, 2025

Leaked Files Expose Iranian Charming Kitten Operations

The KittenBusters repository publicly discloses internal materials tied to the Iranian APT known as Charming Kitten (IRGC-IO Counterintelligence Unit 1500). The disclosures include official documents, employee photos, malware samples, chat logs, attack reports, and translations, all intended as evidence of the group’s operations. The repo also names a purported leader (Abbas Rahrovi/Abbas Hosseini) associated with front companies, asserts the group has targeted telecoms, aviation, intelligence, and dissidents in the Middle East and beyond, and announces future releases of additional evidence.

Analysis: The release of these materials tied to Charming Kitten gives us a rare visibility into the structure, leadership, and tradecraft of an Iranian state-sponsored actor. If real, these disclosures are highly likely to aid defenders in attribution and detection, but they also risk prompting the group to adapt its operations and shift infrastructure. The exposure of individual operators and front companies could pressure Iran’s cyber apparatus, but it is likely Tehran will deny involvement while continuing on with other campaigns under modified units or identities. Should be a fun one to follow.

https://github.com/KittenBusters/CharmingKitten

October 2, 2025

China’s Great Firewall Leak Exposes Internal Censorship Infrastructure

On 15 September 2025, CyberNews reported that over 500 GB of internal data tied to China’s Great Firewall leaked via Geedge Networks. The files included source code, internal work logs, communications, Jira tickets, and system configurations.

The leak revealed that Geedge markets its surveillance and censorship technologies abroad. Confirmed export locations in the documents include Myanmar, Pakistan, Ethiopia, and Kazakhstan. The materials suggest these are part of a broader push under China’s global influence strategies.

This exposure provides a rare look into how censorship is engineered and sold. It highlights the interaction of technical design, political objectives, and global ambition in digital control systems.

https://cybernews.com/security/china-great-firewall-leak-exposes-global-exports/

September 30, 2025

Disrupting Cartels: A Multi-Approach Strategy

Military raids and high-profile arrests make headlines, but they do not end the business of cartels. Mexican and South American trafficking organizations operate like multinational corporations: diversified revenue streams, global supply chains, and deep local recruitment pipelines. Long-term disruption will require a different approach. The US must pursue strategies that make the cartel business model financially unsustainable and logistically difficult. This means combining proven tactics with fresh ideas.

The points below are presented as broad concepts to help spark discussion, rather than full write-ups. Bullet points allow the ideas to be absorbed quickly, keep the focus on the main themes, and give room for others to share their perspectives or expand on them with their own insights.

Hit the Money

Cartels are profit-driven, so hitting their finances directly is one of the most effective tactics.

Sanctions: Use the Foreign Narcotics Kingpin Act and related tools to freeze assets and bar cartel associates from the global financial system.
AML enforcement: Monitor wire transfers, front companies, trade-based laundering, and crypto flows.
Asset forfeiture: Seize properties, accounts, and equipment tied to trafficking.
Gatekeeper accountability: Extend AML requirements to lawyers, accountants, and company formation agents who unintentionally aid laundering.

Source: https://www.fbi.gov/news/stories/operation-targets-sinaloa-drug-cartel-

Pressure the Supply Chains

Without precursor chemicals, weapons, and reliable transport, cartel profits collapse.

Precursor controls: Tight licensing, end-user declarations, and transaction reporting for fentanyl and meth ingredients.
Transport disruption: Increase inspections at land, sea, and air points. Use risk-scoring for parcels and coordinated seizures to impose losses.
Weapon flow prevention: Enforce straw purchase laws, track high-volume ammo sales, and inspect southbound cargo for firearms.

Map illustrating the flow of fentanyl precursors from China to the U.S., Mexico, and Canada, highlighting the trafficking routes used by drug cartels. Source: https://www.heritage.org/china/report/holding-china-and-mexico-accountable-americas-fentanyl-crisis

Strengthen Law Enforcement and Legal Tools

Treat cartels as the national security threat they are.

Legal designations: Label major cartels as Foreign Terrorist Organizations to unlock broader prosecution authorities.
Multi-charge prosecutions: Use corruption, extortion, racketeering, and terrorism statutes alongside drug laws.
Joint task forces: Expand US-Mexico intelligence-sharing, vetted police units, and targeted extraditions.

Undercut Recruitment

Cartels can replace jailed or killed members quickly. Cutting off their manpower is essential.

Economic investment: Develop infrastructure, job opportunities, and vocational training in high-risk regions.
Community programs: Support local leadership, protect activists, and fund youth initiatives.
Public messaging: Counter the narco “glamor” with real accounts of cartel life and its short, violent reality.
Exit pathways: Offer reduced sentences or amnesty for low-level members who defect.

Map illustrating the narcotics trafficking flows and operational zones of major cartels in Mexico, highlighting cities of concentration and ports of entry. Source: https://www.start.umd.edu/tracking-cartels-infographic-series-major-cartel-operational-zones-mexico

Leveraging Technology and Intelligence

Modern cartels use drones, encrypted comms, and cyber tools; the response must be smarter.

Surveillance: Deploy drones, thermal imaging, and satellite analytics to detect labs, routes, and cultivation sites.
Data analysis: Use AI to flag suspicious trade, travel, or financial activity linked to trafficking networks.
Cyber disruption: Infiltrate encrypted networks, disable cartel IT infrastructure, and track crypto transactions.
Fusion centers: Integrate federal, state, and Mexican partners to rapidly act on shared intelligence.

Members of the Jalisco New Generation Cartel in Michoacán State, Mexico, in 2022. Source: https://www.nytimes.com/2025/06/30/world/americas/sinaloa-cartel-mexico.html

Conclusion

Cartels are resilient because they operate across multiple domains: finance, logistics, community, and technology. Disrupting one area temporarily hurts them; attacking all at once can slowly erode their power. The US can combine financial sanctions, supply chain disruption, legal pressure, recruitment prevention, and intelligence innovation into a long-term strategy. Success will not be a single decisive victory, but a steady squeeze that makes cartel operations unprofitable and unsustainable.

August 14, 2025

Iranian APTs and the Next Phase of Infrastructure Risk

In the wake of escalating tensions in the Middle East this past spring, Iranian state-sponsored hackers turned their focus toward a new frontier: US critical infrastructure.

From May through June 2025, cybersecurity telemetry revealed a 133% surge in Iran-attributed cyber activity targeting US industrial and operational technology (OT) environments. These campaigns hit transportation and manufacturing sectors, but energy and water infrastructure remain long-standing targets. While espionage remains a primary objective, the evidence increasingly suggests Iran is preparing for more overt disruption.

Strategic Escalation

Iran’s cyber posture has always mirrored its geopolitical environment. In Spring 2025, that meant responding to Israeli and US airstrikes with asymmetric cyber operations. Groups like APT33 (Elfin), APT34 (OilRig), and MuddyWater (Static Kitten) ramped up traditional espionage, while more aggressive actors like CyberAv3ngers and Fox Kitten (tied to recent Pay2Key.I2P ransomware operations) pursued OT-focused sabotage and ransomware deployment.

Iran’s messaging through pseudo-hacktivist fronts and deepening ties with ransomware operators clearly framed this activity as retaliation for “Western aggression.” That framing is part of a broader Iranian cyber doctrine that views critical infrastructure compromised as a form of coercion and deterrence.

In parallel with APT activity, pro-Iranian hacktivists ramped up operations against US defense and critical infrastructure sectors. Groups like “Mr. Hamza” claimed responsibility for defacing and leaking data tied to defense contractors, including Raytheon technologies (RTX), following US involvement in strikes against Iranian facilities. While attribution remains murky, these operations often mirror Iranian state objectives and timelines, suggesting coordination or at least ideological alignment. The targeting of US DIB entities serves Tehran’s broader goal of projecting reach and retaliation across both digital and strategic domains.

🚨 DDoS Alert 🚨

Mr Hamza claims to have targeted multiple websites

-RTX Corporation 🇺🇸
-Parsons Corporation 🇺🇸
-Kratos Defense and Security Solutions 🇺🇸
-CACI International Inc. 🇺🇸
-Ultra Group 🇬🇧
-Cobham 🇬🇧
-Serco Group plc 🇬🇧
-Elbit Systems 🇮🇱
-Israel Aerospace Industries 🇮🇱… pic.twitter.com/YGHB1tTPmt
— FalconFeeds.io (@FalconFeedsio) June 13, 2025

Pre-Positioning

Iran’s shift toward OT environments is the most significant development.

MuddyWater and APT33 continued to exfiltrate intellectual property from manufacturing and defense-adjacent industries.
CyberAv3ngers targeted water control systems and other ICS devices with their custom malware, IOControl, discovered embedded in US and allied OT environments.
Fox Kitten evolved into a ransomware-as-a-service operator with an 80% (up from 70%) profit-share for affiliates targeting the US or Israel.

Alongside collecting information, these actors are also establishing persistence. In many cases, backdoors were quietly planted and left dormant; signaling an intent for future activation should the need arise.

Actor	Affiliation	Focus	Objective
MuddyWater	MOIS	Aerospace & Defense, Utilities, Gov, Civil & NGOs	Espionage
APT33	IRGC	Aerospace & Defense, Energy, Gov, Healthcare	Espionage and Access
CyberAv3ngers	IRGC	Water, ICS, Finance	Disruption
Fox Kitten	Unkown	IT/OT Gateways	Ransomware-as-a-service
OilRig	MOIS	Finance, Gov	Credential Theft

Implications for the US DIB

Iran’s campaigns are displaying a willingness to target logistics, aerospace, and manufacturing suppliers that support US and Israeli defense sectors. The Defense Industrial Base (DIB) should expect more of this; not only from state-sponsored actors, but from criminal or hacktivist affiliates acting on behalf of Iran’s IRGC or MOIS cyber arms.

Some immediate implications:

DIB contractors should hunt for Iranian TTPs and malware like IOControl and DNSpionage.
OT segmentation, remote access policies, and endpoint hygiene are foundational.
Incident response (IR) planning must include scenario-based escalation modeling: what happens if the access Iran gains today becomes a wiper event tomorrow?

US Response: Shields Up

Initially, the federal response may have felt quieter than prior cyber alerts like those during the Ukraine conflict but the signals were still there.

On LinkedIn, Jen Easterly, former CISA Director, reactivated the Shields Up mantra within hours of US strikes on Iranian nuclear sites. Her post explicitly warned US critical infrastructure operators to expect:

Credential theft and phishing
ICS-specific malware
Wipers masquerading as ransomware
Propaganda-laced hacktivist campaigns

Easterly urged sectors to segment OT networks, patch internet-facing systems, enforce MFA, rehearse ICS isolation, and actively monitor ISAC channels.

The various critical infrastructure-related ISACs followed suit. And while no single campaign bannered over the response, the defense posture matched the moment.

Jen Easterly emphasizes the importance of cybersecurity vigilance for US critical infrastructure in response to recent Iranian cyber activities.

So What’s Next?

Iran’s recent activity represents a shift in focus, not necessarily a shift in capability. The targeting of OT environments and critical infrastructure may reflect aspirational doctrine as much as operational readiness. While there’s no conclusive evidence that Iranian actors have staged disruptive payloads in U.S. networks, the direction of their targeting and tooling, particularly the development of ICS and OT-specific malware, suggests a growing interest in operational disruption, and not just information gathering.

For the US defense and critical infrastructure communities, this creates a clear mandate to prepare for the next phase before it arrives.

Monitor beyond the perimeter: Iranian threat actors have historically gained access through default credentials, exposed devices, and lateral movements through flat networks.
Expect dual-use operations: Intelligence collection and pre-positioning are not mutually exclusive.
Reassess assumptions: Iranian groups are traditionally viewed as less sophisticated than Russian or Chinese APTs, but recent coordination and tooling suggest they’re evolving quickly.

In short, we’re seeing a doctrinal pivot. Iran is exploring offensive options in OT environments, and testing how far it can go without triggering escalation. This makes detection, attribution, and sector-wide coordination more important than ever.

References

https://www.nozominetworks.com/blog/threat-actor-activity-related-to-the-iran-conflict

https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol

https://www.cisa.gov/news-events/news/joint-statement-cisa-fbi-dc3-and-nsa-potential-targeted-cyber-activity-against-us-critical

https://therecord.media/iran-state-backed-hackers-industrial-attacks-spring-2025