Operation Epic Fury : Iran vs. Israel & US Cyber War

Iran conflictUS–Israel ConflictCyber Warfare

On February 28, 2026, the United States and Israel launched Operation Epic Fury a coordinated military and cyber campaign targeting Iran's military command, missile infrastructure, and senior IRGC leadership. The operation triggered an unprecedented, multi-vector cyber conflict spanning 22+ countries, involving Iranian state-sponsored APT groups, pro-Iranian hacktivist coalitions, and Russian-aligned threat actors.

Indicators of Compromise

Domains (623)

alwtania2.comalwatanniya.comdallmonfish.comtgsprem.online6b4s.popmonster.rudelmoon5.comproxy5.signalplus.orgtameeeny.comzain-kw.protamcar.proupdate.usproxy1.signalplus.orgsvans.onlineel-watnneya.comvib2.mytexno.comuptime-timezone.dns-dynamic.neviliam.ude-final.onlinewwindows.datawww.atomicmatryoshka.comproxy6.signalplus.org+603 more

Hashes (2678)

158f85554fe9f198070cee766c610aa0e5efca663816c7f9e7b24692e8d90be710223fe7865a861242a50f2d431ec44236f320d94f3cd9296f6ff3fcfa1124570426f65ea5bcff9e0dc48e236bbec293380ccc43c53470eb1bc24d7e2a9da1d96f6beea00781390821fe76ab50f93aa41bec64fb9082f142c48dde73885e7ca75bad1121fb77e7f23fbf3ce1a9b452421970810bd6b6b37afe5520783f715549cc3c4df9deaf89bfc79d85d0b9175cb86ce032543fe6b0d578e4975dc56e62226f4c56850efb452b9d6c79c0b395cceb83662aa3f7ed01236144:/f5ry+5qfrtatbpsqp50rr6shbtciroh1l46kil:/9bq1atlfpymszboua31166a45d5fda928a1f5d92b60a317282528a98504df60dd570fa7d6ad38f5316646a125505b1bbf7f2c484a879660b2767b21ae591b79219b19cd24f85efbf1ecc802360bdd2ab2a153df1d841552a6889acf01f974d7634103536e524a41a79046785ca7ae3d6+2658 more

IPv4 (219)

5.106.153.24595.179.207.105182.42.110.255194.61.120.185183.134.59.131146.19.254.23891.92.243.10289.116.111.143172.121.129.9045.142.212.201180.153.236.35180.153.236.48128.199.237.132109.125.132.66185.177.72.1137.255.251.1762.106.66.11231.57.35.223194.11.246.101180.153.236.12+199 more

APT Groups

Z-Pentest

APT-IRAN

Team Fearless

Morning Star

Islamic Hacker Army

DarkStorm Team

null

NoName057

APT42

Fox Kitten

Professor6T9

null

Cyber Av3ngers

PalachPro

Tortoiseshell

313 Team

CHRYSENE

HackHax

SYLHET GANG-SG

APT39

MAGNALLIUM

Nation Of Saviors (NOS)

AnonymousBsns

France

MuddyWater

Keymous+

Moroccan Black Cyber Army

Babayo Error System

RipperSec

DieNet

Notes

<div class="content-body">Conclusion Sixty-nine days into Operation Epic Fury, the Iran–US–Israel cyber conflict has far exceeded initial scope projections. What began as a bilateral military campaign has become a 54-country, 1,583-claim, multi-actor cyber war involving state APTs, MOIS-linked hacktivists, Russian-aligned groups, Southeast Asian coalitions, and now a counter-coalition of pro-Israeli actors across the Philippines, India, and Kurdish territories.<div>Four findings define the current threat landscape for security teams:<ul style="margin-top:0;margin-bottom:0;"><li style="list-style-type: disc; font-size: 10pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Pre-positioned access is the primary strategic threat. MuddyWater's March 6 backdoor activation proves the model: compromise during peacetime, activate during crisis. This is not a vulnerability to patch — it is a posture to continuously hunt against. Every organization connected to any supply chain touching the conflict zone must treat its environment as potentially already hosting dormant access.</li><li style="list-style-type: disc; font-size: 10pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">ICS/OT is no longer a future risk — it is a present one. Water treatment systems in the United States and South Korea, grain silos in Israel, and air-raid siren systems have all been the subject of technically credible access claims with video proof in this conflict. The ICS threat model must be updated immediately: the question is not 'could an adversary access this?' but 'what is our response when they demonstrate it tomorrow?'</li><li style="list-style-type: disc; font-size: 10pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">The IRGC's April 1 tech company designation is a strategic escalation signal. Formally naming Apple, Microsoft, Google, Meta, Nvidia, Boeing, and 12 other major US companies as military targets is unprecedented. The downstream risk extends to every organization in the supply chain, customer base, or partner ecosystem of these companies.</li><li style="list-style-type: disc; font-size: 10pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Handala is an intelligence and destruction engine operating at nation-state tempo. In 69 days it has breached an air defense C2 designer, doxxed a former intelligence chief with 14GB of documents, wiped 22TB of data, and breached the FBI Director's personal communications. Despite an FBI domain seizure and the killing of its MOIS handler, it has accelerated rather than slowed. Organizations should monitor Handala's Telegram pre-announcements as a leading indicator of the next major operation.</li></ul> This campaign remains active with no de-escalation in sight as of May 7, 2026. IOC blocklists should be refreshed weekly. The SOCRadar Iran-Israel Cyber Conflict Dashboard provides real-time updates. Incident response plans should be tested and ready — particularly for wiper scenarios, ICS breach, and mass MDM device wipe contingencies.<div> </div></div> </div>

Mitigation

Mitigation Recommendations Threat Hunt for Pre-Planted Backdoors — Immediate Priority Given MuddyWater's confirmed pre-planted backdoor strategy, every organization with exposure to Middle Eastern operations, US government supply chains, or defense-adjacent work should treat their environment as potentially already compromised.<ul style="color: rgb(192, 57, 43); font-size: 13pt; margin-top: 0px; margin-bottom: 0px;"><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Enable PowerShell ScriptBlock logging (Event ID 4104) immediately if not active — MuddyWater loaders will be visible in this log</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Hunt registry run keys and scheduled tasks created in last 90–180 days masquerading as system services</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Monitor all outbound server-process connections to OneDrive, Dropbox, Google Drive — flag as anomalous</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Deploy Sigma rule 7.1 in SIEM at HIGH priority; any hit requires immediate escalation</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Run YARA rule 6.2 against all Windows servers in production environments</li></ul><div style=""> ICS/OT Emergency Actions Given the escalating credibility of ICS access claims — water treatment (US and South Korea), silo control (Israel), air-raid sirens (Israel) — treat OT exposure as an active, not theoretical, threat.<ul style="color: rgb(192, 57, 43); font-size: 13pt; margin-top: 0px; margin-bottom: 0px;"><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Immediately verify no ICS/SCADA HMI panels are reachable from public internet — use Shodan/Censys to check your own ASN</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Block all inbound traffic on Modbus (502), S7comm (102), DNP3 (20000), and EtherNet/IP (44818) from non-authorized sources at perimeter firewall</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Deploy Sigma rule 7.5 in your OT network monitoring infrastructure</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Implement one-way data diodes for all OT-to-IT data flows; remove bidirectional links where possible</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Review and revoke all remote access paths to engineering workstations and HMI panels; require VPN + MFA for any authorized remote OT access </li></ul><div style="">Microsoft Intune & MDM Security (Anti-Wiper) Handala's Stryker attack abused Microsoft Intune to wipe 200,000+ devices. This attack vector requires specific mitigations distinct from traditional endpoint security.<ul style="color: rgb(192, 57, 43); font-size: 13pt; margin-top: 0px; margin-bottom: 0px;"><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Enforce Conditional Access policies restricting Intune admin operations to named IP ranges and MFA-verified sessions</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Implement approval workflows for bulk device wipe operations — single-admin authorization is insufficient</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Deploy Sigma rule 7.2: alert on any Intune wipe operation count >50 within 1 hour</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Audit all Intune admin accounts immediately; remove unused or excessive permissions</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Enable Intune audit logging and route to SIEM</li></ul><div style=""> </div><div style="">DDoS Resilience — Scaled to 1,583+ Claims <ul style="color: rgb(192, 57, 43); font-size: 13pt; margin-top: 0px; margin-bottom: 0px;"><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Engage CDN/DDoS scrubbing provider (Cloudflare, Akamai, AWS Shield Advanced) for all public-facing infrastructure</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Configure rate limiting at application layer: block IPs generating >100 requests/min on government and utility portals</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Enable geo-based rate limiting for high-risk origin countries (Russia, Iran, Indonesia, Bangladesh, Malaysia)</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Ensure BGP failover routes are configured and tested — telecom and transit infrastructure has been targeted</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">For organizations named in IRGC's April 1 designation: escalate DDoS preparedness to maximum posture immediately</li></ul><div style=""> Credential & Access Hardening <ul style="color: rgb(192, 57, 43); font-size: 13pt; margin-top: 0px; margin-bottom: 0px;"><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Force immediate password resets for all privileged accounts — assume credential exposure from 8.3M Israeli voter records, 300K Ministry of Education records, lawyers databases, and ongoing leaks</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Enforce MFA on all VPN, OWA, SharePoint, cloud console, and Intune admin access — mandatory, no exceptions</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Disable legacy authentication protocols; implement Conditional Access blocking basic auth</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Audit all OAuth grants and service account permissions in Azure AD / Google Workspace; revoke unauthorized third-party app access</li></ul><div style=""> </div>Threat Intelligence Monitoring <ul style="margin-top:0;margin-bottom:0;"><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Block all IOCs from Section 5 at firewall, DNS, proxy, and EDR within 24 hours — IOC list is live and growing</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Monitor SOCRadar Iran-Israel Cyber Conflict Dashboard daily: https://socradar.io/iran-israel-cyber-conflict-dashboard/</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Track Handala Telegram channels for pre-announcement posts — Handala typically signals major operations 12–24 hours in advance</li><li style="list-style-type: disc; font-size: 10pt; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Subscribe to IRGC-linked threat actor feeds; the April 1 tech company designation signals a shift to higher-value targets</li></ul></div></div></div></div><div class="content-container"><ul> </ul> </div>