MDR
Solutions
Partners
About
Resources
Recent intelligence highlights a shift toward more targeted and operationally relevant cyber activity linked to Iranian threat actors.
OT / ICS Targeting Intensifies
Activity has become more focused on specific industrial environments, particularly Rockwell and Allen-Bradley systems. Cyber Av3ngers / Storm-0784 is now directly associated with targeting Rockwell Automation equipment. Increased global exposure of related SCADA IPs since early April signals a defined and actionable attack surface for operators.
Strategic Data Leak Activity Escalates
A group calling itself “Sumud Cyber Command” claims to have exfiltrated ~15.9TB of data from INSS. If verified, this marks a shift toward high-impact intelligence leaks used for both strategic insight and psychological pressure.
Connectivity Restoration Enables Activity
Partial restoration of internet access via Iran’s National Information Network is supporting a more consistent operational tempo, with increased activity observed since 8 April.
Psychological and Human-Focused Targeting
Groups such as Handala are prioritising coercive exposure, including alleged leaks of personnel data and private communications. This reflects a shift toward human-layer targeting and reputational pressure.
Emerging Spillover Risks
Unverified claims beyond the core conflict region suggest experimentation with broader or symbolic targets.
Outlook
The threat landscape remains mixed, but immediate risk is driven by phishing, credential theft, exposed systems, and abuse of legitimate access.
.jpg)
A ceasefire has been announced; however, cyber activity continues to escalate. The threat landscape has shifted toward the cyber-physical domain, with state-affiliated actors targeting Operational Technology (OT) and industrial control systems. This activity now extends beyond web disruption to include attempts to manipulate infrastructure and exploit logistics data.
Targeting of Industrial Systems
Programmable logic controllers (PLCs), particularly Rockwell Automation/Allen-Bradley systems, are being actively targeted. Threat actors are interacting with project files and manipulating data on HMI and SCADA systems, resulting in disruptions across water, energy, and government sectors. This reflects a clear intent to cause physical and financial impact.
Iran Infrastructure Breach
A breach of Iran’s national oil distribution network has exposed approximately 15GB of sensitive data, including customer and operational information. This increases the risk of follow-on attacks, as such data can be used to map and target critical infrastructure.
Mitigation Priorities
Organizations should prioritize securing OT environments by:
Handala Activity
The Handala group has escalated operations toward psychological and information campaigns. Reported activities include municipal system compromise, exposure of military personnel data, and large-scale data wiping. The group is leveraging enterprise tools and mesh networking to enable coordinated disruption and targeted intimidation.
The conflict remains cyber-active, but the most important recent changes are around where spillover risk is concentrating, how Handala is sustaining pressure, and what types of activity are becoming more operationally relevant.
Current tracking now shows:
Primary targets include:
Israel, Kuwait, Bahrain, Cyprus, Jordan, Qatar, the UAE, and the U.S.
While DDoS still dominates, the activity now also includes:
This reinforces that this is no longer just a web-disruption story.
GCC Spillover Risk
The clearest regional development is that spillover risk across the Gulf is sharpening, especially for:
The GCC threat level is now assessed as critical, with:
Handala Activity
For Handala, the group remains active despite earlier disruption to its infrastructure.
Most recently, it posted a 22TB wiper claim against 14 Israeli companies, although this should still be treated as an attacker claim rather than an independently confirmed destructive incident.
More broadly, newly disclosed critical vulnerabilities and zero-days should now be treated as potentially relevant to this threat environment, particularly where they affect:
Immediate Risk
The most actionable short-term risks remain:
Recent claims attributed to Handala include:
.local domain environment indicates a domain-connected network, raising the potential for broader compromise beyond a single user.Taken together, this activity reinforces a continued focus on U.S. commercial and operational targets.
Immediate Risk: Phishing and Credential Theft
Despite attention on disruption and leak activity, the most immediate and actionable threat remains:
Threat actors are increasingly leveraging conflict-related themes to enhance credibility, including:
These campaigns are likely to target organisations across defence, energy, telecoms, logistics, customs, and Gulf-linked sectors.
Operational Implications
Organisations should assume ongoing targeting and prioritise:
Assessment
Handala activity reflects sustained intent rather than isolated incidents. While not all claims are substantiated, the combination of plausible access in select cases and ongoing targeting patterns indicates continued operational risk, particularly through credential-based intrusion pathways.
Current activity extends beyond hacktivist-style disruption. While high-volume DDoS and public claims remain the most visible layer, these are accompanied by:
This reflects a shift from isolated disruption to multi-layered pressure, where visible activity does not represent the full extent of risk.
Strategic Targeting Remains Consistent
Threat actors continue to prioritise organisations with geopolitical, economic, and operational relevance.
Primary areas of focus include:
Most exposed sectors:
Even where individual incidents are unverified or short-lived, targeting patterns remain consistent and deliberate.
Coercive Leak and Doxxing Activity Increasing
Hack-and-leak and doxxing operations are being used as tools of pressure rather than purely technical outcomes.
Recent patterns indicate objectives including:
Technical confirmation is not required for these operations to achieve impact, reinforcing the role of perception and influence.
No Confirmed Large-Scale Destructive Activity
There is currently no publicly confirmed destructive cyber incident comparable to previous large-scale events.
Instead, the environment is characterised by:
The overall threat level remains elevated, driven by persistent activity rather than a single high-impact event.
Assessment
The key development is a structural shift toward sustained, multi-layered cyber pressure. Organisations should expect continued regional spillover, consistent strategic targeting, and increasing use of influence-driven tactics alongside technical operations.
.png)
