Iran Cyber Threat Intelligence Center

Situation Overview

Bottom Line Up Front -- from the Iran Conflict Situation Report v1.5, published April 7, 2026

Sector Risk Assessment

Respond Now

Immediate actions and detection queries you can deploy today.

Immediate Actions (0-48 Hours)

From the Iran Conflict Situation Report, Section 8: Action Response Framework

1. 1
   Elevate SOC to 24/7 operations with dedicated Iranian threat monitoring shift

   CISO High Effort
2. 2
   Deploy emergency detection rules for Iranian APT TTPs. Prioritize Lemon Sandstorm VPN exploitation indicators, Agrius wiper signatures, and MuddyWater Operation Olalampo malware families

   SOC Med Effort
3. 3
   Emergency patch all internet-facing VPN appliances (Fortinet, Pulse Secure, Citrix, Palo Alto) — Lemon Sandstorm's primary initial access vector

   IT Ops High Effort
4. 4
   Review and enforce MFA on all critical systems, particularly OT/ICS jump hosts, VPN concentrators, and cloud admin portals

   IT Ops Med Effort
5. 5
   Activate incident response retainer with external forensics provider; confirm SLA and escalation contacts

   CISO Low Effort
6. 6
   Verify offline backup integrity for critical systems; test restoration procedures for wiper scenario

   IT Ops Med Effort
7. 7
   NEW Audit cloud infrastructure for single-region dependencies on Middle East availability zones (AWS me-south-1, me-central-1). Verify multi-region failover is active and tested

   Cloud/DevOps High Effort
8. 8
   NEW Review disaster recovery plans for cloud-hosted services. Ensure RPO and RTO account for complete facility loss, not just software failure

   CTO / Cloud Arch Med Effort
9. 9
   NEW Harden enterprise device management platforms (Microsoft Intune, SCCM, Jamf, Google Workspace MDM). Restrict remote wipe permissions to dedicated admin accounts with hardware-bound MFA. Monitor for anomalous MDM commands. Segment MDM administrative access from general IT infrastructure

   IT Ops / Security High Effort
10. 10
    NEW Assess GPS-dependent operational systems for spoofing resilience. Review navigation, timing, logistics, and financial transaction systems that rely on GNSS signals

    IT Ops / OT Med Effort
11. 11
    NEW Take ICS/SCADA interfaces off the internet immediately. Change default credentials on all PLCs and HMIs. Block industrial protocol ports (TCP 20256, 102, 502, 44818)

    OT / IT Ops High Effort
12. 12
    NEW Audit RMM platform access and patch SolarWinds N-central (CVE-2025-9316). Review all remote management tool installations for unauthorized instances

    IT Ops / SOC High Effort
13. 13
    NEW Build pre-approved communications protocols for responding to Telegram breach claims before journalists call. Do not assume CISA early warning is functioning at normal capacity; establish independent threat intelligence sources

    CISO / Comms Med Effort
14. 14
    NEW Treat any ransomware incident in targeted sectors as a potential wiper until proven otherwise. Preserve forensic evidence before assuming criminal intent

    SOC / IR Med Effort

Featured Hunting Queries

Copy-paste ready detection queries. One from each threat actor's hunting guide.

AuditLogs
| where LoggedByService == "Intune"
| where OperationName has_any ("Wipe", "Retire", "Reset", "remoteLock", "cleanWindowsDevice", "windowsDefenderScan")
| project TimeGenerated, OperationName, InitiatedBy.user.userPrincipalName, TargetResources[0].displayName, Result
| sort by TimeGenerated desc

let C2Domains = dynamic([
    "apps.gist.githubapp.net", "githubapp.net",
    "api.gupdate.net", "gupdate.net",
    "login.forticloud.online", "fortigate.forticloud.online",
    "cloud.sophos.one"
]);
DnsEvents
| where Name has_any (C2Domains)
| extend AlertSeverity = "High"
| project TimeGenerated, ClientIP, Name, QueryType, AlertSeverity
| sort by TimeGenerated desc

title: Suspicious .NET Executable in Windows Temp Staging Directory (Agrius)
id: b2c3d4e5-f6a7-8901-bcde-a91105000001
status: experimental
description: |
    Detects .NET executables created in the Windows temp staging
    directory C:\windows\temp\s\, a known Agrius wiper deployment location.
logsource:
    category: file_event
    product: windows
detection:
    selection_staging_dir:
        TargetFilename|startswith: 'C:\windows\temp\s\'
        TargetFilename|endswith:
            - '.exe'
            - '.dll'
    selection_tool_names:
        TargetFilename|endswith:
            - '\sql.net4.exe'
            - '\systems.exe'
            - '\IPsecHelper.exe'
    condition: selection_staging_dir or selection_tool_names
falsepositives:
    - Legitimate software installation to temp directories
level: high

let MuddyWaterRMM = dynamic([
    "AteraAgent.exe", "ScreenConnect.ClientService.exe",
    "SimpleHelp.exe", "AnyDesk.exe", "Syncro.Overmind.Service.exe",
    "RemoteUtilities.exe", "rutserv.exe", "rfusclient.exe",
    "level-windows-amd64.exe", "PDQConnect.Agent.exe"
]);
DeviceProcessEvents
| where FileName in~ (MuddyWaterRMM)
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, AccountName
| sort by Timestamp desc

Full detection libraries available in the hunting guides below.

Stay Informed on the Iran Cyber Conflict

Subscribe to Intruvent Edge for ongoing threat intelligence updates as the situation evolves.

You'll receive Intruvent Edge, our free bi-weekly threat intelligence newsletter. Unsubscribe anytime.