# Iranian-Aligned Cyber Mobilization — 60+ Groups Targeting US Critical Infrastructure ICS/SCADA with AI-Assisted Reconnaissance Post Iran-US Escalation (Feb 28, 2026)

> Following the February 28, 2026 US-Israel strikes on Iran (Operation Epic Fury), more than 60 Iranian-aligned cyber groups mobilized within hours, forming an Electronic Operations Room on Telegram to coordinate retaliatory attacks against US critical infrastructure. Key threat actors include CyberAv3ngers (IOCONTROL malware, 75+ US ICS devices compromised), APT33/Elfin (TRITON/TRISIS capability, US energy sector targeting), MuddyWater/MERCURY (RustyWater 2026 Rust-based RAT), and APT34/OilRig. AI tools including ChatGPT have been abused for ICS/SCADA reconnaissance, sharply lowering the barrier to targeting internet-exposed industrial systems across US water, energy, and oil/gas sectors.

- **Published:** 2026-03-06T12:00:00Z
- **Last reviewed:** 2026-03-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0183
- **ID:** TL-2026-0183
- **Severity:** CRITICAL
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Actor:** Cyber Av3ngers (Iran)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Iranian-Aligned Cyber Mobilization Against US Critical Infrastructure ICS/SCADA Systems

STRATEGIC CONTEXT

On February 28, 2026, the United States in coordination with Israel launched Operation Epic Fury — a large-scale military air campaign against Iran that killed Supreme Leader Ayatollah Ali Khamenei along with several high-ranking Iranian officials. Within hours, more than 60 Iranian-aligned hacktivist and state-sponsored cyber groups activated, forming an Electronic Operations Room on Telegram to coordinate retaliatory cyber operations. Between February 28 and March 1, over 150 hacktivist incidents were claimed across open channels, targeting government, financial, aviation, telecom, and critical infrastructure in the US, Israel, and Gulf Cooperation Council (GCC) countries.

THREAT ACTOR LANDSCAPE

This campaign involves a layered threat actor ecosystem spanning Tier 1 nation-state APTs and Tier 2 state-aligned hacktivist groups:

Tier 1 — Nation-State APTs:
- APT33/Elfin (Peach Sandstorm, IRGC-affiliated): Targeting US electric utilities and oil/gas since 2013. Demonstrated TRITON/TRISIS capability for Safety Instrumented System attacks. In 2025, sharply increased credential harvesting and OT network mapping against US energy companies.
- APT34/OilRig (MOIS-affiliated): Long-dwell covert access specialists in the energy sector. Known for patient lateral movement and data exfiltration from high-value targets.
- MuddyWater/MERCURY (Mango Sandstorm, MOIS-affiliated): Deployed RustyWater — a new Rust-based RAT in early 2026 — targeting diplomatic, maritime, financial, and telecom entities. Features position-independent XOR encryption, 25+ AV/EDR evasion checks, process injection via explorer.exe hollowing, and HTTP-based C2 with triple-layer encoding (JSON > Base64 > XOR). Also deploying Dindoor backdoor leveraging Deno JavaScript runtime.
- Charming Kitten/APT35 (IRGC-IO): Intelligence collection feeding IRGC targeting operations, providing reconnaissance data for kinetic and cyber operations.

Tier 2 — State-Aligned Groups:
- CyberAv3ngers/BAUXITE (IRGC-CEC): The most operationally active ICS-targeting group. Developed IOCONTROL — a custom Linux-based IoT/OT malware using MQTT for C2, DNS-over-HTTPS via Cloudflare for resolution, and AES-256-CBC encryption. CISA confirmed 75+ US ICS devices compromised (34+ in water/wastewater sector). Actively abused ChatGPT for ICS reconnaissance including Shodan queries, default credential enumeration, Modbus TCP/IP client creation, and bash script obfuscation.
- Handala Hack Team (MOIS-aligned via Void Manticore): Deploys custom wiper malware (Hatef for Windows, Hamsa for Linux) with multi-stage delivery chains including NSIS installers, AutoIT scripts, and BYOVD exploitation. Claimed attacks against Israeli energy companies and Jordanian gas stations post-escalation.
- Additional groups: FAD Team (SCADA/PLC wiper attacks), Dark Storm Team/MRHELL112 (DDoS/ransomware), Cyber Islamic Resistance (DDoS/wiper coordination), Evil Markhors (credential harvesting), 313 Team (DDoS), DieNet (DDoS).

MALWARE ARSENAL

IOCONTROL: Custom Iranian IoT/OT cyberweapon targeting Unitronics, D-Link, Hikvision, Red Lion, Orpak, Phoenix Contact, Teltonika, and Gasboy devices. Uses MQTT protocol (ports 1883/8883) for C2 communication, DNS-over-HTTPS via Cloudflare (1.1.1.1) for domain resolution, AES-256-CBC encryption, and modified UPX packing. Persists via RC scripts (/etc/rc3.d/S93InitSystemd.sh). Supports arbitrary command execution, port scanning, self-deletion, and device information exfiltration.

TRITON/TRISIS: Industrial Safety Instrumented System (SIS) targeting malware first deployed in 2017 against a Saudi petrochemical facility. Represents the most dangerous ICS-specific capability in the Iranian arsenal — designed to cause physical destruction by disabling safety systems.

Shamoon: Destructive disk wiper that destroyed 30,000 Saudi Aramco endpoints in 2012. Remains a template for Iranian destructive operations.

RustyWater: MuddyWater's 2026 Rust-based RAT delivered via spear-phishing with malicious Word documents. Features anti-analysis (VEH registration), 25+ AV evasion checks, registry persistence (CurrentVersion\Run), HTTP-based C2 with reqwest/0.12.23, process hollowing of explorer.exe, and asynchronous operation via Rust tokio runtime.

Handala Wiper: Multi-stage wiper delivered via phishing PDFs, using NSIS > batch > AutoIT > shellcode chain. Exploits vulnerable driver (ListOpenedFileDrv) via BYOVD for privilege escalation. Overwrites files with 4,096 bytes of random data.

AI-ASSISTED RECONNAISSANCE

OpenAI confirmed in October 2024 that CyberAv3ngers abused ChatGPT for ICS reconnaissance, including: generating Shodan queries for exposed industrial devices, enumerating default credentials for Tridium Niagara and Hirschmann devices, creating Modbus TCP/IP clients programmatically, developing network scanning scripts, obfuscating bash exploitation scripts, and querying industrial router geographic deployment patterns. This represents a significant lowering of the barrier to ICS/SCADA targeting.

ATTACK SURFACE

The ICS/SCADA attack surface has expanded dramatically: OT/ICS internet exposure increased 35% year-over-year in H1 2025, Unitronics port 20256 exposure surged 160% despite CISA advisories, and over 40,000 internet-exposed control systems are documented globally. CyberAv3ngers specifically target devices with default credentials (Unitronics default password "1111") and unauthenticated web interfaces.

TARGETED SYSTEMS

Primary targets include: Unitronics Vision Series PLCs (port 20256), Siemens SIMATIC CP 343-1 (unauthenticated web interfaces), Tridium Niagara devices, Hirschmann RS industrial routers, Orpak/Gasboy fuel management systems, and generic Modbus TCP (port 502) devices. Affected sectors: US water/wastewater, electric utilities, oil/gas, manufacturing, telecommunications, healthcare, and government.

ASSESSMENT

This represents the most significant coordinated Iranian cyber campaign against US critical infrastructure to date. The combination of Tier 1 APTs with pre-positioned access, Tier 2 groups with demonstrated ICS exploitation capability, AI-lowered barriers to reconnaissance, and an expanding attack surface of exposed industrial systems creates a high-confidence assessment of imminent destructive cyber operations against US ICS/SCADA infrastructure. The Electronic Operations Room coordination mechanism enables rapid target handoff between reconnaissance groups and exploitation teams.

---

**Revalidated on 2026-03-12**

Six days after initial publication, this threat has escalated from theoretical mobilization to confirmed destructive operations against major US enterprises. The Handala Hack wiper attack on Stryker Corporation on March 11, 2026 represents a watershed moment — the first confirmed destructive cyberattack by an Iranian-linked actor against a major US company since Operation Epic Fury began. Handala claims 50TB of exfiltrated data and 200,000+ wiped systems across 79 countries, causing total operational shutdown of a $100B+ medical technology company. This attack validates the original assessment that Iranian state-aligned groups would progress from DDoS and defacement to destructive wiper operations.

Simultaneously, Symantec's March 5 disclosure of MuddyWater's pre-positioned access inside a US bank, US airport, and defense/aerospace software company via the novel Dindoor backdoor confirms that Tier 1 APTs had established footholds inside US critical infrastructure weeks before the kinetic strikes began. The Dindoor backdoor leverages the Deno JavaScript/TypeScript runtime for command execution, while the companion Fakeset Python backdoor was found on airport networks — both signed with certificates (Amy Cherne, Donald Gay) previously linked to MuddyWater. Data exfiltration attempts using Rclone to Wasabi cloud storage were observed at the software company.

The US government response has intensified significantly. CISA, FBI, DC3, and NSA published a joint statement specifically addressing Iranian cyber threats to US critical infrastructure. The US intelligence community issued private warnings the week of March 10 to companies and agencies, with DHS specifically warning about 'ongoing claims and calls for cyber attacks targeting US entities by Iranian-aligned groups' against the financial services sector. However, CISA is critically under-resourced, operating at roughly 38% staffing capacity with its temporary director reassigned.

Proofpoint confirmed TA453 (Charming Kitten/APT42) conducted credential phishing against a US thinktank on March 8, demonstrating that IRGC intelligence collection operations persist despite Iran's near-total internet blackout (1-4% connectivity since Feb 28). Halcyon's assessment is that Iran is 'actively weighing destructive cyber operations as a retaliatory vector,' with MuddyWater conducting a structured offensive designated Operation Olalampo targeting the META region.

The Russia-Iran hacktivist convergence has materialized as predicted: NoName057(16) teamed with Iranian hacktivists on March 2 to target Israeli defense organizations including Elbit Systems, and Z-Pentest claimed ICS/SCADA compromises at multiple US entities. SOCRadar recorded over 600 distinct cyberattack claims across 100+ Telegram channels within 15 days. The Dragos 2026 OT Cybersecurity Year in Review confirms BAUXITE (CyberAv3ngers) deployed two custom wiper variants against Israeli targets during the June 2025 conflict — establishing a clear escalation pattern now extended to US targets. CloudSEK documented 182,200 internet-exposed industrial assets in the US, and CSIS analysis characterizes Iran's cyber ecosystem as deliberately designed to 'deputize hacktivist proxies in state actions without state attribution,' with the current activation representing the largest-scale deployment of this architecture in history.

Threat status remains CRITICAL with active exploitation confirmed. The progression from hacktivist DDoS to APT pre-positioning to confirmed destructive wiper attacks on US enterprises validates the highest assessment level.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1589 Gather Victim Identity Information
- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1140 Deobfuscate/Decode Files or Information
- T1110 Brute Force
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration
- T1561 Disk Wipe
- T1485 Data Destruction
- T1491 Defacement
- T1531 Account Access Removal
- T1565 Data Manipulation
- T1499 Endpoint Denial of Service

## Sources

- [CloudSEK — AI, the Iran-US Conflict, and the Threat to US Critical Infrastructure](https://www.cloudsek.com/blog/ai-the-iran-us-conflict-and-the-threat-to-us-critical-infrastructure)
- [CISA Advisory AA23-335A — IRGC-Affiliated Cyber Actors Exploit PLCs](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a)
- [Palo Alto Unit 42 — Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/)
- [Canadian Centre for Cyber Security — Iranian Cyber Threat Response to US/Israel Strikes](https://www.cyber.gc.ca/en/guidance/cyber-threat-bulletin-iranian-cyber-threat-response-usisrael-strikes-february-2026)
- [Claroty Team82 — Inside a New OT/IoT Cyberweapon: IOCONTROL](https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol)
- [CloudSEK — Reborn in Rust: MuddyWater Evolves Tooling with RustyWater Implant](https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant)
- [Splunk — Handala Wiper Threat Analysis and Detections](https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html)
- [CNBC — The Lead US Cyber Agency Is Stretched Thin as Iran Hacking Threat Escalates](https://www.cnbc.com/2026/03/03/iran-cisa-cybersecurity-war-threat.html)
- [Nextgov — Intelligence Firms Watch for Uptick in Iran Cyber Activity After US-Israel Strikes](https://www.nextgov.com/cybersecurity/2026/03/intelligence-firms-watch-uptick-iran-cyber-activity-after-us-israel-strikes/411802/)
- [Fortune — Iran Could Use AI to Accelerate Cyberattacks on US and Israeli Critical Infrastructure](https://fortune.com/2026/03/02/iran-ai-powered-cyberattacks-risks-us-infrastructure/)
- [CloudSEK — Middle East Escalation Situation Report](https://www.cloudsek.com/blog/middle-east-escalation-israel-iran-us-cyber-war-2026)
- [Arctic Wolf — Heightened Cyber Risk Following February 2026 US/Israel-Iran Escalation](https://arcticwolf.com/resources/blog/heightened-cyber-risk-following-february-2026-us-israel-iran-escalation/)
- [MITRE ATT&CK — APT33 (G0064)](https://attack.mitre.org/groups/G0064/)
- [CISA — Iran Threat Overview and Advisories](https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran)
- [SOCRadar — Cyber Reflections: US-Israel-Iran War](https://socradar.io/blog/cyber-reflections-us-israel-iran-war/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0183