DEV Community

Elijah N
Elijah N

Posted on • Originally published at theboard.world

Iran Cyber Attacks 2026: APT33, APT35 Targeting US Banks &

#middleeast #defense #security #iran

Iran Cyber War 2026: The Invisible Front in the Hormuz Conflict

When the US-Iran kinetic exchange began on February 28, 2026, the visible theater was the Strait of Hormuz: missiles, tankers, carrier strike groups, and crude prices moving in real time across Bloomberg terminals worldwide.

The invisible theater — the one that may produce more lasting damage to the United States — is digital. And it was already well underway.

Iranian state-sponsored cyber operations against US critical infrastructure did not begin with the Hormuz conflict. They began, by most credible accounts, in 2011–2012 with the first intrusions into US financial institutions' distributed denial-of-service resilience. They accelerated through a decade of sandboxed experimentation, capability development, and strategic positioning. The conflict that started in February 2026 did not create Iran's cyber threat to the United States — it activated capabilities that had been patiently developed and positioned over fifteen years.

This is the comprehensive assessment of where those capabilities stand, how they are being deployed, and what the United States is doing — and failing to do — to defend against them.

Key Findings

  • APT33 and APT35 (Iranian state-sponsored groups, also known as Refined Kitten and Charming Kitten respectively) have been operating against US, Israeli, and Gulf targets continuously since at least 2012
  • Operation Ababil (2012–2013): Iranian DDoS attacks against US banks (JPMorgan, Bank of America, Wells Fargo) disrupted online banking for tens of millions of customers — the first major Iranian cyber offensive against the US financial sector
  • Shamoon malware: Destroyed approximately 35,000 computers at Saudi Aramco in 2012 and has been deployed in multiple subsequent variants; the threat to US energy infrastructure is considered analogous
  • 2026 post-strike activity: CISA (Cybersecurity and Infrastructure Security Agency) issued an Emergency Directive on March 3, 2026 warning of "heightened threat of Iranian-affiliated cyberattacks against US critical infrastructure sectors" — the first such directive since 2020
  • Water system vulnerability: The 2021 Oldsmar, Florida water plant attack — in which an unknown actor raised sodium hydroxide levels to dangerous concentrations via remote access — was attributed to Iranian-affiliated actors by some officials; it established the playbook for infrastructure sabotage below the kinetic threshold
  • Healthcare sector: Iranian actors are confirmed to have maintained persistent access inside at least 6 US hospital networks since 2023, per FBI testimony; these represent potential assets for ransomware or destructive attacks during escalation
  • Financial sector: FS-ISAC (Financial Services Information Sharing and Analysis Center) raised its threat level to Critical on March 1, 2026 — the first Critical designation for Iranian threat since the Operation Ababil era

Who Are APT33 and APT35?

APT33 — Refined Kitten

APT33 is assessed by Mandiant (now part of Google Cloud Security), Microsoft, and the US intelligence community as operating under the direction of Iran's Islamic Revolutionary Guard Corps (IRGC) Intelligence Organization. The group has been active since approximately 2013.

Primary targets: Aviation, petrochemical, and energy sector companies in the United States, Saudi Arabia, South Korea, and the UK. APT33 has demonstrated particular interest in industrial control systems (ICS) and SCADA environments — the software that controls physical infrastructure like pipelines, refineries, and power plants.

Signature capabilities:

  • DROPSHOT/SHAPESHIFT: A sophisticated dropper malware used to stage secondary payloads
  • TURNEDUP: A custom backdoor providing persistent access and command-and-control capability
  • STONEDRILL and SHAMOON variants: Wiper malware designed to destroy data and render systems inoperable — not ransomware seeking payment, but pure destructive capability
  • Spear-phishing infrastructure: APT33 operates an extensive network of fake recruitment websites, credential-harvesting portals, and malicious document delivery systems targeting specific organizations

Distinctive characteristic: Unlike Chinese APT groups, which primarily conduct espionage for economic and intelligence gain, APT33 has demonstrated willingness to conduct destructive attacks. This is the key threat: not data theft, but infrastructure destruction.

"APT33 is not trying to steal your intellectual property. They're trying to understand how to turn off your refinery, your pipeline, or your power plant — and then waiting for the political order to do it." — John Hultquist, Vice President of Intelligence Analysis, Mandiant/Google Cloud Security, testimony to Senate Armed Services Committee, March 2026

APT35 — Charming Kitten / PHOSPHORUS

APT35 operates under the direction of Iran's Ministry of Intelligence (MOIS) rather than the IRGC — a meaningful distinction that indicates separate command chains and sometimes competing priorities.

Primary targets: Journalists, human rights activists, academics, defense researchers, US government officials, and their personal accounts. APT35's signature is targeted espionage against individuals with access to strategically valuable information.

Signature capabilities:

  • Spear-phishing via fake Google/Microsoft login pages: Highly convincing credential-harvesting infrastructure with responsive design and anti-bot detection
  • POWERSTAR/GorjolEcho: PowerShell-based backdoors delivered via cloud storage services (Google Drive, Dropbox, OneDrive)
  • WhatsApp and Signal attack vectors: APT35 has pioneered mobile-vector attacks using social engineering to extract authentication codes and session tokens from encrypted messaging platforms
  • Conference and think-tank impersonation: Invitations to fake academic conferences, policy seminars, and media interviews that deliver malware or harvest credentials

2026 activity: Microsoft's MSTIC (Microsoft Threat Intelligence Center) issued an advisory on March 5, 2026 identifying APT35 campaigns targeting US State Department officials, think-tank researchers working on Iran policy, and journalists covering the Hormuz conflict. The campaigns began approximately 72 hours before the February 28 strikes — suggesting pre-positioned operation launch synchronized with the anticipated kinetic action.

The Shamoon Precedent: Infrastructure Destruction at Scale

To understand the severity of the Iranian cyber threat, one must understand Shamoon.

On August 15, 2012 — the holiest night in the Islamic calendar, Laylat al-Qadr — a wiper malware known as Shamoon (or Disttrack) began executing on computers at Saudi Aramco, the world's largest oil producer. The malware, which had been inserted weeks earlier through a spear-phishing email to a company employee, had three components: a spreader (to replicate across the network), a wiper (to overwrite master boot records and file systems), and a reporter (to notify command-and-control of successful infection).

In approximately 7 hours, Shamoon destroyed the data on 34,841 computers — roughly 75% of Aramco's corporate PC fleet. The company lost access to email, document systems, HR systems, and internal communications. For 10 days, Aramco employees could not use computers. The company resorted to typewriters and fax machines.

The critical point: Shamoon did not attack Aramco's operational technology (OT) systems — the SCADA systems that actually control oil extraction, processing, and pumping. If it had, the physical consequences would have been catastrophic. The attack was devastating to the corporate IT environment but deliberately contained before the physical infrastructure layer.

Analysts believe this containment was intentional — a demonstration of capability rather than full deployment. The message: we got inside, we destroyed what we chose to destroy, and we chose not to go further — this time.

Subsequent Shamoon variants (Shamoon 2 in 2016, Shamoon 3 in 2018) confirmed that Iran had maintained and evolved this capability over years. The 2018 Shamoon 3 campaign targeted Italian oil company Saipem, which was operating in Saudi Arabia, and destroyed files on approximately 400 servers and 100 personal computers — again stopping short of OT systems.

[CHART: Timeline of Iranian cyber operations 2012–2026 — showing major campaigns, targets, attribution confidence, and apparent strategic intent for each]

Attack Vectors: How Iranian Cyber Operations Penetrate US Systems

1. Spear-Phishing: The Dominant Vector

Nearly every documented Iranian APT intrusion has begun with a spear-phishing email. This is not laziness — it is rational optimization. Spear-phishing is cheap, scalable, and highly effective against even sophisticated targets.

Iranian spear-phishing has grown significantly more sophisticated since the early campaigns of 2012–2014. Modern APT33 and APT35 campaigns use:

  • Vendor impersonation: Emails mimicking trusted suppliers, IT vendors, or HR software platforms that targets interact with regularly
  • Multi-stage delivery: Initial email contains no malicious payload — only a legitimate-looking link to a document. The malicious payload is delivered only after the target has engaged with the document, reducing automatic scanning detection
  • Language model-crafted content: Since approximately 2024, Iranian phishing emails have shown markedly improved English-language quality and contextual relevance, consistent with AI-assisted content generation
  • Mobile-first attacks: Targeting personal Gmail, Outlook, and iCloud accounts (not corporate email) to bypass corporate security stack

2. Credential Stuffing and Password Spray

Iranian actors have been documented purchasing or obtaining credential dumps from dark web markets and running automated credential-stuffing attacks against corporate VPN portals, remote access systems, and cloud service login pages. Microsoft's MSTIC identified approximately 7,600 credential-spray attempts per day attributable to APT35 against O365 tenants in the healthcare and financial sectors during the first week of March 2026.

3. SCADA and Industrial Control System Vulnerabilities

This is the threat that keeps critical infrastructure security professionals awake at night.

SCADA (Supervisory Control and Data Acquisition) systems control physical infrastructure: power plant turbines, water treatment chemical dosing, pipeline pressure regulation, oil refinery process control. These systems were largely designed in the 1980s and 1990s with zero security — they were expected to be physically isolated ("air-gapped") from any internet-connected network.

They are no longer air-gapped. Economic pressure has driven operators to connect OT systems to corporate IT networks for remote monitoring, predictive maintenance, and operational efficiency. The consequence is that vulnerabilities in internet-connected corporate networks can, under the right circumstances, provide a pathway to physical infrastructure control.

Iranian actors have demonstrated awareness of and interest in specific ICS/SCADA platforms. A 2023 CISA advisory attributed to Iranian actors the active scanning of Programmable Logic Controllers (PLCs) manufactured by Siemens, Schneider Electric, and Rockwell Automation — the three dominant vendors in US critical infrastructure.

The Oldsmar Precedent: On February 5, 2021, an operator at the Oldsmar, Florida water treatment plant watched his cursor move across the screen and someone else's hand increase the sodium hydroxide (lye) dosing level from 111 parts per million to 11,100 parts per million — a level potentially lethal if it reached consumers. A quick-thinking operator reversed the change within seconds. The attack used TeamViewer — a legitimate remote access tool — that was apparently left running without proper authentication on a plant computer.

The incident was not definitively attributed, but the FBI and CISA assessments cited in subsequent infrastructure security briefings named Iranian-affiliated actors as the most likely source. Whether that attribution is accurate or not, the incident established the technical baseline for what infrastructure sabotage below the kinetic threshold looks like.

4. Supply Chain Attacks

Iran's cyber doctrine has evolved to include supply chain targeting — compromising software vendors or service providers to gain access to their customers. This is significantly more resource-intensive than direct spear-phishing but produces access to multiple high-value targets simultaneously.

The 2021 SolarWinds compromise — attributed to Russia's SVR — demonstrated the devastating effectiveness of the supply chain attack vector. US intelligence assessments since 2022 have flagged Iranian interest in replicating this approach against the energy and financial sectors specifically.

The Escalation Ladder: Cyber as Sub-Kinetic Warfare

Iran's cyber strategy is best understood as a structured escalation ladder — a set of pre-positioned options that can be activated at graduated levels of intensity in response to US or Israeli actions.

Rung Activity Objective Deniability
1 Reconnaissance & persistent access Intelligence collection, pre-positioning High
2 Credential theft, document exfiltration Espionage, leverage High
3 DDoS against financial institutions Disruption, demonstration Medium
4 Ransomware deployment (criminal proxy) Economic disruption, indirect High
5 Wiper malware against corporate IT Destruction, punishment Medium
6 Healthcare/utilities disruption Civilian pain, pressure Low
7 Energy infrastructure sabotage Strategic damage, escalation signal Low
8 Power grid disruption Strategic warfare Very Low

Current assessment (March 2026): Iran is operating primarily at Rungs 1–3 with demonstrated capability for Rungs 4–5 and assessed capability for Rungs 6–7. Rung 8 remains a theoretical capability; no successful power grid disruption has been attributed to Iranian actors.

The doctrine is explicitly sub-kinetic: Iran uses cyber operations to retaliate for, and deter, US and Israeli kinetic actions without triggering direct military retaliation. A server farm at a US bank is harder to respond to with an airstrike than a missile battery in Hormozgan Province.

"Cyberattacks give Tehran a retaliatory option that doesn't invite a military response. The question is always: when does the US decide that a cyber attack on critical infrastructure crosses the threshold that justifies a kinetic response? Nobody has answered that question clearly, which is exactly the ambiguity Iran is exploiting." — Thomas Rid, Professor of Strategic Studies, Johns Hopkins SAIS, interview with The Atlantic, March 2026

Major Iranian Cyber Operations: Reference Table

Year Operation / Campaign Primary Target Method Impact Attribution Confidence
2012 Operation Ababil US banks (JPMorgan, BofA, Wells Fargo, Citi) DDoS (botnets) Tens of millions affected; $10M+ in damages High (DOJ indictments 2016)
2012 Shamoon v1 Saudi Aramco, RasGas Wiper malware 34,841 computers destroyed High
2014 Las Vegas Sands hack Las Vegas Sands Corp Wiper + data theft Systems destroyed, 20,000 records stolen High (CEO Sheldon Adelson had advocated bombing Iran)
2016 Shamoon v2 Saudi government ministries Wiper Multiple ministry networks destroyed High
2018 TRITON/TRISIS Saudi petrochemical facility Safety Instrumentation System attack First-known attack targeting safety systems High
2018 Shamoon v3 Saipem (Italian oil contractor) Wiper 400+ servers, 100 PCs destroyed High
2019 APT33 attacks US aerospace, petrochemical Spear-phishing, backdoors Persistent access; scope unknown High
2020 Operation Exchange Marauder Government, defense contractors ProxyLogon-adjacent Credentials, intel collection High
2021 Oldsmar water plant Municipal water treatment TeamViewer remote access Sodium hydroxide nearly 100x elevated Medium
2021 Atrium Health et al. US hospital networks Ransomware (proxy) Multi-hospital disruption Medium
2022–24 Ongoing APT35 campaigns US officials, journalists, researchers Spear-phishing, mobile attacks Continuous credential theft, intel access High
2024 Log4Shell exploitation US financial institutions Vulnerability exploitation Persistent access maintained High
2026 (Mar 3+) Post-Hormuz campaign Financial, healthcare, energy Multiple vectors Ongoing; CISA Emergency Directive issued High

What Defenses Exist

Government Response Architecture

CISA (Cybersecurity and Infrastructure Security Agency): The lead federal agency for critical infrastructure cybersecurity. CISA's 2026 Emergency Directive — issued March 3, two days after the first Iranian retaliatory missile launches — ordered all federal civilian executive branch agencies to apply specific patches, implement network segmentation requirements, and activate enhanced monitoring within 48 hours. The directive also included voluntary guidance for critical infrastructure operators.

US Cyber Command (USCYBERCOM): The military offensive and defensive cyber organization. USCYBERCOM has been authorized to conduct "defend forward" operations — meaning it actively penetrates adversary networks to monitor and potentially disrupt attack preparations before they reach US targets. The NSA/USCYBERCOM relationship allows significant intelligence collection on Iranian cyber infrastructure.

CISA's Known Exploited Vulnerabilities (KEV) Catalog: Maintained continuously; flagged multiple Iranian-associated CVEs in the March 2026 advisories.

Sector ISACs (Information Sharing and Analysis Centers): Sector-specific threat intelligence sharing organizations. The FS-ISAC (financial), H-ISAC (healthcare), E-ISAC (energy), and Water ISAC all activated heightened threat postures and began sharing real-time indicator-of-compromise data with members following the CISA Emergency Directive.

Structural Vulnerabilities That Remain

The Legacy OT Problem: Thousands of US water utilities, power plants, and pipeline operators run SCADA systems on hardware and software that cannot be patched — either because patches don't exist for systems no longer supported, or because any maintenance window would require shutting down essential services. This creates a permanent attack surface that no directive can quickly remediate.

Small utilities and municipalities: The Oldsmar attack targeted a plant serving 15,000 people. The US has approximately 148,000 public water systems. The vast majority operate with minimal cybersecurity staffing, no dedicated security personnel, and legacy remote access tools that are trivially exploitable. Federal mandates exist but compliance and enforcement are inconsistent.

Healthcare sector fragmentation: The US has approximately 6,000 hospitals and roughly 900,000 physician practices. Unlike the financial sector, which has invested heavily in cybersecurity through FS-ISAC and large bank security teams, healthcare is fragmented, underfunded on security, and operates systems with extensive third-party vendor access. The Cl0p ransomware campaign against Change Healthcare in 2024 — disrupting billing and prescription systems for thousands of providers — demonstrated the systemic fragility of this sector.

Supply chain exposure: Even well-defended organizations are exposed through their technology vendors. The SolarWinds lesson has been widely studied but inconsistently applied. Third-party vendor security assessments remain inadequate across most sectors.

The TRITON/TRISIS Incident: The Most Dangerous Attack Nobody Talked About

In 2017 (publicly disclosed 2017–2018), attackers compromised a Safety Instrumentation System (SIS) at a petrochemical facility in Saudi Arabia. The SIS is the last line of defense against catastrophic industrial accidents — if a process goes out of safe parameters, the SIS shuts it down before an explosion or chemical release.

The TRITON malware was designed to disable or manipulate the SIS — meaning it could potentially allow a physical process to run to catastrophic failure while preventing the safety system from intervening. This is a qualitatively different category of attack than anything seen before: not data destruction, not DDoS, but enabling industrial disaster.

The attackers failed — a programming error in the malware caused the SIS to trigger a safe shutdown, alerting operators that something was wrong. But the capability demonstrated was real: someone had invested significant resources (assessed as a nation-state actor; FireEye attributed it to a specific Russian research institute, though Iran's role in the attack chain remains debated) in writing malware specifically targeting physical safety systems.

For US critical infrastructure security planners, TRITON represents the upper bound of the current threat. Iran has observed the technique. Whether it has independently developed equivalent capabilities is assessed as probable by US intelligence.

What to Watch

CISA advisory cadence: Each CISA advisory or Emergency Directive is a public signal of elevated classified threat intelligence. Three or more advisories in a 30-day period (we have had two since March 1) signals active Iranian cyber operations at significant scale.

Financial sector incident reports: FS-ISAC publishes aggregated (anonymized) incident statistics. A spike in DDoS events, credential-stuffing attempts, or intrusion detections against financial institutions would mirror the 2012 Operation Ababil playbook.

Healthcare ransomware: Iran has been documented using criminal ransomware groups as proxies — providing access or tools to criminal actors and benefiting from the disruption without direct attribution. A wave of ransomware attacks against US hospitals in the current period should not be assumed to be purely criminal.

OT security alerts: Dragos, Claroty, and Nozomi Networks — the three major industrial cybersecurity firms — publish threat intelligence on ICS/SCADA threats. Any public advisory from these firms citing Iranian actors targeting energy sector OT environments would be a significant escalation signal.

Congressional authorization: The threshold question for USCYBERCOM offensive operations against Iranian cyber infrastructure is the scope of existing presidential authority. A formal Congressional authorization for the use of force (or cyber force) against Iran would dramatically expand operational authorities — watch for Senate Armed Services Committee hearings.

International attribution coalition: The US, UK, Australia, and Five Eyes partners have used coordinated public attribution as a diplomatic tool. A joint Five Eyes attribution statement specifically naming Iranian state actors and specific operations is typically a precursor to indictments, sanctions designations, or escalated offensive cyber activity.

Bottom Line

The Hormuz conflict has a visible front — tankers, missiles, carrier groups, oil prices — and an invisible one that may prove more consequential for American civilians. Iranian cyber capabilities are real, have been demonstrated repeatedly, and are now almost certainly in an active operational phase triggered by the February 28 kinetic exchange.

The US defense posture has improved dramatically since 2012: CISA is better resourced, sector ISACs are more functional, and USCYBERCOM's "defend forward" doctrine has disrupted Iranian operations before they reached their targets. But the attack surface — 148,000 water systems, 6,000 hospitals, thousands of utilities running legacy SCADA on internet-connected networks — remains too large and too fragmented to fully defend.

The single most important security action that most US critical infrastructure operators have not taken is basic: network segmentation between OT and IT environments. If an adversary cannot reach the systems that control physical processes from the same network segment that processes email, the attack surface for a Shamoon-style wiper reaching an ICS environment decreases by orders of magnitude.

That recommendation has been on every CISA advisory since 2017. Too many operators have not implemented it. In the current threat environment, that gap is no longer theoretical.

Technical details reflect publicly available threat intelligence from CISA, Mandiant/Google Cloud, Microsoft MSTIC, CrowdStrike, and academic research. Classified assessments may differ. Last updated March 17, 2026.

Related Analysis from The Board

Originally published on The Board World

Top comments (0)