Between January and June 2026, Iran integrated AI technologies as a force multiplier across its hybrid warfare model — cyber operations, influence operations, military systems, and domestic surveillance — without fundamentally altering its asymmetric strategic doctrine. Iranian state-sponsored threat actors (APT42, MuddyWater, APT34, and others) leveraged LLMs to accelerate malware development, enhance spearphishing lures, and conduct ICS reconnaissance, while AI-generated propaganda and inauthentic social media accounts flooded the information environment at unprecedented scale. Russia likely transferred AI-enabled Shahed drone variants and operational tactics to Iran, though independent confirmation of AI use in 2026 kinetic operations remains limited.
Middle East
14 posts
AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict June 2026 Dark Web Threat Actor Trend Report The June 2026 Dark Web Threat Actor Trend Report from AhnLab ASEC summarizes broad activity across hacktivist, APT, and cybercrime ecosystems. Key developments include ShinyHunters' migration to dark web infrastructure, North Korean supply chain attacks on npm AI-framework packages via Sapphire Sleet, a RaaS group's EDR-killing toolkit targeting European defense/aerospace, and TA569's Web Inject framework leveraging fake browser updates. Law enforcement achieved notable wins including a Scattered Spider conviction and multiple arrests across Europe.
June 2026 Dark Web Breach Incident Trend Report The June 2026 Dark Web Breach Incident Trend Report summarizes major data breach cases observed on deep web and dark web forums. ShinyHunters claimed breaches across multiple sectors in North America and Europe, while Operation FortiBleed exposed large-scale credentials for security equipment and VPN accounts. The report also highlights emerging threats including AI-generated fake breach data, ransomware negotiation brokerage services on Russian-language forums, and potential manipulation of AI assistant platform response layers in the Middle East.
Threat landscape for industrial automation systems. Q1 2026 Kaspersky's Q1 2026 ICS threat landscape report indicates a continued overall decline in malware blocked on industrial automation systems, reaching 19.6%. However, specific regions like Southern Europe and industries like biometric systems saw notable increases in threats, particularly from malicious scripts, phishing, and spyware. The report highlights the persistent risk to OT environments from common threat vectors like internet browsing and email.
The Bear Necessities: A Look at the Drivers, Dynamics, and Applications of the Pro-Russia Influence Ecosystem Google Threat Intelligence Group analyzes the evolution of the pro-Russia influence ecosystem four years into the full-scale invasion of Ukraine, identifying a pivot from war-focused operations back to global strategic objectives targeting the West, NATO, and the EU. The ecosystem comprises six interconnected components — overt media, covert IO campaigns, hacktivism, cyber espionage, government direction, and outsourced proxies — that cross-promote and amplify narratives. Key trends include the increasing use of generative AI for content creation, the blending of cyber espionage with influence operations via hack-and-leak tactics, and the outsourcing of capability development to contractors like NTC Vulkan for plausible deniability.
25th May – Threat Intelligence Report This threat intelligence report highlights multiple high-profile breaches, including 7-Eleven and GitHub, alongside the active exploitation of vulnerabilities in Windows Defender, Trend Micro, and Drupal. It also details emerging threats such as the Kali365 phishing kit, AI-driven prompt injection attacks, the Nimbus Manticore IRGC-linked campaign deploying the MiniFast backdoor, and a supply chain attack on Laravel Lang packages.
Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns Unit 42 identified an active cyberespionage campaign by the Iran-nexus APT group Screening Serpens, targeting entities in the U.S., Israel, and the Middle East. The threat actor deployed two new RAT families, MiniUpdate and MiniJunk V2, utilizing advanced AppDomainManager hijacking and DLL sideloading to evade native .NET security mechanisms like ETW. The attacks rely on highly tailored social engineering lures, such as fake job portals and video conferencing updates, to initiate the infection chain and establish persistent command and control.
Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict Iranian threat actor Nimbus Manticore (UNC1549) conducted a series of campaigns in early 2026 utilizing AppDomain Hijacking, SEO poisoning, and task hijacking to deploy the new MiniFast backdoor. The group demonstrated rapid toolset evolution, likely aided by AI-assisted development, targeting the aviation and software sectors across the US, Europe, and the Middle East.
Now Live: The CrowdStrike 2026 Financial Services Threat Landscape Report The CrowdStrike 2026 Financial Services Threat Landscape Report highlights a 43% global increase in hands-on-keyboard intrusions against the financial sector. The threat landscape is dominated by eCrime ransomware operations, DPRK-nexus cryptocurrency theft via supply chain compromises, and China-nexus intelligence collection leveraging Operational Relay Box (ORB) networks and DLL search-order hijacking.
Fortify Your Network Security from Emerging Geopolitical Cyberthreats Following the outbreak of a geopolitical conflict in the Middle East in early 2026, Akamai observed a 245% surge in malicious cyber activity targeting global enterprises. The threat landscape is characterized by massive increases in automated reconnaissance, credential harvesting, and data-wiping attacks by state-sponsored and hacktivist groups like Handala, primarily targeting the financial, ecommerce, and healthcare sectors.
China-nexus Group Targets Persian Gulf Region | ThreatLabz A China-nexus threat actor, assessed with medium confidence as Mustang Panda, targeted the Persian Gulf region using a multi-stage attack chain themed around the Middle East conflict. The campaign leverages LNK and CHM files to execute a heavily obfuscated shellcode loader via DLL sideloading, ultimately deploying a PlugX backdoor capable of HTTPS and DNS-over-HTTPS (DoH) C2 communications.
Middle East Conflict Fuels Cyber Attacks | ThreatLabz Threat actors are capitalizing on Middle East geopolitical tensions using over 8,000 newly registered domains to launch opportunistic cyber attacks. Campaigns include Mustang Panda deploying the LOTUSLITE backdoor via DLL sideloading, fake news sites distributing StealC malware, and various phishing/scam operations exhibiting Persian-language artifacts.
Interplay between Iranian Targeting of IP Cameras and Physical Warfare in the Middle East Iranian threat actors are actively exploiting vulnerabilities in Hikvision and Dahua IP cameras across the Middle East to support physical warfare operations. The compromised devices are utilized for battle damage assessment (BDA) and targeting correction during kinetic military operations, with exploitation spikes correlating closely with regional geopolitical events.
Alert: NCSC advises UK organisations to take action following conflict in the Middle East The NCSC has issued an alert advising UK organizations, particularly those with ties to the Middle East, to bolster their cybersecurity posture amid ongoing regional conflicts. While direct threats to the UK remain low, there is a heightened risk of collateral damage from Iran-linked hacktivists utilizing DDoS, phishing, and ICS targeting.
