Geopolitically driven cyber activity surges following Operation Epic Fury

Iran-linked threat actors escalated from espionage to disruptive and destructive operations in the wake of the US/Israel military campaign dubbed Operation Epic Fury, with reporting describing a coordinated hybrid offensive against Western, Israeli, and regional economic and critical infrastructure targets. Tenable assessed MOIS-affiliated groups as increasingly masking activity behind cybercriminal infrastructure to complicate attribution, and highlighted a notable rise in Iranian-nexus targeting of internet-connected IP cameras using known, exploitable vulnerabilities; the same reporting pointed to increased activity from MuddyWater and the Void Manticore/Handala persona, including indications of pre-positioned access ahead of the kinetic operations.

Separate threat-intelligence reporting described China-nexus actors rapidly pivoting in the same geopolitical window, including activity against Qatari entities shortly after the initial strikes: Camaro Dragon attempted to deploy a PlugX variant using conflict-themed lures, and another intrusion attempt used DLL hijacking to deliver Cobalt Strike, consistent with China-aligned tradecraft. Other items in the set cover unrelated campaigns and incidents—an exposed APT28 Roundcube exploitation toolkit targeting Ukrainian government mail infrastructure, a pro-Russian NoName057(16) DDoS campaign heavily targeting German and Israeli public-sector and commercial services, a Russian-speaking BlackSanta BYOVD “EDR killer” delivered via HR-themed lures and steganographic images, and a weekly bulletin summarizing multiple breaches (e.g., AkzoNobel, LexisNexis, Wikimedia, TriZetto)—and do not materially add to the Operation Epic Fury–linked escalation narrative.