Loading story…
Poland’s National Centre for Nuclear Research (NCBJ) said hackers targeted its IT infrastructure, but the intrusion was detected and blocked before systems were compromised. The institute said the MARIA research reactor continued operating safely and was not affected, while Polish authorities opened an investigation and placed internal security teams on heightened alert. Reporting cited by one source said investigators found indicators that Iran may be behind the operation, although officials cautioned those signs could also be a false flag.
Albania’s parliament also reported a sophisticated cyberattack aimed at deleting data and compromising internal systems, temporarily disrupting parliamentary email services while leaving the main website and core systems operational. A group known as Homeland Justice claimed responsibility and published alleged screenshots of stolen parliamentary communications, though Albanian authorities had not verified the claims at the time of reporting. Homeland Justice has previously been linked by researchers and Western officials to Iran’s IRGC, but the two incidents remain separate events with different targets, attribution status, and operational details; broader discussion of Salt Typhoon and U.S. telecom policy is unrelated to these attacks.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
As the investigation progressed, Polish officials said early indicators pointed to possible activity originating from Iranian infrastructure. Authorities cautioned that the signs could be false flags and said no public technical evidence had been released to support firm attribution.
Following the attempted breach, NCBJ notified relevant authorities and began a coordinated response with national cybersecurity and government agencies. The institute raised its internal security alert level and started analyzing the incident to strengthen defenses.
On March 12-13, Poland’s National Centre for Nuclear Research detected and blocked a cyberattack targeting its IT infrastructure before any compromise or operational disruption occurred. NCBJ said the MARIA research reactor continued operating safely at full power throughout the incident.
The hacker group Homeland Justice claimed it carried out the attack on Albania’s parliament and said it had obtained internal communications, posting screenshots of purported leaked documents on Telegram. Albanian authorities did not verify the claim and said cybersecurity agencies were investigating.
Albania’s parliament reported a sophisticated cyberattack aimed at deleting data and compromising internal systems. Internal email services for the parliamentary administration were temporarily suspended, leaving staff and lawmakers unable to access computers and email for several hours, while the main systems and website remained operational.
Before the latest incident, the Iran-linked group Homeland Justice had publicly claimed attacks on Albanian targets including parliament, the national airline, telecom firms, and the national statistics agency. These earlier operations form the backdrop to the new claim against Albania’s parliament.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcerescana.com
Open sourcebleepingcomputer.com
Open sourcencbj.gov.pl
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran-linked threat actors tied to **MOIS** and **IRGC-IO** attempted a series of disruptive cyberattacks during the broader Iran conflict, including efforts to compromise internet-exposed programmable logic controllers in U.S. water systems, deploy a wiper against a U.S. healthcare company, and breach the email server of Albania’s parliament. The operations were presented by Iranian actors as strikes on critical infrastructure and public institutions across the United States, Israel, and Gulf states. Reporting assessing the campaign says the attacks caused limited real-world damage and suggests Iran’s offensive cyber capacity may have been weakened by U.S. and Israeli cyber and kinetic pressure. The assessment concludes that while Iranian activity remains a resilience concern for operators of critical services, **Russia** still represents the more significant hybrid-warfare cyber threat to Europe, particularly if the war in Ukraine further deteriorates.
Jul 15, 2026
U.S. agencies warned that Iran could target **critical infrastructure** operators as researchers and policy analysts described a cyber ecosystem that blends state-directed activity with nominally independent hacktivist groups. CSIS said Tehran uses this structure to support espionage, sabotage, influence operations, and plausible deniability, citing the **CyberAv3ngers** intrusions into U.S. water and wastewater systems as a prominent example after U.S. authorities tied the activity to officials in the Islamic Revolutionary Guard Corps Cyber-Electronic Command. The same reporting linked Iranian state organs, including the **IRGC** and **MOIS**, to affiliated groups such as `APT33`, `APT35`, `APT34`/`OilRig`, and `MuddyWater`. The threat picture expanded as pro-Russia actors joined Iran-linked operations under **#OpIsrael**, with attacks reportedly including **DDoS**, claimed breaches, leaked CCTV footage, **SQL injection**, and data leaks against Israeli government, education, and municipal targets. Researchers said dozens of Russia-aligned and Iran-nexus actors appeared to be participating, while Radware separately reported retaliatory hacktivist DDoS activity tied to the regional conflict. U.S. officials and sector groups have monitored for spillover risk, warning that even if many operations are opportunistic or low sophistication, smaller U.S. infrastructure operators could still face disruptive, high-visibility attacks.
Jun 29, 2026
Iran-nexus cyber activity intensified alongside regional military escalation, with multiple reporting streams describing both opportunistic and targeted operations. Check Point Research observed a coordinated campaign to compromise internet-connected **IP cameras** across Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus, with spikes in exploitation attempts aligning to geopolitical events; activity was traced to infrastructure linked to Iran-nexus actors using commercial VPN exit nodes (e.g., *Mullvad*, *ProtonVPN*, *Surfshark*, *NordVPN*) and VPS infrastructure to mask origin, and the most targeted vendors were **Hikvision** and **Dahua**. Separately, Symantec reported **Seedworm** (*MuddyWater/Temp Zagros/Static Kitten*) activity on multiple U.S. and Canadian organizations beginning in February 2026, including a U.S. bank, airport, non-profit, and the Israeli operations of a U.S. software supplier to defense/aerospace; Symantec identified a previously unknown backdoor dubbed **Dindoor** (leveraging the *Deno* runtime) and a Python backdoor **Fakeset**, with malware signed using certificates issued to “**Amy Cherne**” (and in some cases “**Donald Gay**”), and noted attempted data exfiltration using **Rclone** to a *Wasabi* cloud storage bucket. Additional coverage indicates broader pro-Iranian cyber activity but is less specific to the above intrusions. ASEC’s weekly “Ransom & Dark Web Issues” roundup flags **pro-Iranian/pro-Islamist hacktivist** attacks against Middle Eastern and pro-Western targets, but provides limited technical detail in the excerpt. A podcast episode describing “Iran’s 12 days of cyber war” and global OT targeting (including *Unitronics* PLCs) is largely commentary and retrospective framing rather than a discrete, verifiable incident report, and two other items in the set (a Russia-linked **APT28** phishing/malware campaign in Ukraine and a China-nexus **UAT-9244** telecom intrusion set in South America) describe unrelated threat activity outside the Iran-focused escalation.
Jul 22, 2026