Loading story…
The U.S. intelligence community’s 2026 Annual Threat Assessment warned that North Korea continues expanding its nuclear and ballistic missile programs while also using a sophisticated cyber apparatus for illicit activity, including cryptocurrency theft, to fund the regime and strengthen its military capabilities. The report said Pyongyang’s weapons of mass destruction, conventional forces, asymmetric capabilities, and cyber operations pose significant threats to the United States and its allies, especially South Korea and Japan, and noted that support from Russia in exchange for North Korean assistance in the war against Ukraine has improved the North’s military capacity.
The same annual threat hearing also addressed Iran, with U.S. intelligence leaders telling senators that Tehran’s leadership remains in power and could rebuild degraded military capabilities over the coming years despite ongoing U.S. and Israeli strikes. Testimony indicated Iran has long pursued nuclear and missile ambitions and continues to threaten U.S. interests and regional shipping, but officials did not substantiate claims that Iran was on the verge of launching an imminent first strike before the war began. A separate report on DHS leadership and CISA staffing focused on domestic agency policy and budget cuts rather than the threat assessment’s findings, making it unrelated to the core national threat-reporting story.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
At a Senate Select Intelligence Committee hearing, U.S. intelligence leaders said Iran's regime remains in power despite severe military damage and did not confirm White House claims that Iran had posed an imminent nuclear or missile threat before the war. The hearing also exposed inconsistencies in Director of National Intelligence Tulsi Gabbard's written and oral testimony about the status of Iran's nuclear program.
The U.S. Intelligence Community's Annual Threat Assessment said North Korea continues expanding its nuclear, ballistic missile, and other strategic weapons programs, posing significant threats to the United States, South Korea, and Japan. The assessment also described North Korea's cyber operations, including cryptocurrency theft, espionage, and the use of fraudulent IT workers to generate revenue and evade sanctions.
According to testimony cited in the Roll Call report, the war with Iran began on 2026-02-28. U.S. intelligence leaders said subsequent U.S. and Israeli strikes significantly degraded Iran's conventional military capabilities.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **U.S. Intelligence Community's 2026 Annual Threat Assessment** warns that major geopolitical adversaries and regional flashpoints are becoming more dangerous, with North Korea and South Asia highlighted as persistent sources of instability. The report says **North Korea** has strengthened its military and economic position through deeper cooperation with **Russia** and renewed ties with **China**, while continuing to expand its nuclear and missile arsenal, including systems capable of reaching the U.S. homeland. It also links Pyongyang's improved position to combat experience gained through involvement in the Ukraine war and increased foreign-currency revenues, including from cybercrime. The same assessment says **India-Pakistan tensions** remain a serious nuclear escalation risk, with terrorism, historical rivalry, and advancing military capabilities creating conditions for a rapid crisis even without either side seeking full-scale war. It also notes that **ISIS-K** continues to pursue external operations in the region despite Taliban counterterrorism pressure, and warns that Pakistan is advancing missile capabilities with increasing range and sophistication. Together, the findings portray a broader U.S. intelligence judgment that multiple state and non-state threats are intensifying across regions rather than a single isolated security incident.
Jul 12, 2026
A new threat assessment warns that the Iran war is likely to increase physical security risks in the United States over the next year, driven mainly by second-order political and social effects that mobilize homegrown violent extremists, domestic violent extremists, and lower-capability Iran-nexus actors. The report says **Islamic State supporters** are the most likely perpetrators of mass-casualty attacks, while anti-government, anti-authority, anarchist, and neo-Nazi accelerationist extremists are expected to continue targeted violence, sabotage, and plotting against officials, facilities, and critical infrastructure. The assessment says Iran is more likely to **inspire or guide** attacks in the US than to conduct sophisticated, centrally directed operations, noting that recent US-linked plots tied to Tehran have been aspirational, low-sophistication, and often dependent on financially motivated proxies. Likely targets include US and Israeli government or military-linked entities, **Jewish communities**, immigration enforcement, critical infrastructure, and high-profile public officials, while emerging tactics include greater experimentation with **IEDs**, 3D-printed weapons, UAV-borne explosives, and generative AI-assisted attack planning.
Aug 13, 2026
Iranian officials and affiliated voices signaled a sharper turn toward cyber retaliation during the U.S.-Israeli conflict, with the Islamic Revolutionary Guard Corps threatening major U.S. technology companies including **Apple, Google, and Meta** if more Iranian leaders were killed. North Carolina and other U.S. defenders were urged to stay on heightened alert as state officials cited increased nation-state activity and MS-ISAC warned that Iran is more likely to conduct disruptive or destructive operations such as **wiper attacks**, website defacements, and DDoS activity than conventional ransomware. Reporting tied the threat environment to a claimed Handala wiper attack on medical device maker **Stryker** and to broader concern that election-related websites and other civilian targets could face low-level disruption. Multiple assessments said Iran’s immediate cyber response appeared limited because military strikes, leadership losses, and internet disruptions had temporarily degraded its operations, but argued that the conflict is likely to push Tehran to invest more heavily in cyber capabilities over time. Analysts described cyber operations as a cheap, resilient, and globally deployable tool that can survive bombing and compensate if Iran’s other means of projecting power are weakened. The debate unfolded alongside criticism that Washington’s cyber strategy is too offense-heavy and institutionally underpowered, with gaps in leadership, pressure on U.S. Cyber Command, and reduced civilian cyber capacity leaving U.S. networks and critical infrastructure more exposed as Iranian retaliation risks grow.
Jun 29, 2026