APTs, campaigns, IOCs, TTPs
50 stories
In the last 7 days, Threat Intelligence tracked 13 stories — 77% negative, 23% neutral sentiment, averaging 6.9/10 impact.
Figures are computed live from our source-verified story record — see our methodology for how impact and sentiment are derived.
The Trump administration is considering deploying thousands of additional troops to the Middle East as the conflict with Iran enters a critical new phase. This military buildup is expected to trigger a parallel escalation in state-sponsored cyber operations targeting U.S. critical infrastructure and the defense industrial base.
Israeli Defense Minister Katz confirmed the elimination of Iranian Intelligence Minister Esmail Khatib during a targeted military operation. This high-profile decapitation of Iran's intelligence leadership is expected to trigger immediate retaliatory cyber operations against Israeli and Western critical infrastructure.
The confirmation of Iranian security chief Ali Larijani's death following an Israeli strike has triggered a global cybersecurity alert. Intelligence agencies warn of imminent retaliatory cyber operations targeting Israeli critical infrastructure and international partners.
A new intelligence report reveals a sophisticated Chinese influence campaign leveraging birth tourism in Los Angeles to establish long-term strategic assets. The operation highlights the evolving nature of hybrid threats where human-centric intelligence gathering intersects with national security vulnerabilities.
The confirmation of Iranian security chief Larijani's death in an Israeli strike marks a critical escalation in the widening U.S.-Israeli war with Iran. The conflict has led to a blockade of the Strait of Hormuz, triggering global energy shocks and heightening the risk of state-sponsored cyber retaliation against critical infrastructure.
Israel has formalized operational plans for at least three weeks of sustained warfare against Iran following a series of significant airstrikes. This strategic window marks a period of heightened risk for global cybersecurity, with state-sponsored cyber operations expected to escalate alongside kinetic military actions.
Former President Donald Trump has accused Iran of deploying advanced artificial intelligence to conduct sophisticated disinformation campaigns. The allegations highlight a growing shift in geopolitical influence operations toward synthetic media and automated narrative generation.
Donald Trump has accused Iran of deploying sophisticated AI-driven disinformation campaigns to manipulate global media and public perception. The allegations highlight a technical escalation in Tehran's influence operations, moving from manual social media engagement to automated, high-fidelity synthetic content.
As US officials project a swift conclusion to potential hostilities with Iran, Tehran has countered with a strategy of long-term endurance. This geopolitical friction signals an imminent surge in nation-state cyber operations, placing global critical infrastructure and financial systems at heightened risk of retaliatory strikes.
The U.S. military has transitioned artificial intelligence from experimental frameworks to active operational roles in the conflict in Iran. This shift focuses on accelerating the kill chain through automated data synthesis and real-time target identification.
The ongoing conflict in the Middle East has entered a new phase of cyber-kinetic integration, with state-sponsored actors targeting critical infrastructure and maritime logistics. Recent developments indicate a shift from disruptive DDoS attacks to sophisticated, destructive operations against energy and water systems.
The Islamic Revolutionary Guard Corps (IRGC) has issued a direct threat against Israeli Prime Minister Benjamin Netanyahu, marking a dangerous escalation in the three-week-old conflict. This shift toward high-stakes personal targeting is expected to trigger a wave of retaliatory state-sponsored cyber operations against critical infrastructure.
Iran’s Foreign Minister has officially denied reports that the nation sought a ceasefire, signaling a commitment to ongoing regional hostilities. This stance indicates a high-probability surge in state-sponsored cyber operations targeting Western and regional critical infrastructure as the kinetic conflict persists.
As the kinetic conflict between the U.S. and Iran enters its third week, President Trump has signaled further strikes following attacks on critical infrastructure like the Kharg Island oil terminal. This escalation significantly raises the risk of retaliatory cyber operations targeting Western energy, finance, and government sectors.
Israel has claimed responsibility for a precision airstrike in Tehran that killed two senior Iranian intelligence officials on March 14, 2026. This high-stakes operation marks a significant escalation in the regional shadow war and is expected to trigger immediate retaliatory cyber operations against Israeli and Western critical infrastructure.
Tehran has officially accused the United States of launching offensive operations from bases in the United Arab Emirates as the regional conflict enters its third week. This escalation signals a broadening of the digital and kinetic theater, raising critical concerns for infrastructure security across the Middle East.
The U.S. Embassy in Baghdad has issued an urgent evacuation order for American citizens following President Trump's confirmation of military strikes against Iranian targets. This geopolitical escalation signals an immediate shift in the global cyber threat environment, with experts warning of imminent retaliatory strikes from state-sponsored Iranian actors.
As the conflict in Iran enters its third week, Tehran has issued direct threats against the Middle East's busiest maritime hubs. This escalation signals a shift toward targeting critical infrastructure, raising urgent concerns for maritime cybersecurity and global supply chain integrity.
The reported deaths of 13 U.S. service members in a direct conflict with Iran marks a catastrophic escalation in Middle Eastern geopolitics. Cybersecurity agencies are bracing for a massive wave of retaliatory state-sponsored cyberattacks targeting U.S. critical infrastructure and financial systems.
Group-IB has officially expanded into the Americas with the launch of its first Digital Crime Resistance Center (DCRC) in Santiago, Chile. The new facility will serve as a regional hub for threat hunting, digital forensics, and localized cybercrime investigations.
Source: newswiretoday.com · newswiretoday.com
Following President Donald Trump's announcement that US forces destroyed military targets on an Iranian island, cybersecurity agencies are bracing for asymmetric retaliation. Iranian state-sponsored threat actors are expected to intensify operations against Western critical infrastructure and financial systems.
Source: clactonandfrintongazette.co.uk · nwemail.co.uk
As the United States intensifies military operations against Iran and deploys Marines to the Middle East, cybersecurity agencies have issued urgent warnings regarding retaliatory cyberattacks. Iranian state-sponsored threat actors are expected to target Western critical infrastructure, specifically the energy and financial sectors, using destructive wiper malware.
The Bombay High Court has rejected the bail application of Jerry Philips Jacob, accused of trafficking educated Indian youth to Southeast Asia to operate cryptocurrency scam centers. The National Investigation Agency (NIA) provided evidence of coerced labor, torture, and the confiscation of passports in what officials describe as a growing 'cyber-slavery' crisis.
The US military has confirmed the deployment of advanced artificial intelligence tools, including large language models, to process battlefield data in the ongoing conflict with Iran. This integration marks a significant shift in military operations, leveraging commercial technology from firms like Anthropic and Palantir to accelerate decision-making cycles.
Source: Cb_usr (do) · Cb_usr (ag)
State-sponsored Iranian cyber actors have intensified operations against United States infrastructure and international targets, shifting from traditional espionage toward disruptive preparation. Security officials warn that the ongoing regional conflict has significantly heightened the risk of retaliatory cyberattacks designed to cripple essential services.
Ukraine has officially opened access to its extensive battlefield data for allied AI models, marking a pivotal shift in military intelligence sharing. This initiative aims to accelerate the development of autonomous systems and electronic warfare tools by leveraging real-world combat data from the ongoing conflict.
A US missile strike in Iran has resulted in 165 civilian casualties after outdated intelligence led to the targeting of a school. The incident underscores a catastrophic failure in the intelligence lifecycle and raises urgent questions regarding data integrity in automated military systems.
The escalating conflict between the US-Israel alliance and Iran has moved beyond kinetic strikes into a systemic digital war, threatening global supply chains and critical infrastructure. Businesses are facing a surge in state-sponsored wiper malware and retaliatory espionage that transcends regional borders.
Iran has issued a formal statement from its new leadership as active hostilities with the United States and Israel escalate into a broader regional conflict. This transition marks a critical juncture for global cybersecurity, with intelligence analysts warning of a significant shift in Iranian state-sponsored cyber doctrine and offensive operations.
China’s latest strategic roadmap marks a definitive pivot from technological imitation to a pursuit of absolute leadership in critical infrastructure and emerging tech. This shift toward 'technological sovereignty' prioritizes indigenous innovation in semiconductors and AI, posing systemic challenges to Western cybersecurity standards.
The escalation of hostilities between the United States, Iran, and Israel has elevated offensive cyberoperations to a primary front of modern warfare. This shift marks a departure from traditional 'gray zone' tactics toward integrated, high-impact strikes on critical infrastructure and defense networks.
Medical technology leader Stryker has been hit by a significant cyberattack attributed to the Iranian-linked group Handala, resulting in the alleged theft of 50 terabytes of data. The incident, described as a retaliatory strike, has disrupted medical systems serving millions of patients and signals a sharp escalation in state-sponsored targeting of the healthcare supply chain.
An Iranian-born entrepreneur is leveraging advanced AI to dismantle state-sponsored hacking networks, marking a significant shift in private-sector cyber defense. The initiative, highlighted by major Israeli outlets, underscores the growing role of 'insider-experts' in neutralizing sophisticated digital threats.
Source: jpost.com · en.globes.co.il
Finnish intelligence officials caution that a potential end to the war in Ukraine will likely result in Russia redirecting its vast intelligence and cyber resources toward NATO's eastern flank. This shift threatens to escalate hybrid warfare tactics and state-sponsored espionage against critical infrastructure in the Nordic-Baltic region.
The expansion of the Middle East conflict into a global confrontation is triggering a massive surge in state-sponsored cyber operations and infrastructure targeting. Security analysts warn that the digital front is no longer contained to the region, with Western critical infrastructure now facing heightened risks from retaliatory wiper attacks and sophisticated espionage.
Israel has launched precision strikes against high-value Iranian military and intelligence command centers in Tehran and Tabriz, targeting infrastructure responsible for ballistic missile launches and satellite surveillance. Iran responded with a missile barrage and drone strikes on Israeli intelligence facilities, marking a significant escalation in the regional conflict.
Following what U.S. officials describe as the most intense day of kinetic strikes against Iranian targets, cybersecurity experts are warning of immediate retaliatory cyber operations. Defense Secretary Pete Hegseth confirmed the scale of the military action, signaling a significant shift in the regional conflict that historically triggers high-volume Iranian cyber offensives.
United States intelligence has intercepted high-level communications suggesting Iran is attempting to activate dormant sleeper cells located abroad. The development has prompted immediate briefings for the White House and Congressional leadership, signaling a heightened state of alert for both kinetic and cyber sabotage.
Democratic US senators are demanding immediate hearings following an escalation in conflict with Iran, signaling a critical shift in national security priorities. This geopolitical flashpoint significantly raises the threat level for US critical infrastructure as Iranian-aligned APT groups are expected to launch retaliatory cyber operations.
President Trump’s announcement that the kinetic phase of the conflict with Iran is nearing completion has triggered market optimism, but cybersecurity experts warn of a pivot toward asymmetric digital retaliation. As traditional military operations wind down ahead of schedule, the focus now shifts to Iran's sophisticated cyber capabilities and the potential for long-term infrastructure targeting.
As the kinetic conflict involving Iran enters its tenth day with no resolution in sight, global threat intelligence agencies are tracking a significant escalation in state-sponsored cyber operations. These attacks have shifted from localized disruption to sophisticated 'wiper' malware campaigns targeting international energy and maritime sectors.
Following the appointment of a new leader, Iran has launched a coordinated offensive against Israel and Gulf states on the tenth day of active hostilities. This escalation signals a significant shift in regional stability, with high-priority threats emerging against critical infrastructure and energy sectors.
Anthropic has been formally designated as a supply-chain risk following a deepening standoff over the integration of its AI models into defense frameworks. The move highlights escalating tensions between AI safety-focused firms and the Pentagon's rapid push for military AI capabilities.
The escalation of conflict involving Iran highlights a critical shift toward AI-driven targeting systems that overwhelm traditional missile defense architectures. This transition to algorithmic warfare suggests a new era where local retaliation and cyber-physical integration define the modern battlefield.
Israel has launched direct strikes on oil storage facilities in Tehran, while Iran is accused of targeting sensitive water infrastructure in the UAE and Bahrain. This shift toward critical infrastructure marks a dangerous escalation in regional hostilities, highlighting the vulnerability of essential services to kinetic and cyber-physical disruption.
As military tensions escalate in Iran, Russia is adopting a calculated non-interventionist stance to exploit Western resource exhaustion. This strategic pivot allows Moscow to observe Western defensive responses while deepening cyber-intelligence ties with Tehran for long-term digital dominance.
Reports indicate Russia is providing Iran with tactical intelligence to facilitate strikes against United States targets. Former President Donald Trump has publicly dismissed the significance of these findings, sparking debate over the evolving 'Axis of Resistance' and its implications for global security.
President Trump has issued a maximalist warning to Iran, threatening 'complete destruction' following a series of geopolitical provocations. For the cybersecurity community, this escalation signals an immediate shift toward high-intensity Iranian cyber operations targeting Western critical infrastructure.
Reports of increased Russian technical and military assistance to Iran signal a strengthening of the 'axis of evasion,' with significant implications for global cybersecurity. This partnership likely involves the exchange of advanced cyber-offensive capabilities and defensive strategies to counter Western sanctions and digital surveillance.
One week after the commencement of kinetic operations involving Iran, the digital battlefield has expanded into a global 'gray zone' conflict. State-aligned threat actors have transitioned from espionage to destructive operations, targeting critical infrastructure and financial systems across the West and the Middle East.
According to our own tracking database, this category has accumulated 174 threat intelligence stories since coverage began. This page aggregates the latest threat intelligence stories within our cybersecurity coverage area. Every story is cross-referenced across multiple primary sources, scored for sentiment and operational impact, and timestamped so fresh developments surface first. We track apts, campaigns, iocs, ttps and surface the angles a domain expert would actually read.
Story selection follows our editorial methodology — impact scoring weights regulatory, financial, and operational developments distinctly. Sentiment is classified across five tiers via supervised classification trained on labeled industry corpora. See our glossary for term definitions and our trends index for longitudinal patterns across the cybersecurity beat.
Stories only surface on this page once the classifier scores them at a minimum 35 percent relevance to the category. According to that methodology, reviewed July 2026, this follows multi-source corroboration standards recommended by journalism research bodies such as the Reuters Institute for the Study of Journalism.
| Signal | What it tells you |
|---|---|
| Verified by N sources | Confidence the story isn't a single-source rumor — N≥2 means the development is independently corroborated. |
| Impact score (1-10) | Estimated regulatory, financial, or operational impact. 8+ indicates a story experienced operators should act on. |
| Sentiment | Five-tier classification (very bullish through very bearish) trained on labeled cybersecurity-specific corpora. |
| Time stamp | Recency. Fresh stories (under 1h) render with a highlighted timestamp; stale stories (≥24h) render dimmed. |