Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)
Summary: As of April 17, 2026, Iran began restoring limited internet access after a 47-day near-complete outage, while Unit 42 tracked a new cluster, CL-STA-1128 (aka Cyber Av3ngers, Storm-0784), targeting Rockwell Automation OT/ICS equipment in late March 2026, a shift from its historic focus on Unitronics PLCs. Unit 42's investigation of conflict-themed phishing lures identified 7,381 related phishing URLs across 1,881 unique hostnames, and it estimates 60 individual hacktivist groups active as of March 2, 2026.
Bottom line: Unit 42 reports confirmed use of wipers and urges organizations to test data backup and recovery procedures and harden identity and privileged account management - the destructive attacks it tracks are aimed at recovery and access, not just disruption.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026