A Threat Actor Landscape Assessment of ICS/OT Targeting in the 2026 Iran-US Conflict AND THE SCALE OF THE RISK

Executive Summary

The strikes of 28 February 2026 did not create the cyber threat to US critical infrastructure. They accelerated one that has been building for over a decade. This report answers three questions: who is actively targeting US and allied industrial systems, how they do it, and how large the exposed attack surface is.

Three things make US critical infrastructure the primary retaliation surface:

• Civilian impact: disrupting water, power, or fuel generates immediate political pressure without direct military engagement
• Accessible attack surface: tens of thousands of ICS devices are directly internet-reachable, many with default or no credentials
• Structural under-investment: water utilities and industrial operators run OT environments with security budgets far below commercial standards

Active Threat Actors Targeting ICS / OT Environments

Some actors are profiled below, ordered from Tier 1 nation-state APTs with years-long persistence and custom tooling, to Tier 2 proxy and hacktivist groups that are less disciplined but far more numerous and rapidly activated. All are assessed as active and directly relevant to ICS / OT targeting.

APT33 / Elfin  |  IRGC  |  Tier 1

Initial Access Vectors

• High-volume password spraying against Office 365 and Azure accounts across thousands of organisations simultaneously
• Spearphishing with malicious Office macro attachments, .hta links, and malicious archives
• LinkedIn impersonation of recruiters and students for credential harvesting

‍

Confirmed TTPs  |  Microsoft Aug 2024; MITRE ATT&CK G0064

• Tickler backdoor (2024): multi-stage, Azure-based C2, persists via Run key named SharePoint.exe
• AzureHound and Roadtools for Azure AD reconnaissance; credential theft via LaZagne and Mimikatz
• AnyDesk deployed for persistent remote access without IT authorisation

MuddyWater  |  MOIS  |  Tier 1

Initial Access Vectors

• Spearphishing with malicious Excel macro attachments and PDF droppers
• Abuse of legitimate RMM tools (Syncro, PDQ Connect) installed by third-party IT integrators on OT networks
• Internal email takeover for follow-on phishing of additional staff and suppliers

‍

Confirmed TTPs  |  CISA AA22-055A; ESET Dec 2025; CloudSEK Feb 2026

• PowGoop DLL side-loader disguised as Google Update; POWERSTATS PowerShell backdoor for credential theft
• Small Sieve backdoor: Telegram Bot API for C2, persists via Outlook/Microsoft registry run key
• Mori backdoor: DNS tunneling for covert C2 exfiltration
• MuddyViper (2024): fake Windows Security dialog for credential theft during phishing campaigns

Handala Hack Team  |  MOIS-Aligned  |  Tier 2

Initial Access Vectors

• Phishing via SMS and email impersonating IT vendors and service providers
• Supply chain compromise via MSPs for simultaneous downstream industrial operator access
• Scanning internet-facing apps for misconfigurations and weak credentials (observed via Starlink IPs to evade geolocation blocks)

Confirmed TTPs  |  Cisco Talos / Splunk Jul 2024; Check Point Mar 2026

• Custom wiper: AutoIT-based, NSIS-packaged, delivered via vendor-impersonation phishing; Telegram channel as C2
• Ransomware deployment with non-recovery intent (wiper behavior disguised as ransomware for psychological effect)

Charming Kitten / APT35  |  IRGC-IO  |  Tier 1

Initial Access Vectors

• Sophisticated social engineering via fake social media profiles, WhatsApp, Telegram, and email impersonating conference coordinators, research assistants, and analysts
• Phishing sites cloning Google Login and Google Meet hosted on legitimate Google Sites infrastructure to add authenticity  |  Source: Dark Atlas, 2025
• Password-protected archives containing malicious LNK files delivered after trust is established

‍

Confirmed TTPs  |  CISA; Mandiant; Gatewatcher; Dark Atlas 2025

• Multi-stage infection chains: cloud-hosted C2, encrypted archives, malicious LNK files, cross-platform implants for Windows and macOS
• ProxyShell exploitation against Microsoft Exchange servers for persistent email access  |  Source: Gatewatcher analysis of leaked operational archive, 2025
• Relationship-based access cultivation over extended timeframes before any credential harvest attempt
• Leaked operational archive (2025) revealed monthly performance reports in Persian and structured target development campaigns across Iran, South Korea, Kuwait, Turkey, Saudi Arabia, and Lebanon

Volt Typhoon  |  PRC  |  Tier 1

Initial Access Vectors

• Exploitation of internet-facing edge devices: Fortinet, Ivanti, Citrix appliances
• KV Botnet: compromised end-of-life SOHO routers (Cisco, Netgear) used as relay infrastructure
• Valid account abuse, timed to business hours to blend with legitimate traffic

Confirmed TTPs  |  CISA AA24-038A

• Exclusive living-off-the-land execution: netsh, wmic, ntdsutil, PowerShell only. No custom malware, rendering signature detection ineffective.
• Lateral movement from IT to OT network segments: the defining characteristic distinguishing this from traditional espionage
• PortProxy registry modifications; AD Explorer for Active Directory environment mapping

‍

CyberAv3ngers  |  IRGC-CEC Proxy  |  Tier 2

Initial Access Vectors

• Default credential login on internet-exposed Unitronics PLCs via TCP port 20256 (default password: 1111)
• Shodan and Censys scanning for exposed devices, AI-assisted query generation via ChatGPT confirmed (OpenAI, Oct 2024)
• No software vulnerability exploitation required in any confirmed campaign

‍

Confirmed TTPs  |  CISA AA23-335A; Claroty Team82

• Authenticate to Unitronics PLC, overwrite ladder logic, deface HMI display
• Disable upload / download functions to prevent operator remediation; downgrade firmware version
• IOCONTROL malware (2024): custom Linux backdoor with MQTT-based C2, deployed across Unitronics and Orpak fuel management systems  |  Claroty Team82, Dec 2024

Mapping the Attack Surface

Every result returned by these queries represents a real ICS device running a live industrial process, reachable from any internet connection. Use the Shodan queries in the rightmost column to populate each row with current counts.

‍

‍

How Threat Actors Move from Discovery to Disruption

All actors in this report use one or more of three paths to reach ICS and OT environments. The paths are not mutually exclusive.

Path 1: Direct Exploitation of Exposed Assets

The lowest-barrier, highest-volume risk. No social engineering, no network infiltration.

• Threat actor queries Shodan for port 20256 or port 502, identifies exposed devices
• Attempts default credentials. Unitronics: 1111. Other defaults published in vendor manuals and CISA advisories.
• If authenticated: full operator-level access, read / write process values, modify control logic, disable safety alarms, stop processes
• No ICS expertise required. AI-assisted query generation compresses target identification to minutes.

‍

Path 2: Phishing Into OT-Adjacent Environments

Used by APT33, MuddyWater, Handala. The target is the people who operate ICS, not the device itself.

• Spearphishing reaches SCADA engineers and control room operators impersonating equipment vendors or IT support
• One compromised OT operator credential can provide access to the engineering workstation and PLC programming environment
• MSPs with RMM tools installed on OT networks are a high-value target: a single MSP compromise yields access to all downstream industrial clients simultaneously

‍

Path 3: IT Infiltration with Lateral OT Movement

The Volt Typhoon model. The hardest to detect, the longest dwell time, and the highest potential impact.

• Internet-facing VPN or firewall exploited to gain IT network foothold
• Actor moves silently toward IT/OT boundary: engineering workstations, historians, jump servers
• Uses only native OS tools, no malware, minimum five-year confirmed dwell in some US victims
• In a conflict or crisis the pre-positioned actor activates: disrupts processes, triggers safety failures, destroys equipment

Takeaways

For Technical Teams

• Remove ICS management interfaces from the public internet now. No Unitronics HMI, Siemens SIMATIC portal, or Niagara login page should be internet-accessible without a VPN.
• Change default credentials on all deployed ICS devices. For eg. The Unitronics password 1111 is in a CISA advisory and is still in active use.
• Block at the perimeter: TCP 20256, 102, 502, 44818, 1911, 4840, 20000 and UDP 47808
• Audit all MSP and RMM tool access to OT environments. Syncro, PDQ Connect, AnyDesk installed without IT authorization are open doors.
• Hunt for LOTL anomalies in OT-adjacent environments. Set behavioral baselines. Investigate deviations from normal.
• Enable logging on all ICS management interfaces. Without logs, incidents cannot be detected, investigated, or confirmed.

For Leadership and Non-Technical Readers

• A US water utility was forced onto manual operations by an Iranian-affiliated group using a default password in 2023. The threat pool is now larger, better coordinated, and AI-assisted.
• Sixty-plus hacktivist groups were activated within hours of 28 February 2026. They do not need nation-state capability. They need an exposed device and motivation. Both conditions are currently met.
• Volt Typhoon has been inside US critical infrastructure for years. The threat is not only incoming attacks. Some actors are already there.
• The three highest-impact actions do not require large budgets: take ICS interfaces off the internet, change default passwords, block industrial protocol ports.

PRIMARY SOURCES

• CISA AA23-335A  |  Exploitation of Unitronics PLCs Used in Water and Wastewater Systems
• CISA AA22-055A  |  MuddyWater joint advisory  |  FBI, NSA, NCSC-UK, CNMF
• CISA AA24-038A  |  Volt Typhoon / VOLTZITE in US critical infrastructure
• CISA AA22-103A  |  PIPEDREAM / INCONTROLLER alert
• Microsoft Threat Intelligence, Aug 2024  |  APT33 Tickler malware and Azure C2
• Mandiant  |  APT33 and APT34 actor profiles
• MITRE ATT&CK  |  G0064 (APT33), G0069 (MuddyWater), G0049 (APT34)
• Claroty Team82, Dec 2024  |  IOCONTROL malware analysis
• ESET Research, Dec 2025  |  MuddyWater / MuddyViper Israeli campaign analysis
• CloudSEK TRIAD Team, Jan 2026  |  RustyWater RAT analysis
• Check Point Research, Mar 2026  |  Handala / Void Manticore
• Cisco Talos and Splunk, Jul 2024  |  Handala wiper malware
• KELA Cyber Intelligence, Jan 2026  |  Handala actor profiling
• Palo Alto Unit 42, Mar 2026  |  60+ Iranian hacktivist group activation
• Dragos 2025 OT/ICS Security Report  |  VOLTZITE, KAMACITE-ELECTRUM, FrostyGoop
• FBI Director Wray, Congressional Testimony, Jan 2024  |  Volt Typhoon
• Forescout Research Labs, Jun 2025  |  Global internet-exposed OT/ICS counts
• US Treasury Department, Feb 2024  |  IRGC-CEC sanctions documentation