EclecticIQ Report Warns of Escalating Cyber Risks Amid Regional Conflicts
Summary
EclecticIQ's Q1 2026 assessment warns of persistent Chinese access to critical networks, Russian threats to European OT, and continued Iranian-aligned cyber activity, while recommending stronger edge-device, identity, OT, and supply-chain defenses.
Key points
- The report assesses Chinese-linked actors as a long-term threat, citing persistent access and exploitation of network-edge devices to pre-position in critical infrastructure.
- It warns that Russian state-linked groups and aligned hacktivists pose risks to European energy, water, and industrial OT, while noting that some hacktivist access claims remain unverified.
- Iran-linked cyber activity may continue despite reduced centralized coordination; the report highlights wiper attacks, independent aligned groups, and conflict-themed phishing.
- The report describes the Stryker attack as an example of destructive activity through trusted identity and management tools, rather than malware deployed to endpoints.
- Recommended priorities include patching internet-facing devices, segmenting IT and OT, securing remote OT access, strengthening identity controls, and reviewing third-party dependencies.
- Organizations should assess resilience to disruption of cloud infrastructure and other services physically exposed to conflict.
Article Details
- Publisher
- EclecticIQ
- Report Period
- 2026-01-01 to 2026-03-31
- Scope
- Geopolitically linked cyber threats to enterprises and critical infrastructure, focusing on PRC, Russia, Iran, and opportunistic cybercrime.
- Key Statistics
- Public reporting describes Salt Typhoon targeting over 1,000 vulnerable Cisco network devices across more than 100 countries in early 2025.
- According to Microsoft analysis published in October 2025, Russian government-backed or aligned cyberattacks against NATO countries increased 25% in one year.
- As of late March 2026, researchers reportedly tracked nearly 5,800 cyberattacks by approximately 50 Iran-linked groups; industry sources caution that additional attacks are unreported.
- Public reporting indicates Handala may have used compromised administrative access and Microsoft Intune to wipe nearly 80,000 Stryker devices within three hours on 2026-03-11.
- The report records 2,302 data-leak-site victims in the first quarter of 2025, described as the highest quarterly total; these are leak-site records rather than independently confirmed incidents.
- Recommendations
- Patch, inventory, and harden internet-facing network devices; monitor unauthorized firmware, routing, and configuration changes.
- Remove OT control interfaces from the public internet, require multifactor authentication for remote OT access, replace default credentials, and audit IT/OT segmentation.
- Prioritize protection of privileged identities and administrative platforms, including remote management, identity providers, and privileged access management systems.
- Establish centralized logging with sufficient retention for threat hunting and prioritize behavioral detection of legitimate administrative tool abuse.
- Map third-party dependencies connected to conflict zones and stress-test business continuity against cloud-region disruption or physical destruction; assess multi-cloud or hybrid architectures.
MITRE ATT&CK
T0831The report describes actors manipulating OT setpoints and water-flow valves after gaining access to operational controls.T1078.004 · Cloud AccountsPublic reporting suggests Handala may have used a compromised Stryker administrator account in Microsoft Entra ID.T1102.002 · Bidirectional CommunicationGearDoor routes command-and-control traffic through Google Drive to resemble routine cloud usage.T1110 · Brute ForcePro-Russian hacktivist groups use brute-force tools against internet-exposed OT operational interfaces.T1136.003 · Cloud AccountPublic reporting suggests Handala created a new Global Administrator account during the Stryker operation.T1190 · Exploit Public-Facing ApplicationPRC-linked groups exploit internet-facing edge devices, and Silver Dragon exploits internet-facing servers for initial access.T1485 · Data DestructionHandala reportedly remotely wiped Stryker devices through Microsoft Intune; Iranian operations also wiped data at Israeli companies.T1543.003 · Windows ServiceSilver Dragon hijacks legitimate Windows services to blend malware into normal system activity.T1566 · PhishingSilver Dragon uses phishing for initial access; opportunistic cybercriminals use conflict-themed phishing to deliver infostealers and backdoors.
People
Mohammad Mehdi Farhadi RaminIranian cybercriminal on the FBI's most wanted list who allegedly stole American identities and accessed national security data for the Iranian government; reportedly killed in US-Israeli strikes.Yossi KaradiChief of Israel's National Cyber Directorate, cited as saying Iran-linked hackers wiped data from over 50 small Israeli companies.
Threat Actors
APT41Named as the ecosystem to which Silver Dragon is linked; the report does not state that the names are aliases.Cyber Army of Russia RebornPro-Russian hacktivist group described as moving from DDoS activity toward OT/IoT reconnaissance and claimed industrial disruption.CyberAv3ngersNamed in the assessment table in connection with pre-positioned OT/ICS access that may not require real-time C2 to activate.ELECTRUMDescribed as an access cluster associated with Sandworm, with demonstrated capability to target OT environments.Flax TyphoonReported to target Taiwan and U.S. critical infrastructure and build botnets using compromised IoT devices.HandalaShortened name used for Handala Hack; its alleged disruption of North Country Business Products POS terminals remains unverified.Handala HackAlso referred to as Handala; identified by Palo Alto Networks Unit 42 as a state-directed front for Iran's MOIS and associated with destructive operations against Stryker.Infrastructure Destruction SquadPro-Russian group that claimed industrial-network access in 2025; the report cautions that not all claims were independently verified.KAMACITEDescribed as an access cluster associated with Sandworm, with demonstrated capability to target OT environments.Laundry BearRussian hacking group attributed to the September 2024 Dutch National Police breach that stole officers' work-related contact data.Salt TyphoonPRC-linked group reported to have compromised telecommunications providers and targeted vulnerable Cisco network devices.SandwormAlso identified as APT44 and operated by Russia's GRU; linked to Ukrainian grid disruption and DynoWiper deployment against Polish energy infrastructure.SECT0R16Claimed access to industrial networks in Germany, Italy, and Poland in 2025; some reported access may involve test or simulated environments.Silk TyphoonLinked to the compromise of U.S. Treasury systems in late 2024.Silver DragonChina-nexus group linked to the APT41 ecosystem, targeting government ministries in Southeast Asia and Europe and using GearDoor.TwoNetRussia-aligned group reported to have accessed a simulated water-treatment environment and attempted disruption in September 2025.UNC5221China-nexus actor linked to BRICKSTORM operations targeting government and IT-sector environments.Volt TyphoonTargets US critical infrastructure and uses living-off-the-land techniques for sustained access; the report highlights intrusions affecting Guam.VoltziteTracked by Dragos and described as embedding malware in US energy utilities to access OT devices.Z-AlliancePro-Russian hacktivist group described as moving toward OT/IoT reconnaissance and claimed disruptive industrial attacks.Z-PentestClaimed access to industrial networks in Germany, Italy, and Poland in 2025; the report cautions that not all claims were verified.
Malware
BRICKSTORMAnother high-profile campaign involves the BRICKSTORM backdoor, linked to China-nexus actor UNC5221 and observed by Google/Mandiant, which targets VMware hypervisor and Windows environments across government and ITDYNOWIPERA decade later, the same group demonstrated that this capability now extends to NATO territory, deploying DynoWiper malware against Poland’s energy infrastructure in December 2025 [25].GearDoorIts custom backdoor, GearDoor, routes command-and-control traffic through Google Drive, disguising malicious communication as routine cloud usage.Shamoonthose of Russia and China, Iranian cyber units have demonstrated consistent offensive capacity from the Shamoon virus that crippled Saudi Aramco in 2012 to sustained campaigns against US financial institutions and the
Vendors
Amazon Web ServicesAmazon Web Services data centers in the UAE and Bahrain suffered structural damage from Iranian kamikaze drone strikes.CiscoActivity observed since at least 2021, including the targeting of over 1,000 vulnerable Cisco network devices across more than 100 countries in early 2025, indicates a level of coordination that may reflect moreFortinetof vulnerabilities in Ivanti Connect Secure, Palo Alto Networks PAN-OS, multiple Cisco IOS XE products, Fortinet, Juniper, SonicWall, Nokia, and Sierra Wireless devices [15].Ivantidevices as the most critical defensive action, with confirmed exploitation of vulnerabilities in Ivanti Connect Secure, Palo Alto Networks PAN-OS, multiple Cisco IOS XE products, Fortinet, Juniper, SonicWall,Juniperin Ivanti Connect Secure, Palo Alto Networks PAN-OS, multiple Cisco IOS XE products, Fortinet, Juniper, SonicWall, Nokia, and Sierra Wireless devices [15].MicrosoftAccording to Microsoft analysis published in October 2025, Russian government-backed or aligned cyberattacks against NATO countries surged 25% in a single year [23].NokiaConnect Secure, Palo Alto Networks PAN-OS, multiple Cisco IOS XE products, Fortinet, Juniper, SonicWall, Nokia, and Sierra Wireless devices [15].North Country Business ProductsOn 28 March 2026, Handala published a claim on its dedicated leak site alleging a breach of North Country Business Products, a US-based provider of point-of-sale systems serving major retail chains nationwide [42].Palo Alto Networkscritical defensive action, with confirmed exploitation of vulnerabilities in Ivanti Connect Secure, Palo Alto Networks PAN-OS, multiple Cisco IOS XE products, Fortinet, Juniper, SonicWall, Nokia, and Sierra WirelessSierra WirelessPalo Alto Networks PAN-OS, multiple Cisco IOS XE products, Fortinet, Juniper, SonicWall, Nokia, and Sierra Wireless devices [15].SonicWallin Ivanti Connect Secure, Palo Alto Networks PAN-OS, multiple Cisco IOS XE products, Fortinet, Juniper, SonicWall, Nokia, and Sierra Wireless devices [15].VMwareBRICKSTORM backdoor, linked to China-nexus actor UNC5221 and observed by Google/Mandiant, which targets VMware hypervisor and Windows environments across government and IT sector organizations [10].
Products
Cisco IOS XEexploitation of vulnerabilities in Ivanti Connect Secure, Palo Alto Networks PAN-OS, multiple Cisco IOS XE products, Fortinet, Juniper, SonicWall, Nokia, and Sierra Wireless devices [15].Google DriveIts custom backdoor, GearDoor, routes command-and-control traffic through Google Drive, disguising malicious communication as routine cloud usage.Ivanti Connect Securedevices as the most critical defensive action, with confirmed exploitation of vulnerabilities in Ivanti Connect Secure, Palo Alto Networks PAN-OS, multiple Cisco IOS XE products, Fortinet, Juniper, SonicWall, Nokia,Microsoft Entra IDpublic reporting, the group may have leveraged a compromised Stryker administrator account within Microsoft Entra ID, created a new Global Administrator account, and used Microsoft Intune to remotely wipe nearlyMicrosoft Intuneaccount within Microsoft Entra ID, created a new Global Administrator account, and used Microsoft Intune to remotely wipe nearly 80,000 devices in a three-hour window on 11 March [40].Microsoft WindowsThe group exploits internet-facing servers and uses phishing for initial access, then hijacks legitimate Windows services to blend malware into normal system activity.PAN-OSaction, with confirmed exploitation of vulnerabilities in Ivanti Connect Secure, Palo Alto Networks PAN-OS, multiple Cisco IOS XE products, Fortinet, Juniper, SonicWall, Nokia, and Sierra Wireless devices [15].VMware hypervisorbackdoor, linked to China-nexus actor UNC5221 and observed by Google/Mandiant, which targets VMware hypervisor and Windows environments across government and IT sector organizations [10].
Countries
BahrainAmazon Web Services data centers in the UAE and Bahrain suffered structural damage from Iranian kamikaze drone strikes.BelgiumThe UK, Germany, Belgium, Italy, Estonia, France, the Netherlands, and Poland all ranked among the top targets.CanadaIntensifying information operations targeting Western elections (Poland, Germany, Canada, Moldova) and NATO cohesionChinaThe People's Republic of China (PRC) represents the most significant long-term cyber threat to defense-aligned and enterprise organizations.Cyprusand Israeli air strikes, span Bahrain, the United Arab Emirates, Israel, and Cyprus.EstoniaThe UK, Germany, Belgium, Italy, Estonia, France, the Netherlands, and Poland all ranked among the top targets.FranceThe UK, Germany, Belgium, Italy, Estonia, France, the Netherlands, and Poland all ranked among the top targets.GermanyGermany, one of the primary targets for Russia, has traditionally been reluctant to conduct offensive cyber operations.IranThe conflict in Iran is likely to break the pattern observed in previous regional crises, where cyberattack volumes spiked briefly before returning to baseline.IsraelPro-Iranian hacktivist groups will highly likely continue targeting organisations in the US and Israel.ItalyThe UK, Germany, Belgium, Italy, Estonia, France, the Netherlands, and Poland all ranked among the top targets.MoldovaIntensifying information operations targeting Western elections (Poland, Germany, Canada, Moldova) and NATO cohesionNetherlandsThe UK, Germany, Belgium, Italy, Estonia, France, the Netherlands, and Poland all ranked among the top targets.NorwayAvailable: https://www.theguardian.com/world/2025/aug/14/russian-hackers-control-norwegian-dam-norwayPolandThe UK, Germany, Belgium, Italy, Estonia, France, the Netherlands, and Poland all ranked among the top targets.RussiaRussia presents the most imminent operational risk to European critical infrastructure, with confirmed OT-capable cyberattacks against energy and water systems across European Union (EU) member states.SpainThroughout 2025, pro-Russian actors continued to show interest in water-sector environments across several European countries, including Spain, Italy, Poland, and France.TaiwanThis access appears intended for possible activation during a future geopolitical crisis, likely a Taiwan contingency.Ukraineactivity suggests an intent to undermine public trust, deepen political divisions, weaken support for Ukraine, and probe Western red lines, while remaining below the threshold likely to trigger a collective defenseUnited Arab Emiratesand Israeli air strikes, span Bahrain, the United Arab Emirates, Israel, and Cyprus.United KingdomThe UK, Germany, Belgium, Italy, Estonia, France, the Netherlands, and Poland all ranked among the top targets.United StatesIf a power vacuum emerges, these actors could fuel decentralized and ideologically driven cyberattacks against US and Israeli infrastructure, operating outside the geographic limits of conventional warfare.
Industries
AI researchThe targeting of AI research institutions and technology companies has intensified in parallel.DefenseThe People's Republic of China (PRC) represents the most significant long-term cyber threat to defense-aligned and enterprise organizations.EnergyRussia presents the most imminent operational risk to European critical infrastructure, with confirmed OT-capable cyberattacks against energy and water systems across European Union (EU) member states.Financial ServicesBuilding latent disruptive capability across government entities, telecommunications, financial services, energy, transportation, and defense sectors suggests a focus on long-term strategic access.food and agricultureThese groups actively exploit internet-facing VNC connections and HMI devices with default or weak credentials to gain direct access to OT control systems in the water, energy, and food and agriculture sectors.GovernmentPRC-linked cyber operations are widely regarded as a significant long-term threat to enterprise and government networks, particularly due to their ability to remain undetected for extended periods, with dwell timesITIran's technically skilled cyber workforce, shaped by years of state investment, does not disappear when central coordination is disrupted - instead it disperses.Legalthink tanks, law firms, and financial institutions, reflecting sustained interest in regulatory, legal, and policy intelligence that could strengthen Beijing's hand in international negotiations and tradeManufacturingIf European nations align with the US-Israeli position, this targeting is likely to expand to European entities including but not limited to finance, energy, and manufacturing.medical technologyIran's Ministry of Intelligence and Security (MOIS), conducted a destructive operation against US medical technology company Stryker [39].RetailOn 28 March 2026, Handala published a claim on its dedicated leak site alleging a breach of North Country Business Products, a US-based provider of point-of-sale systems serving major retail chains nationwide [42].semiconductorManufacturing and semiconductor companies were targeted at higher rates than in previous years, directly aligned with China's drive for technological self-sufficiency and its stated objective of reducing dependence onTelecommunicationsattack surface has expanded beyond the enterprise perimeter into cloud infrastructure, OT systems, telecommunications networks, and third-party supply chains.TransportationBuilding latent disruptive capability across government entities, telecommunications, financial services, energy, transportation, and defense sectors suggests a focus on long-term strategic access.waterRussia presents the most imminent operational risk to European critical infrastructure, with confirmed OT-capable cyberattacks against energy and water systems across European Union (EU) member states.