Augur Reports Iranian APT Infrastructure Buildup Before Epic Fury
Summary
Augur Security says Iranian-linked groups expanded infrastructure activity before the February 2026 US-Israeli strikes, while an estimated 60-plus hacktivist groups coordinated cyber activity afterward.
Key points
- Augur reports increased infrastructure activity among several MOIS- and IRGC-linked groups in the six months before the February 28, 2026 strikes.
- Augur assessed that MuddyWater's September 2025 infrastructure spike was consistent with pre-operational staging, with medium confidence that it was preparation for post-strike operations.
- The report describes multi-tier infrastructure involving an Iranian ISP, bulletproof hosting providers and additional shell-company layers.
- The report says an Electronic Operations Room formed within 24 hours of the strikes to coordinate an estimated 60 or more hacktivist groups.
- Reported targets were primarily Israeli and US government, financial and critical-infrastructure organizations, with Gulf states described as a secondary focus.
- The article says damage to Iran's internal internet connectivity did not seriously affect Iranian APTs' ability to continue and expand operations.
Article Details
- Event Type
- Reported preparation and expansion of Iranian-linked cyber operations before and after the February 28, 2026 US/Israeli strikes against Iran, including increased infrastructure activity and coordinated hacktivist activity.
- Impact
- Augur Security reported increased infrastructure activity by government-linked Iranian groups in the six months before the strikes and a rapid post-strike expansion of hacktivist activity, with an estimated 60 or more groups coordinated through an Electronic Operations Room. Reported targets include Israeli and US government, financial, and critical-infrastructure organizations, as well as Gulf states described as facilitating the strikes. Augur assessed with medium confidence that MuddyWater’s infrastructure buildup was preparation for post-strike operations. The article says the strikes damaged Iran’s internal internet connectivity but did not seriously affect Iranian APTs’ ability to continue and expand cyber operations.
People
Threat Actors
BLEAK IONListed in Augur’s report among Iranian APTs linked to IRGC; the article pairs the name APT33 with Peach Sandstorm.Charming KittenListed in Augur’s report among Iranian APTs linked to IRGC-IO; the article pairs the name Charming Kitten with APT35.Cotton SandstormListed in Augur’s report among Iranian APTs linked to IRGC and described as coordinating affiliated collectives; the article pairs the name Cotton Sandstorm with Emennet Pasargad.Cyber FattahNamed among groups involved in the post-strike expansion of coordinated Iranian hacktivist activity.CyberAv3ngersListed in Augur’s report among Iranian APTs linked to IRGC-CEC.Emennet PasargadListed in Augur’s report among Iranian APTs linked to IRGC; the article pairs the name Emennet Pasargad with Cotton Sandstorm.Fatimiyoun Cyber TeamNamed among groups involved in the post-strike expansion of coordinated Iranian hacktivist activity.HandalaThe article identifies Handala as responsible for the attack against Stryker and says it has conducted data-exfiltration and wiper operations, primarily targeting Israel. It also describes Handala as part of the coordinated Iranian cyber response to the February 28 strikes.MuddyWaterAugur reported seven CIDRs flagged within 72 hours in mid-September 2025 and assessed with medium confidence that the infrastructure buildup was preparation for post-strike operations.OilRigListed in Augur’s report among Iranian APTs linked to MOIS; the article pairs the name OilRig with APT34.Peach SandstormListed in Augur’s report among Iranian APTs linked to IRGC; the article pairs the name Peach Sandstorm with APT33.RICH IONListed in Augur’s report among Iranian APTs linked to IRGC-IO; the article pairs the name APT35 with Charming Kitten.SOLAR IONListed in Augur’s report among Iranian APTs linked to MOIS; the article pairs the name APT34 with OilRig.
Vendors
AlexHostThe second tier involves bulletproof hosting providers, such as Moldovan ALEXHOST and Wyoming-based shell company RouterHosting LLC, historically associated with infrastructure linked to Iranian threat actors.Augur SecurityA study by Augur Security, which uses AI and behavioral modeling to provide early identification and mapping of malicious infrastructure, demonstrates that numerous government-linked groups (either with MOIS or one ofCloudblastA third tier involves further shell companies. Such as Cloudblast, registered in the US but operating from Dubai and routing through a Netherlands-based upstream provider, further complicating investigation andClouviderASN provider, with country codes spanning Russia, UK, and Estonia; and the remaining two are on Clouvider, “a UK-based general hosting provider with a documented history of abuse by multiple threat actorRouterHosting LLCThe second tier involves bulletproof hosting providers, such as Moldovan ALEXHOST and Wyoming-based shell company RouterHosting LLC, historically associated with infrastructure linked to Iranian threat actors.Sefroyek Pardaz EngineeringIt starts from Sefroyek Pardaz Engineering, an Iranian ISP and hosting company based in Tehran.Ultahostcomplicating investigation and enforcement with an additional jurisdiction layer. A second example, UltaHost has dual registration – UltaHost Inc in the US and ULTAHOST Ltd in the UK. It operates as a US parent
Countries
EstoniaFive are related to an Estonian ASN provider, with country codes spanning Russia, UK, and Estonia; and the remaining two are on Clouvider, “a UK-based general hosting provider with a documented history of abuse byIranAmerica, Israel and ‘facilitating’ Gulf states received malicious attacks from Iranian APTs within days of Epic Fury, and there are around 60 Iran-linked hacktivist groups currently operating.IsraelAmerica, Israel and ‘facilitating’ Gulf states received malicious attacks from Iranian APTs within days of Epic Fury, and there are around 60 Iran-linked hacktivist groups currently operating.Netherlandscompanies. Such as Cloudblast, registered in the US but operating from Dubai and routing through a Netherlands-based upstream provider, further complicating investigation and enforcement with an additionalRussiaFive are related to an Estonian ASN provider, with country codes spanning Russia, UK, and Estonia; and the remaining two are on Clouvider, “a UK-based general hosting provider with a documented history of abuse byUnited StatesA third tier involves further shell companies. Such as Cloudblast, registered in the US but operating from Dubai and routing through a Netherlands-based upstream provider, further complicating investigation and
Industries
Critical infrastructureThe primary focus has been on Israeli and the US government, financial, and critical infrastructure organizations.Governmentto provide early identification and mapping of malicious infrastructure, demonstrates that numerous government-linked groups (either with MOIS or one of the Islamic Revolutionary Guard Corps – IRGC – cyber units)