Midyear Assessment Finds Iran-Linked Cyber Risk Centered on Persistent Access and Trusted Pathways

Jul 21, 2026 · Original article ↗

Summary

SentinelLABS assesses that Iran-linked cyber activity remains focused on persistent access, espionage, persona-led coercion, and exposed OT systems, while public claims often exceed verified effects and visibility inside Iran remains limited.

Key points

The assessment identifies persistent access through compromised accounts, service providers, remote-management tools, and trusted administrators as a strategic risk that can enable later collection or disruption.
Iran-linked activity spans distinct state-linked operators, surveillance clusters, personas, and opportunists; public labels do not necessarily represent separate actors or proven command relationships.
MOIS-linked personas combine intrusion, data disclosure, destruction, and coercion. Claims about impact, including some associated with the Stryker incident, remain unverified beyond confirmed victim or government reporting.
A U.S. government advisory documented Iranian-affiliated activity against internet-facing Rockwell Automation and Allen-Bradley PLCs, with reported operational disruption and financial loss. Interface access alone does not prove process manipulation or physical impact.
Iran's June banking disruptions affected shared services across multiple banks, but public evidence does not establish a single coordinated campaign or identify an actor; the assessment highlights concentration and recovery dependencies.
The assessment says connectivity restrictions, fragmented disclosure, and surveillance inside Iran limit incident visibility, while informal channels used to bypass restrictions can expose users to malware such as MarkiRAT.
Defender priorities include securing identity, cloud, RMM, and service-provider access; removing direct OT exposure; strengthening remote access and monitoring; and ensuring recovery systems do not share compromised dependencies.

Article Details

Publisher: Sentinel One Labs
Report Period: Assessment current as of 2026-07-21; incidents discussed primarily from February through June 2026.
Scope: Midyear assessment of Iran-linked cyber activity, cyber-physical risk, incidents inside Iran, and defender priorities.
Key Statistics: Unit 42 identified six new Screening Serpens RAT variants deployed between February and April against apparent targets in the United States, Israel, the UAE, and the wider Middle East.
On June 14, Iranian authorities reported that an attack on shared communications infrastructure disrupted services at four banks.
A second reported attack on June 23 disrupted card services at three banks.
The article reports that Iran began restoring international connectivity after an 88-day shutdown; restoration was partial and uneven.
The U.S. Department of Justice seized four domains associated with Handala, Homeland Justice, KarmaBelow80, and a related Red Wanted operation in March.
Recommendations: Review identity, cloud, remote-management, and service-provider relationships for persistent access and trusted pathways; map shared dependencies and recovery paths.
Coordinate technical response, legal review, communications, and physical-safety support during persona-led incidents, since publication and employee targeting may begin before incident scoping is complete.
For OT environments, remove direct internet exposure, put remote access behind authenticated gateways with phishing-resistant MFA, restrict programming-mode and logic changes, and limit vendor access by source and time.
Monitor engineering workstations and industrial protocols, preserve offline project files and known-good configurations, and verify that recovery does not rely on the same potentially compromised identity, virtualization, or management environment.
Validate claims of cyber-physical impact with evidence such as logs, process data, engineering review, operator testimony, timestamps, configuration evidence, or independent confirmation.