FuryMalware
RansomwareFrom MISP Galaxy
Last reported 11 days ago, by Tenable9 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1110.003Password Spraying
“…y la NSA publicada en octubre de 2024 documentó una campaña de un año en la que actores iraníes usaron password spraying y MFA push‑bombing (inundar a los usuarios con solicitudes de inicio de sesión hasta que alguien apruebe una por error) para…”
- T1684Social Engineering
“Deployed against Windows systems since the Fall of 2023, this multi-stage malware, delivered via social engineering and masquerading as programs or services – targeted Iranian dissidents, journalists and members of organizations with views opposing the government of Iran, among o…”
- T1036Masquerading
“Victims were contacted via messaging applications, where they received the first stage of the malware – masquerading as a legitimate program.”
- T1195Supply Chain Compromise
“When it comes to attacks that give bad actors a lot of bang for their buck, supply chain compromise typically reigns supreme.”
- T1213.005Messaging Applications
“Victims were contacted via messaging applications, where they received the first stage of the malware – masquerading as a legitimate program.”
- T1219Remote Access Tools
“If you rely on MSPs, inquire about how they secure their remote access tools and whether they've reviewed their own exposure in light of the conflict.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
Critical infrastructure orgs face heightened cyber risk from nation-state groups, AI threats“launched Operation Epic Fury in February, according to the U.S.”
-
The 2026 U.S. Midterms Election Season, Weakened Defenses: The Cyber Landscape Ahead“FBI agents from the CI-12 counterespionage unit, which specialized in monitoring Iranian threats, were fired days before Operation Epic Fury for their prior involvement in the classified documents investigation.”
-
The Flashpoint Threat Intelligence Brief: Middle East“Following Operation Epic Fury, regional kinetic operations have transitioned into direct, persistent threats against commercial shipping, energy infrastructure, and critical supply chains.”
-
HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack“…ramed its destructive attacks and leaks against Albania as retaliation for Tirana’s support for the MEK; years later, amid Operation Epic Fury, Handala turned the same model of cyber-enabled coercion against Iranian dissidents, Israeli military and government personnel, U.S.”
-
The Evolution of Hacktivism in Hybrid Warfare: Modern Tactics and Real-World Impact“…igns are opportunistic and tied to global events—from the escalation in the Middle East following military operations like Operation Epic Fury, to the Milan-Cortina Winter Olympics and new aid packages to Ukraine.”
-
US Sanctions Iranian $6bn Crypto “Exchange” Shelbit“…asury, Scott Bessent said, “The Iranian regime’s reliance on digital assets and shadow banking networks is further evidence that Economic Fury is working.”
-
AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict“… Israel predates the January 2026 protest crackdown and the February 28, 2026, coordinated US-Israeli airstrikes, known as Operation Epic Fury / Roaring Lion.”
-
El impacto en la ciberseguridad de la guerra en Irán: riesgos clave que debe monitorear“A pocas horas de la operación conjunta entre Estados Unidos e Israel, “Operation Epic Fury” (“Operation Roaring Lion”), del 28 de febrero, actores de cyber vinculados a Irán se movilizaron en gran número: Unit 42 de Palo Alto Networks contabilizó m&aac…”
-
Cyber fallout from the Iran war: What to have on your radar“Within hours of the US-Israel ‘Operation Epic Fury’ (‘Operation Roaring Lion’) on February 28th, Iran-nexus cyber-actors mobilized in large numbers – Palo Alto Networks' Unit 42 counted more than 60 active pro-Iranian hacktivist groups.”
Indicators in its reports
named in the reports above- justicehomeland[.]orgin 1 report
- karmabelow80[.]orgin 1 report
- handala-redwanted[.]toin 1 report
- handala-hack[.]toin 1 report
- hxxps://sgp1.vultrobjects[.]com/jttrepijgdb/in 1 report
- sgp1.vultrobjects[.]comin 1 report
- hxxps://sgp1.vultrobjects[.]com/jttrepijgdb/efg_d4.zipin 1 report
- hxxps://api.telegram[.]org/bot783XXXX576in 1 report
- hxxps://api.telegram[.]org/bot772XXXX818in 1 report
- hxxps://api.telegram[.]org/file/in 1 report
- 8219453084f370ce…d82d617f26ddin 1 report
- 0190940243f6535f…43d493159e14in 1 report
- b3c1a3eebefafe1346c6a864b5423182in 1 report
- 47fa634b13b8ba35…68f848825de4in 1 report
- 88a8d118ee190ac3…6ddd2dda517bin 1 report
- b2f6f40570ac9085b5463fdb623560dein 1 report
- d2d19c7f2e4a5fdc…df32307c377ein 1 report
- 9108466c98df0103…0c23372c52f2in 1 report
- 16602375fc2dae1eb54580ab7eda6567in 1 report
- 3befcca381deb6b4…4754a4b74e81in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.