Back to Threat Intel
Special ReportTLP:REDCLOUD-KINETIC-2026-03-01

THE NIGHT THE
DATA CENTERS
WENT DARK

CLOUD WAR — MARCH 2026 / IRAN–ISRAEL HYBRID CONFLICT ANALYSIS

INCIDENT DATE
01 MAR 2026
02:30 UTC
ACTIVE INVESTIGATION

The March 2026 cyber-kinetic conflict marks the first large-scale convergence of physical military strikes and coordinated state-sponsored cyber operations against public cloud hyperscale infrastructure. Drone strikes on AWS facilities in the UAE and Bahrain triggered cascading failures across cloud regions, a record-breaking 5.2 Tbps DDoS campaign, a multi-actor supply-chain worm (Shai-hulud 2.0), and deep enterprise intrusions via the Dindoor/CHAR/RustyWater malware ecosystem. This report synthesizes the full kill chain, threat actor attribution, enriched IOCs, and strategic implications backed by current threat intelligence.

5.2 Tbps
Peak DDoS Volume
~14 hrs
Control Plane Outage
6 APTs
Threat Actor Groups
3 AZs
AWS Zones Impaired
1.3 TB
SNOC Data Exfiltrated
>$400M
Gulf Economic Impact
67 hrs
Israeli Bank Downtime
96%
Iran Internet Blackout
Geopolitical Background

◆ OPERATION EPIC FURY / ROARING LION

On Feb 28, 2026 22:00 UTC, US and Israeli forces launched a coordinated cyber-kinetic offensive against Iranian nuclear, C2, and air-defense infrastructure. Operation Epic Fury (US) ran parallel to Operation Roaring Lion (Israel).

  • B-2 Spirit and F-35I strikes under radar-silent corridors — Iranian air defense SCADA compromised months prior
  • BGP manipulation drops Iranian internet to 4% of normal capacity within 60 minutes
  • BadeSaba prayer app (30M+ users) backend hacked — IRGC personnel receive defection push notifications
  • IRIB state TV satellite feeds overridden for 10+ minutes via DVB-S signal injection
  • GNSS jamming across Persian Gulf disrupts Shahed-136 loitering munition navigation
  • Iranian C2 communications severed — attack cells forced to execute from Lebanon, Iraq, and Russia

◆ IRANIAN RETALIATION — CLOUD-FIRST DOCTRINE

Iran's response marked a fundamental doctrine shift from shadow-war espionage to Cloud-First destructive operations. The Electronic Operations Room was established Feb 28 — coordinating MOIS APTs, IRGC proxies, and Russian-aligned hacktivists from outside Iranian borders.

  • Drone strikes on AWS me-central-1 (UAE) and me-south-1 (Bahrain) — first kinetic attacks on hyperscale cloud infrastructure
  • Electronic Operations Room: Handala Hack + 313 Team + Russian Legion formal coordination
  • Shai-hulud 2.0 npm worm deployed in software supply chains — targets CI/CD secret theft
  • Dindoor pre-positioned backdoors activate in Gulf VPN/firewall appliances after months of dormancy
  • Shamoon 4.0 + SHAPESHIFT wipers deployed against Saudi, Israeli, Jordanian critical infrastructure
  • RedAlert.apk distributed to Israeli civilians — mass SMS 2FA intercept and GPS tracking

◆ ELECTRONIC OPERATIONS ROOM — COMMAND STRUCTURE

Cyber Espionage & Pre-positioning
· MuddyWater / Seedworm
· APT34 / OilRig
Destructive Operations & Wipers
· APT33 / Peach Sandstorm
· Handala Hack
DDoS & Influence Ops
· 313 Team (IRGC Proxy)
· Russian Legion
Incident Timeline

Chronological Event Matrix

Feb 28 — 22:00 UTC
Operation Epic Fury / Roaring Lion

Joint US-Israeli cyber-kinetic strikes on Iranian nuclear, C2, and air-defense infrastructure. BGP manipulation collapses Iran's internet to 4% capacity within 60 minutes. BadeSaba prayer app (30M+ users) backend compromised — IRGC personnel receive defection-urging push notifications. IRIB state TV satellite feeds overridden for 10+ minutes via DVB-S signal injection with anti-regime content. GNSS jamming across the Persian Gulf disrupts Shahed-136 loitering munition navigation. B-2 Spirit and F-35I strikes execute under radar-silent corridors created by compromised Iranian SCADA-controlled air defense systems.

Mar 1 — 02:30 UTC
Drone Strikes — AWS me-central-1 (UAE)

Two small aerial objects penetrate UAE airspace. First detonation near power distribution supplying AWS me-central-1 AZ mec1-az2. Second impact hits cooling infrastructure of the adjacent complex. AWS AZ mec1-az3 sustains nearby impact blast damage. Fire suppression agents deploy across multiple zones simultaneously — water floods PDUs under raised flooring, arc faults trigger emergency shutdowns, storage arrays lose controller connectivity, and network switches go dark.

Mar 1 — 02:45 UTC
AWS me-south-1 (Bahrain) Hit

Separate drone strike targets data center infrastructure in Bahrain. One AWS Availability Zone in me-south-1 sustains proximity damage. Foundational services (S3, DynamoDB) begin degraded operation. The Elastic IP 'EIP Trap' emerges: API calls to disassociate EIPs fail due to regional control-plane degradation — customers cannot failover away from impaired zones.

Mar 1 — 02:50 UTC
AWS API Death Spiral Begins

Millions of Kubernetes clusters, autoscaling groups, and serverless runtimes simultaneously attempt recovery. EC2 API saturates from simultaneous RunInstances calls. Lambda execution environments time out, generating cold-start storms. AWS begins throttling (HTTP 429) — applications interpret throttle responses as new failures and retry, exponentially amplifying the spiral. CloudFormation and IAM APIs return 500 errors. Pilot-light DR plans fail: they required the impaired region's Control Plane to function.

Mar 1 — 03:15 UTC
DDoS Campaign Peaks at 5.2 Tbps

Electronic Operations Room (Handala + 313 Team + Russian Legion) launches record-volume attack combining IoT botnets, hijacked consumer routers, and cloud-hosted amplifiers. AI-assisted DDoS tooling sustains the volume. DNS infrastructure, financial clearing systems, and cloud edge gateways are targeted. Recursive DNS cache poisoning poisons regional resolvers. CloudFront and Route53 routing degrades globally due to control-plane lag.

Mar 1 — 04:00 UTC
Dindoor & Shai-hulud 2.0 Activate

MuddyWater/Seedworm activates pre-positioned Dindoor (Deno-based) backdoors in VPN gateways and firewall appliances across Gulf enterprise networks. Simultaneously, Shai-hulud 2.0 — a self-replicating npm/CI worm — activates in software supply chains, targeting AWS Secrets Manager, GCP Secret Manager, and Azure Key Vault credentials. CI/CD pipelines with malicious pull_request_target workflows begin leaking secrets. Credential harvesting of cloud API tokens begins under cover of the AWS chaos.

Mar 1 — 06:00 UTC
Gulf Banking Sector Fails

Mobile banking platforms across the Gulf collapse. Emirates NBD customers experience login failures and delayed transactions. Careem, Alaan, Hubpay, and Sarwa report 24–48h outages. Bank Hapoalim and Bank Leumi (Israel) suffer 67 combined hours of disruption. DFM/ADX markets open limit-down (–5%). Brent crude surges above $81/bbl on Gulf supply disruption fears. Total Gulf economic impact estimated at $400M+.

Mar 1 — 08:00 UTC
Wiper Malware Wave — Shamoon 4.0 / SHAPESHIFT

APT33 deploys Shamoon 4.0 (MBR wiper with Rust companion modules) and SHAPESHIFT (Stonedrill evolution) against Israeli, Saudi, and Jordanian critical infrastructure. SPLITDROP dropper arrives via phishing lures mimicking Cisco Webex invitations (meetingapp.site). Targets include Israeli National Grain Silos, Saudi Aramco-linked suppliers, and Jordanian utility SCADA systems. APT34's SideTwist and DNS-tunneling implants simultaneously activate in Gulf financial sector networks, having maintained months-long silent pre-positioning.

Mar 1 — 10:00 UTC
Handala Claims SNOC Breach (1.3TB)

Handala Hack Team announces exfiltration of 1.3TB from Sharjah National Oil Corporation (SNOC) on their Telegram channel, simultaneously claiming breaches of Israel Opportunity Energy and Aramco-linked suppliers. Exfiltrated data includes confidential bank records, oil contracts, exploration project data, and internal communications. Data is staged on Wasabi S3-compatible storage via Rclone using stolen API credentials.

Mar 1–3
Global Spillover & Infrastructure Recovery

AWS recommends migrating workloads to EU/US regions. SaaS platforms reroute GPU inference to Europe and Asia. Organizations unable to failover due to UAE data-residency requirements (NESA/TDRA) explore Azure UAE North as cross-cloud secondary. BGP stabilization gradually restores regional routing. UAE Central Bank confirms 146.6% liquidity coverage — no systemic financial collapse.

Mar 5, 2026
Full Financial Services Restored

UAE Central Bank confirms all financial systems operational. Emirates NBD waives GCC ATM fees through March 31. Separate Amazon global retail outage (faulty code deployment, unrelated to strikes) briefly re-alarms public. No confirmed customer data breaches from AWS physical damage. UAE Sovereign Financial Cloud fast-track initiative formally announced.

Threat Actor Attribution

Electronic Operations Room — Actor Profiles

Tap an actor to expand full operational details, tools, and IOCs

Indicators of Compromise

Network Indicators(21 indicators)

IndicatorType
api.ra-backup[.]com
Domain
216.45.58.148
IPv4
shirideitch[.]com
Domain
update.centos-yum[.]com
Domain
serialmenot[.]com
Domain
149.56.76[.]26
IPv4
185.236.25[.]119
IPv4
194.11.246[.]101
IPv4
codefusiontech[.]org
Domain
promoverse[.]org
Domain
jerusalemsolutions[.]com
Domain
stormplayavia[.]com
Domain
meetingapp.site
Domain
subreviews.azurewebsites.net
Domain
satellite2.azurewebsites.net
Domain
nomercys.it.com
Domain
159.198.66.153
IPv4
161.35.228.250
IPv4
209.74.87[.]100
IPv4
162.0.230.185
IPv4
0x2B77671cfEE4907776a95abbb9681eee598c102E
ETH

File Hashes(12 samples)

RedAlert.apkHandala Trojan
83651b0589665b112687f0858bfe2832ca317ba75e700c91ac34025ee6578b72
Dindoors.binDindoor Backdoor (MD5)
decd6b94792a22119e1b5a1ed99e8961
Trojan.DindoorDindoor (Deno RT)
0f9cf1cf8d641562053ce533aaa413754db88e60404cab6bbaa11f2b2491d542
Trojan.FakesetFakeset (Python)
077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de
CHAR BackdoorCHAR (Rust/Telegram)
7523e53c979692f9eecff6ec760ac3df5b47f172114286e570b6bba3b2133f58
GhostFetch LoaderGhostFetch (Rust)
e61b2ed360052a256b3c8761f09d185dad15c67595599da3e587c2c553e83108
RustyWater / Archer RATRustyWater (Rust)
76aad2a7fa265778520398411324522c57bfd7d2ff30a5cfe6460960491bc552
CertificationKit.iniRustyWater Dropper
ddc6e6c76ac325d89799a50dffd11ec69ed3b5341740619b8e595b8068220914
SPLITDROP DropperShamoon 4.0 Chain
f38a56b8dc0e8a581999621eef65ef497f0ac0d35e953bd94335926f00e9464f
Tickler PEAPT33 Tickler (C++)
7eb2e9e8cd450fc353323fd2e8b84fbbdfe061a8441fd71750250752c577d198
Sold.dllTickler (Sideloaded DLL)
ccb617cc7418a3b22179e00d21db26754666979b4c4f34c7fda8c0082d08cec4
sysuu2etiprun.jsShai-hulud 2.0 Bot Payload
bedb882c6e2cf896e14ecf12c90aaa6638f780017d1b8687a40b4a81956e230f
Exploited Vulnerabilities
CVE-2025-59718CRITICAL
Fortinet FortiOS

Authentication bypass via forged SAML response allows unauthenticated admin access. Exploited by MuddyWater to create persistent 'FortiSetup' super_admin accounts across Gulf enterprise VPN gateways.

CVE-2025-59719CRITICAL
Fortinet FortiOS

Companion bypass used in combination with CVE-2025-59718 for full device compromise and persistent backdoor implantation. Used as a chained exploit for complete FortiGate takeover.

Cisco VPN — Unpatched FirmwareHIGH
Cisco ASA / VPN Gateways

Unpatched firmware exploited by MuddyWater for lightweight Dindoor implant deployment. Persistent access established 3–6 months before March 1 as long-term pre-positioning.

ms-ds-MachineAccountQuota (Default: 10)HIGH
Active Directory / AWS Managed AD

Default quota allows any domain user to join machine accounts, enabling Resource-Based Constrained Delegation (RBCD) lateral movement. Exploited during the AWS API chaos window when security monitoring was degraded.

Shai-hulud 2.0 — pull_request_targetHIGH
GitHub Actions / CI Pipelines

Malicious pull_request_target workflow injection leaks all repository secrets via toJSON(secrets). Part of Handala's npm supply chain worm targeting AWS/GCP/Azure credentials stored in CI environments.

EtherHiding — Ethereum C2MEDIUM
Enterprise Network Perimeters

APT34 uses Ethereum smart contract (0x2B77671cfEE...) as an immutable, uncensorable C2 resolver. Standard domain/IP blocklists are ineffective. Requires blocking blockchain RPC endpoints at the network level.

Technical Analysis

◆ DINDOOR — DENO RUNTIME BACKDOOR

MuddyWater / MOIS · First observed Feb 2026 · Cert: "Amy Cherne"

Dindoor leverages the Deno JavaScript/TypeScript runtime as a compiled standalone executable, bypassing Windows Script Host detection and evading EDR telemetry. Pre-positioned 3–6 months before activation.

  • Pre-positioned in FortiGate, Cisco ASA, and Palo Alto appliances via CVE-2025-59718/19
  • Activates via beacon to api.ra-backup[.]com on chaos-condition trigger (internet blackout detection)
  • Harvests cloud API tokens, SSH keys, and VPN session cookies from memory
  • Exfiltrates via Rclone to Wasabi S3-compatible storage using stolen credentials
  • RBCD abuse: creates machine accounts under ms-ds-MachineAccountQuota for AD lateral movement
  • Certificate CN 'Amy Cherne' — use as a hunt pivot across EDR telemetry

◆ SHAI-HULUD 2.0 — NPM/CI CLOUD WORM

Handala Hack · Supply chain worm · AWS/GCP/Azure secret theft

A self-replicating worm distributed via poisoned npm packages with preinstall scripts targeting cloud secrets in CI/CD pipelines. Designed for mass credential harvesting during the chaos window.

  • Distributed via npm packages with setup_bun.js preinstall scripts
  • Targets AWS Secrets Manager, GCP Secret Manager, Azure Key Vault
  • CI/CD poisoning: injects pull_request_target workflows to leak toJSON(secrets)
  • Wipes home directory if credential harvest or GitHub auth fails (destructive fallback)
  • Replicates via git config --global init.templateDir to poison future repositories
  • Key: bedb882c6e2cf896e14ecf12c90aaa6638f780017d1b8687a40b4a81956e230f (sysuu2etiprun.js)

◆ CHAR BACKDOOR — RUST + TELEGRAM C2

MuddyWater / Operation Olalampo · Telegram bot: @stager_51_bot

CHAR uses a Telegram bot as its Command & Control channel, enabling operators to issue shell commands via chat messages. Built in Rust with AI-assisted development (emoji-based debug strings confirmed by Group-IB researchers).

  • Persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\CertificationKit
  • Default path: C:\ProgramData\CertificationKit.ini (executed as binary at runtime)
  • GhostFetch loader pre-validates environment — checks for VBoxGuest.sys, vmtoolsd.exe, mouse movement
  • Deploys Kalim secondary backdoor and SOCKS5 reverse proxy for lateral movement
  • AnyDesk dropped as backup persistence path if CHAR is killed
  • User-Agent: reqwest/0.12.23 (default Rust library — often unchanged by operators)

◆ AWS API DEATH SPIRAL — CONTROL PLANE COLLAPSE

AWS me-central-1 · AZ mec1-az2 & mec1-az3 impaired · EIP Trap

When two AZs lost power simultaneously, millions of recovery systems created a self-amplifying throttle cascade. Pilot-light DR plans failed because they required the impaired region's Control Plane APIs to function.

  • EIP Trap: Elastic IPs 'trapped' — disassociation API calls fail due to control-plane degradation
  • K8s control planes issue simultaneous node replacement calls → EC2 API saturation
  • Lambda cold-start storm: timed-out environments generate amplified retry loops
  • AWS throttles (HTTP 429) → apps interpret as new failures → exponential retry amplification
  • IAM and CloudFormation APIs return 500 errors — Pilot Light DR plans paralyzed
  • Data residency (NESA/TDRA): UAE workloads legally cannot failover to EU — cross-cloud to Azure UAE North required

◆ SHAMOON 4.0 + SHAPESHIFT — MBR WIPER EVOLUTION

APT33 / Peach Sandstorm · Rust companion + Stonedrill evolution

APT33's fourth-generation wiper introduces Rust-based companion modules and SHAPESHIFT (evolved Stonedrill) with in-memory injection and advanced anti-EDR emulation bypass.

  • SPLITDROP dropper delivered via phishing lure mimicking Cisco Webex (meetingapp.site)
  • EldoS RawDisk driver overwrites MBR and partition tables without requiring kernel privileges
  • SHAPESHIFT uses in-memory injection with anti-emulation — evades EDR behavioral detection
  • SpreaderPSexec replicates across SMB shares using harvested AD credentials
  • Timed detonation: activates 03:00–05:00 local time to maximize blast radius with minimal responders
  • Targets: Saudi Aramco-linked suppliers, Israeli National Grain Silos, Jordanian utility SCADA

◆ REDALERT.APK — MOBILE PSYOP VECTOR

Handala Hack · SHA256: 83651b058...78b72 · Mass civilian infection

A trojanized Israeli rocket-warning app achieving mass civilian infection. Handala typically claims to "hack phones" — forensically, this is Telegram session hijacking via tdata theft rather than direct device compromise.

  • Distributed via bulk SMS spoofing Israeli national emergency numbers during active rocket alerts
  • Requests RECEIVE_SMS, READ_CONTACTS, ACCESS_FINE_LOCATION, CALL_PHONE, READ_CALL_LOG
  • Intercepts all SMS — banking OTPs, military 2FA codes, government authentication
  • Real-time GPS exfil to api.ra-backup[.]com every 30 seconds
  • Harvests Telegram tdata folder for session hijacking without SIM swap or 2FA bypass
  • senvarservice-DC.exe: PyInstaller-packed exfil tool using boto3 (AWS S3) + Telegram API

◆ ETHERHIDING — BLOCKCHAIN DEAD-DROP C2

APT34 / OilRig · Contract: 0x2B77671cfEE4907776a95abbb9681eee598c102E · Immutable C2

APT34 uses an Ethereum smart contract as a dead-drop C2 resolver. The contract stores the current C2 IP/domain — immutable on-chain, immune to domain seizure and standard takedown mechanisms. Implants perform JSON-RPC eth_call to resolve the live C2 address.

  • Contract on BSC testnet / Polygon — public nodes: bsc-testnet.publicnode.com
  • Function selector 0xe2d84e23 (getString()) returns current C2 as hex-encoded ASCII
  • Completely immune to IANA/registrar domain seizure — C2 survives indefinitely
  • DeadLock ransomware and MuddyWater have adopted the same technique
Detection: Block blockchain RPC endpoints
# Block in enterprise perimeter (pf/iptables/NGFW)
publicnode.com
ankr.com
bsc-testnet.publicnode.com

# KQL — Sentinel / Defender hunt
DeviceNetworkEvents
| where RemoteUrl has_any(
  "publicnode.com","ankr.com")
| where InitiatingProcessName
  !in ("chrome.exe","firefox.exe")
Economic & Infrastructure Impact
–5% limit-down
DFM/ADX Opening

UAE stock exchanges hit circuit-breaker on market open

$81+/bbl
Brent Crude Spike

Oil surged on Gulf supply disruption fears and shipping disruption

24–48 hrs
UAE FinTech Outages

Careem, Alaan, Hubpay, Sarwa — all offline simultaneously

67 hrs
Israeli Bank Downtime

Bank Hapoalim & Bank Leumi combined disruption hours

$420–580M
Transaction Losses

Estimated DBS Bank (SEA) transaction losses from 19hr outage alone

146.6%
UAE Liquidity Coverage

UAE Central Bank confirmed adequate reserves — no systemic collapse

42M users
UK Banking Disrupted

HSBC, Barclays, Lloyds hit on Feb 21 — 8.2M DBS customers stranded

3 AZs
AWS Physical Damage

me-central-1 AZ mec1-az2/az3 + me-south-1 AZ — weeks of repair

Mar 31
Fee Waiver Deadline

Emirates NBD waived all GCC ATM fees through end of March

Cloud DR Architecture — Lessons from me-central-1

ModelRTOCostMarch 2026 Verdict
Backup & Restore8–24h$AVOID — hardware repair takes weeks
Pilot Light60 min$$RISKY — API throttling blocks provisioning
Warm Standby< 10 min$$$CURRENT BEST PRACTICE
Active-Active< 1 min$$$$Mission-critical only

Recovery Timeline

Mar 1–2
Acute Phase

Banking outages, market circuit-breakers, fintech failures. AWS recommends workload migration to EU/US. EIP Trap prevents standard failover.

Mar 3–4
Stabilization

BGP routes restored. GPU inference rerouted Europe/Asia. UAE Central Bank issues 146.6% liquidity confirmation. AWS me-south-1 partial recovery.

Mar 5+
Full Recovery

UAE Central Bank confirms all financial systems operational. Emirates NBD waives GCC ATM fees through March 31. Sovereign Financial Cloud initiative announced.

Strategic Assessment

◆ FIVE DOCTRINE SHIFTS DEFINED BY CLOUD-KINETIC-2026

Cloud Infrastructure as Military Target

First confirmed kinetic attack on hyperscale public cloud. AWS data centers are now legitimate targets in nation-state conflict — sets global precedent.

Pre-Positioning Patience

Dindoor implants placed 3–6 months before activation. The conflict was the trigger, not the deployment. Iranian APTs demonstrated NSA/FSB-tier operational patience.

Blockchain C2 Immutability

APT34's EtherHiding: Ethereum smart contracts as uncensorable C2 resolvers. Standard domain seizure and IP blocking are now insufficient.

AI-Assisted Malware at Scale

CHAR backdoor contains LLM-generated code (emoji debug strings confirmed). SANDWORM_MODE targets AI assistant configurations (MCP servers) directly.

Proxy Network Operational Maturity

Electronic Operations Room demonstrated cross-MOIS/IRGC/Russian coordination at unprecedented scale — 6 distinct actors with synchronized timing.

Supply Chain as Primary Vector

Shai-hulud 2.0 proves npm ecosystem is a valid warfare vector. CI/CD pipelines are now contested infrastructure in nation-state conflict.

◆ OT/ICS VULNERABILITY SURFACE — ACTIVE EXPLOITATION

TCP 20256
PCOM Protocol

Unitronics PLCs — default PIN 1111 still primary entry point. CyberAv3ngers / FAD Team actively scanning.

TCP 502
Modbus (Exposed)

78.7K devices in US, 27.9K in Israel directly internet-exposed. No authentication by protocol design.

TCP/UDP 44818
EtherNet/IP

ICS protocol exposed on internet — targeted in Gulf energy sector reconnaissance by APT34.

◆ 15 DEFENDER RECOMMENDATIONS — PRIORITY ORDER

01.Patch FortiOS immediately — CVE-2025-59718/19 are being actively exploited for persistent super_admin creation
02.Set ms-ds-MachineAccountQuota to 0 in all Active Directory and AWS Managed AD environments
03.Audit all .github/workflows for pull_request_target + toJSON(secrets) patterns — Shai-hulud 2.0 vector
04.Block Deno/Node runtime execution from non-standard paths (%APPDATA%, %TEMP%) via application allowlisting
05.Monitor for Rclone execution and large outbound transfers to Wasabi, Backblaze B2, or Storj endpoints
06.Block blockchain RPC endpoints at network perimeter: publicnode.com, ankr.com — EtherHiding C2 pattern
07.Rotate all CI/CD secrets — assume npm package compromise if any pipeline ran an unvetted preinstall script
08.Implement Warm Standby DR across a distant region — Pilot Light fails when the primary region's Control Plane is degraded
09.Audit cloud API token scopes — revoke wildcard permissions from all service accounts immediately
10.Monitor User-Agent 'go-http-client' in Azure AD sign-in logs — primary signature for APT33 password spraying
11.Verify SAML response signatures — reject unsigned/self-signed assertions to block CVE-2025-59718 exploitation
12.Block ports TCP 20256, 502, 44818 at perimeter — active OT/ICS exploitation by IRGC-aligned actors
13.Hunt for SharePoint.exe outside Microsoft Office directories — APT33 Tickler DLL sideloading persistence
14.Inspect ~/.gitconfig for init.templateDir redirects — SANDWORM_MODE persistence across new repositories
15.Audit AI assistant configs (Claude, Cursor, VS Code) for rogue MCP server endpoints in ~/.dev-utils

◆ ATTRIBUTION CONFIDENCE MATRIX

ActorAttribution ConfidencePrimary EvidenceDisputed Claims
MuddyWaterHIGHDindoor cert CN 'Amy Cherne', CHAR Telegram C2 forensics, C2 overlap with Olalampo IOCsNone — multiple vendors confirm
APT33HIGHTickler PE overlap, SPLITDROP hash, azurewebsites.net C2 pattern, SharePoint.exe sideloadingShamoon 4.0 timeline vs historical
HandalaMEDIUMSNOC leak site, RedAlert.apk hash, senvarservice-DC.exe decompilationPhone hack claims — forensically only Telegram session theft
APT34MEDIUMEtherHiding contract address, DNS tunneling patterns, SideTwist artifactsExact financial sector targets unconfirmed
Russian LegionLOWSelf-claimed via Telegram channel, partial botnet infrastructure overlapIron Dome access — forensically unverified
◆ INTEL REPORT: CLOUD-KINETIC-2026-03-01 ◆
AUTHORED BY 4NUXD · MARCH 2026 · SOURCES: MICROSOFT THREAT INTELLIGENCE, GROUP-IB, KELA, MANDIANT, AWS PHD
IOCs are enriched from live threat intelligence feeds. Verify before blocking in production environments.