Following the February 2026 Operation Epic Fury strikes, Proofpoint observed a surge in state-aligned cyber operations exploiting the conflict for targeted intelligence collection. Iran-aligned TA453 (Charming Kitten/APT42) continued credential-phishing campaigns—using multi-stage lures and OneDrive-themed credential pages to target stakeholders and gather geopolitical intelligence. #TA453 #OperationEpicFury
Keypoints
- Proofpoint reported a significant increase in cyber operations tied to the February 2026 Operation Epic Fury conflict.
- Iran-aligned group TA453 (Charming Kitten/APT42) remained operational despite government-mandated internet shutdowns.
- Researchers observed a credential-phishing campaign targeting a U.S. think tank that began before the conflict escalated.
- Attackers used a multi-stage lure: rapport-building emails, a malicious PDF link, and a OneDrive-themed credential phishing page pre-filled with the target’s email.
- Regional instability is shifting collection priorities toward geopolitical intelligence, forcing defenders to adapt surveillance and defense strategies.
Read More: https://securityonline.info/iran-aligned-ta453-weaponizes-operation-epic-fury-for-cyber-espionage/