Breaking
Operation Epic Fury and the 4-Hour Digital Blackout
Within hours of the February 28 strikes, Iran's available internet connectivity collapsed to between 1–4% of normal capacity — a near-total blackout assessed to be the result of both physical infrastructure damage and deliberate offensive cyber operations targeting routing infrastructure. The connectivity loss created a double-edged forensic consequence: while it initially degraded Iran's ability to coordinate sophisticated retaliatory attacks, it also severed real-time logging and telemetry from networks inside the country, creating significant gaps in the evidentiary record. Investigators working attribution cases tied to this period must account for the blackout window when reconstructing attacker timelines — network artifacts that would normally provide corroborating evidence may simply not exist for the February 28 – March 2 window.
Intelligence
60 Groups, One Room: Inside Iran's Electronic Operations Room
On February 28, Iran's Ministry of Intelligence and Security (MOIS) formally activated what threat analysts are calling the "Electronic Operations Room" — a coordinated command structure bringing together 60+ state-aligned and hacktivist groups under unified operational direction. Key actors include Handala Hack (MOIS-linked), Cyber Islamic Resistance, Dark Storm Team, Sicarii ransomware operators, and pro-Russian hacktivist collectives. The formation of this room represents a significant evolution in Iranian cyber doctrine: for the first time, the MOIS is openly coordinating criminal, hacktivist, and state APT assets under a single operational umbrella. For forensic investigators, this creates a deliberate attribution maze — attacks may appear to originate from independent hacktivist groups while actually executing state intelligence directives, with persona fragmentation designed specifically to frustrate forensic attribution.
Analysis
Wipers on the Frontline: When "Ransomware" Becomes Permanent Erasure
BaqiyatLock and Sicarii — the primary destructive tools deployed by Iran-aligned actors in this conflict — present a forensic crisis unlike standard ransomware: no decryption is ever possible. Both tools present as ransomware to confuse the initial triage, displaying ransom notes and wallet addresses, but their actual function is immediate, irreversible data destruction targeting Master Boot Records, partition tables, and file system headers. By the time an organization recognizes the ransom demand as a facade, the evidence is already gone. Forensic examiners responding to suspected wiper incidents must immediately pivot to volatile evidence — RAM dumps, network flow captures, and out-of-band logging — before touching the disk. Post-execution disk forensics on BaqiyatLock targets typically yield little beyond confirming the method of destruction. The only viable forensic record lives in what was preserved before detonation.
Advisory
CISA at 38%: America's Cyber Shield is Critically Understaffed
As Iran-aligned actors execute their most coordinated cyber campaign since 2021, CISA — the United States' primary civilian cyber defense agency — is operating at just 38% staffing capacity due to a federal funding lapse. The agency's public-facing threat advisories have not been actively updated since February 17, 2026. CISA's website itself carries a notice acknowledging the lapse. The consequences for private-sector organizations are significant: the agency's usual role of rapid threat indicator sharing, joint advisories, and emergency coordination is severely degraded precisely when it is needed most. Forensic teams and security operations centers should not assume federal support will arrive in the standard timeframe. Organizations must increase their reliance on private threat intelligence feeds, sector-specific ISACs, and peer information sharing immediately. The gap in federal coordination is itself a vulnerability that Iran-aligned threat actors are likely aware of and actively exploiting.