Iranian cyber operations will likely continue during ceasefire.

Summary

By the N2K CyberWire staff

Iranian cyber operations will likely continue during ceasefire.

The United States and Iran reached a shaky ceasefire on Tuesday, though it's uncertain what impact the truce will have on Iranian cyberactivity, SecurityWeek reports. IRGC-linked hacktivist group Handala said it would stop targeting the US for now, but will continue hitting Israeli targets. Handala claimed responsibility for a disruptive cyberattack against US medtech giant Stryker last month.

US intelligence and law enforcement agencies warned on Tuesday that multiple Iranian APTs are targeting programmable logic controllers (PLCs) and SCADA systems across US critical infrastructure sectors, and experts say organizations should treat this warning urgently despite news of a ceasefire.

Markus Mueller, Field CISO at Nozomi Networks, told SecurityWeek that he expects an increase in cyber operations during the ceasefire, rather than a decrease, as threat actors attempt to infiltrate data centers, tech companies, and defense contractors that participated in the war. Cyberattacks give nation-states a level of plausible deniability, allowing them to continue operating below the level of open war.

Secure and govern AI usage, applications, and agents across the enterprise

AI adoption is expanding across employee tools, copilots, embedded AI features, and homegrown applications. That pace is creating governance gaps, inconsistent policy enforcement, and new exposure risk. Security teams must now govern the AI employees use, and the AI applications and agents development teams build. This webinar shows how organizations can discover Shadow AI, apply prompt and response guardrails, and protect AI applications and agents at runtime through Cato AI Security.

CISA orders government agencies to patch actively exploited Ivanti flaw.

The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered Federal agencies to patch a critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM) by midnight this Sunday, April 12th, BleepingComputer reports. The code injection flaw (CVE-2026-1340) received a patch on January 29th after being exploited in zero-day attacks.

While CISA's order applies to government agencies, private sector organizations should also prioritize patching this flaw.

Crooks build stealthy IoT botnet to launch DDoS-for-hire attacks.

Trellix has published a report on Masjesu, an IoT botnet used for DDoS-for-hire attacks. The botnet malware "scans random IP addresses to identify and exploit numerous vulnerabilities found in devices from manufacturers including D-Link, GPON, and Netgear," and "targets a wide array of IoT devices, such as routers and gateways, across multiple architectures (including i386, MIPS, ARM, and AMD64)."

Masjesu has been operating since 2023, focusing on stealth rather than widespread infection. The botnet deliberately avoids targeting sensitive IP ranges, such as those belonging to the US Department of Defense, to avoid drawing undue attention to itself. Trellix notes that the botnet is "rapidly maturing," and it "minimizes detectability and maximizes attack effectiveness by randomizing packet headers and payloads to better mimic legitimate traffic."

Notes.

Today's issue includes events affecting Iran, Israel, and the United States.

Attacks, Threats, and Vulnerabilities

Google Warns of New Threat Group Targeting BPOs and Helpdesks (Infosecurity Magazine) Google’s threat intel team warns UNC6783, a new extortion group possibly linked to the “Raccoon” persona, is targeting BPOs and enterprises

New macOS Malware notnullOSX Targets Crypto Wallets Over $10K (Hackread) macOS Malware notnullOSX targets crypto wallets over $10K, using fake apps, Terminal tricks, and backdoors to steal funds and sensitive data.

Vibe Hacking: Claude Code Can Be Turned Into A Nation-State-Level Attack Tool With No Coding At All (LayerX) LayerX researchers have found how Claude Code can be turned from a ‘vibe’ coding tool into a nation-state-level offensive hacking tool that can be used to hack websites, launch cyberattacks, and research new vulnerabilities. Our research demonstrates how trivially easy it is to convince Claude Code to abandon its safety guardrails and remove its […]

Products, Services, and Solutions

Trellix prevents enterprise data exposure in sanctioned and shadow AI (Trellix) Data security enhancements and a three-part framework provide enterprises with visibility, control, and governance of data across AI tools

Technologies, Techniques, and Standards

Anthropic Teams Up With Its Rivals to Keep AI From Hacking Everything (WIRED) The AI lab's Project Glasswing will bring together Apple, Google, and more than 45 other organizations. They'll use the new Claude Mythos Preview model to test advancing AI cybersecurity capabilities.

Litigation, Investigation, and Law Enforcement

John Deere to Pay $99 Million in Monumental Right-to-Repair Settlement (The Drive) The ag manufacturing giant will also make digital diagnostic, maintenance, and repair tools available to third parties for 10 years.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

KB4-CON 2026 (Orlando, Florida, USA, May 12 - 14, 2026) Since its inception in 2018, KB4-CON has evolved from a user-focused gathering to the must-attend event for anyone serious about staying ahead in the security landscape. It is the human risk management industry’s premier event, bringing together KnowBe4 customers, channel partners, prospects, plus security advocates and industry professionals. This is your exclusive opportunity to engage with and learn from the industry’s most influential players, all under one roof.

Events

SO-CON 2026 (Arlington, Virginia, USA, Apr 13 - 14, 2026) SO-CON is the only conference dedicated to identity-based security and attack path management. The week begins with a two-day main conference packed with talks, research, and community exchange, followed by four days of deep-dive, hands-on trainings led by adversary-experienced practitioners. Training to follow on April 15-18, 2026.

Space Symposium 2026 (Colorado Springs, Colorado, USA, Apr 13 - 16, 2026) Space Symposium is the premier event uniting global space professionals from all sectors, providing a unique platform to explore critical space issues, foster dialogue, and drive innovation across the space industry.

Adapt 2026: Signal Over Noise (New York, New York, USA, Apr 15, 2026) Adapt26 isn't your typical corporate conference. Built for security, IT, and risk leaders, this is where you learn to cut operational drag and move from overwhelming findings to focused remediation. When 56% of teams struggle to prioritize effectively, visibility alone isn't enough. You need durable context - a verifiable foundation that turns disconnected data into decision-grade security. Join the teams building a more resilient cyber future to learn how to secure your entire distributed footprint across IT, Cloud, and IoT/OT.

Philadelphia Cybersecurity Summit (Philadelphia, PA, Apr 15, 2026) Maximize your networking opportunities by meeting with fellow industry executives and leading security experts at the upcoming 9th Annual Philadelphia Official Cybersecurity Summit on Wednesday, April 15, 2026. Secure your admission now! Use Code CSS26-CRA before February 18 for Free Admission.*

CyberArk IMPACT 2026 (Austin, Texas, USA, May 11 - 13, 2026) At CyberArk IMPACT, cybersecurity practitioners and leaders will come together to explore today’s #1 attack vector – identity. Attendees will acquire a deep understanding of the latest developments in identity-based cyberattacks, including sophisticated attacker techniques that leverage AI and other methods. And most importantly, they will learn how to shut out attackers and prevent unauthorized access by securing every identity across the organization with the right level of privilege controls.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 04.09.26

Top stories.

Iranian cyber operations will likely continue during ceasefire.

CISA orders government agencies to patch actively exploited Ivanti flaw.

Crooks build stealthy IoT botnet to launch DDoS-for-hire attacks.

Notes.

Attacks, Threats, and Vulnerabilities

Products, Services, and Solutions

Technologies, Techniques, and Standards

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events