Technology & OSINT — 2026-03-19

Iran Deploys Decentralized Cyber Operations; CISA at 38% Staffing

Iran shifted to decentralized cyber operations through its 'Electronic Operations Room' formed February 28. IRGC-backed groups including CyberAv3ngers, APT33, and APT55 have targeted U.S. industrial control systems, water treatment plants, and medical device companies. CISA is operating at approximately 38% staffing.

Analysis
Prior IC Brief and INTSUM tracked CISA staffing losses and the Stryker medical device breach separately. Unit 42's report consolidates the threat picture: Iran's shift to decentralized operations coincides precisely with the period of maximum U.S. defensive capacity degradation.