Cybersecurity — 2026-04-16

Coordinated Cyber Campaign Scans 12,000 Middle East Critical Infrastructure Systems in MuddyWater-Linked Operation

Oasis Security researchers uncovered a highly coordinated cyber campaign that scanned more than 12,000 internet-exposed systems ahead of targeted attacks on critical infrastructure in the Middle East. Active since early February, the operation follows a structured reconnaissance-to-exfiltration workflow matching tactics previously linked to MuddyWater, an Iranian state-sponsored threat group attributed to Iran's MOIS. The campaign targeted industrial control systems and enterprise networks across multiple Gulf states.

Analysis
Attribution to MOIS rather than IRGC signals strategic intelligence collection over immediate operational targeting, though the campaign may be routine Iranian reconnaissance reframed as war-linked by Oasis Security, the sole source, a commercial firm with market incentives during a conflict news cycle. The February start date roughly coincides with the US-Iran conflict's opening phase, consistent with a parallel cyber operation coordinated with or enabled by the kinetic war. Gulf state critical infrastructure operators are almost certainly unprepared for the exfiltration phase in the coming weeks; pre-positioned access could be activated for destructive effects within days if the ceasefire collapses, a cyber dimension of the Hormuz crisis that policy deliberations have underweighted.

1 sources

12,000+ Systems Scanned Ahead Of Middle East Critical Infrastructure Attacks - Cyber Press