CRITICAL 8 min read 17 Mar 2026

War Week 3 Morning Brief: Iran Escalation Doctrine Confirmed, 245% Attack Surge

The most intelligence-dense 24-hour period of the Iran-US conflict to date. Iran's "don't calibrate — escalate" doctrine is formally confirmed by CSIS. Akamai measures a 245% attack surge in banking and financial services since February 28. Handala expands to three distinct TTPs in seven days. GlassWorm Phase 2 is actively poisoning Python repos via stolen GitHub tokens.

Key findings
01
Iran 'Don't Calibrate — Escalate' Doctrine Formally Confirmed by CSIS
CRITICAL
Unrestrained horizontal escalation (wider geography, Gulf capitals, US commercial) and vertical escalation (weapon grade, target severity). Cyber retaliation window is no longer time-bounded — it is doctrine.
02
Akamai: 245% Attack Surge Since February 28 — Banking Takes 40% of Traffic
CRITICAL
Ground-truth CDN telemetry. Russia 35%, China 28%, Iran 14% source IPs — proxy-laundering understates Iranian reach. One US financial institution blocked 13M Iranian-origin packets in 90 days.
03
Handala: Three Distinct TTPs in Seven Days — Confirmed Iranian Intelligence Arm
CRITICAL
Wiper destruction (Stryker, 80K devices), credential theft (Intuitive Surgical), precision intelligence collection (100K Mossad emails). Cymulate confirms MOIS alignment.
04
GlassWorm Phase 2: Python Repo Poisoning Active via Stolen GitHub Tokens
HIGH
Force-pushed malicious code into Django, ML, Streamlit, PyPI repos. Invisible Unicode PUA (U+E000-F8FF) hides Base64 payloads in setup.py/main.py. C2 on Solana blockchain. Campaign active since March 8 — audit all Python dependencies installed after that date.
05
CVE-2026-29000 pac4j-jwt CVSS 10.0 — Public PoC, Log4j Comparisons
CRITICAL
Full auth bypass using server's own RSA public key. Affects Spring Boot + pac4j-jwt. Public PoC live. CISA KEV addition expected within 72h.
06
Stryker Forensics: 80K Devices Wiped via Intune, Existing Admin Account Used
HIGH
DART + Unit 42: compromised existing Intune admin account (not new Global Admin) issued bulk Wipe commands. Detection rules targeting new account creation have a gap.
07
Apple CVE-2026-20700: All-Platform Zero-Day, Emergency Patch Required
HIGH
Extremely sophisticated attacks across iPhone, iPad, Mac, Apple Watch, Apple TV. Dynamic Link Editor RCE. iOS 18.3.1 / macOS 15.3.1 required.
08
Hikvision CVE-2017-7921 + Rockwell CVE-2021-22681 Added to CISA KEV — March 26 Deadline
HIGH
Both CVSS 9.8. CyberAv3ngers documented targeting both platforms. Nine-day federal patch deadline coincides with peak Iranian retaliation window.

The most intelligence-dense 24-hour period of the Iran-US conflict to date. Four converging crises dominate: the war entering Week 3 with a confirmed escalation doctrine; Stryker forensic confirmation (80,000 devices, Intune vector); a 245% Akamai-measured surge in attack volume; and GlassWorm Phase 2 actively poisoning Python repos.

Iran's doctrine is now formally documented by CSIS: unrestrained horizontal escalation (wider geographies, Gulf capitals, US commercial infrastructure) and vertical escalation (greater weapon grade, higher target severity). The cyber retaliation window is not time-bounded by negotiating progress. It is embedded in doctrine.

Handala has demonstrated three distinct operational modes in a single week — wiper destruction at scale (Stryker), credential theft and data exfiltration (Intuitive Surgical), and precision intelligence collection against a named intelligence official. Cymulate confirms MOIS alignment. Handala is a formal Iranian intelligence arm.

GlassWorm ForceMemo Phase 2 is active. GitHub tokens stolen in the VS Code extension campaign are being used to force-push malicious code into Python repos. The technique uses invisible Unicode PUA characters (U+E000-F8FF) to hide Base64 payloads. C2 fetched from Solana blockchain — domain blocking does not help. Audit all Python project directories for force-push anomalies and unexpected history rewrites.

Immediate actions: audit Python dependencies installed after March 8; patch Chrome to 146.0.7680.75+ (CVE-2026-3910, March 27 deadline); patch Wing FTP to 7.4.4+ (March 30 deadline); review pac4j-jwt Java services (CVE-2026-29000, CVSS 10.0, public PoC live).

iranescalationhandalaglasswormpython-supply-chainics-otzero-daycisa-kev

Act on this brief

Map detection coverage gaps for the techniques above, or generate Sigma rules from the named CVEs.