Iran's decentralized cyber operations continue despite strikes on leadership.

This briefing summarizes multiple active cyber incidents: Iran‑linked decentralized cyber operations continue despite strikes; Handala‑attributed attackers compromised an Intune admin account and remotely wiped about 80,000 Stryker devices; EU imposed sanctions on companies accused of supporting cyberattacks; a sophisticated iOS exploit chain called DarkSword (capable of kernel read/write and data exfiltration) is being used in watering‑hole campaigns; and international law enforcement disrupted several large IoT botnets used for massive DDoS activity.