[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5bIKkpphXgAKzLB7bXCUYvn8HIGh8E-9rA1Kotk7Ck8":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":111},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"03f9aca0-a02c-4476-88b0-600dc294c3a0","Iran-backed network directed London attacks over FaceTime, US prosecutors say","iran-backed-network-directed-london-attacks-over-facetime-us-prosecutors-say-68bf61","An indictment unsealed Tuesday says the broader campaign, targeting Jewish and American sites, included attacks on synagogues in Belgium, the Netherlands and London, and U.S. bank buildings in Amsterdam and Paris.","US prosecutors have indicted three men accused of orchestrating attacks across Europe on behalf of Iran's IRGC, including arson and a stabbing in London. The campaign targeted Jewish and American sites and involved recording attacks for propaganda, with instructions relayed via FaceTime and other calls. The attacks were claimed by a group called HAYI, described as a front for Kataib Hezbollah and the IRGC.","Iran-backed network directed London attacks over FaceTime, US prosecutors say.","https:\u002F\u002Ftherecord.media\u002Firan-backed-network-directed-london-attacks-over-facetime","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fdoj_computer_9bebfbd8b8.jpg","2026-11-11T16:57:00+00:00","2026-11-11T18:00:25.813645+00:00",8,[17,20,23,25],{"name":18,"type":19},"Apple","vendor",{"name":21,"type":22},"Kataib Hezbollah","threat_actor",{"name":24,"type":22},"IRGC",{"name":26,"type":27},"HAYI","campaign","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":48,"value":26,"context":49},"malware","Group claiming responsibility for attacks, described as a front for Kataib Hezbollah and the IRGC.",[18],{"controls":52,"vendors":110},[53,82],{"slug":54,"name":55,"problem":56,"products":57},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":45,"name":83,"problem":84,"products":85},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[],{"slug":112,"title":113,"body":114,"framework_refs":115,"framework_notes":120},"iran-backed-operatives-used-facetime-to-direct-real-world-attacks-on-western-targets","Iran-Backed Operatives Used FaceTime to Direct Real-World Attacks on Western Targets","Iran's IRGC leveraged commercially available communication tools like FaceTime to remotely command proxies in Europe to carry out physical attacks, including arson and stabbing, against Jewish and American targets. The use of a front group (HAYI) as a cutout obscured the true directing hand of a state actor, complicating attribution and early interdiction. Attacks were recorded for propaganda, indicating a coordinated information operations component beyond mere physical harm. This case underscores that hybrid threats blend digital coordination with physical violence, and that security awareness must extend to recognising foreign-directed influence and recruitment operations targeting individuals who may be radicalised or coerced into acting as local proxies.",[116,117,118,119],"NIST CSF 2.0 DE.CM-01: Continuous Monitoring","NIST SP 800-53 IR-6: Incident Reporting","NIS2 Article 21(2)(b)","MITRE ATT&CK T1583: Acquire Infrastructure",{"NIS2 Article 21(2)(b)":121,"NIST SP 800-53 IR-6: Incident Reporting":122,"MITRE ATT&CK T1583: Acquire Infrastructure":123,"NIST CSF 2.0 DE.CM-01: Continuous Monitoring":124},"NIS2's incident handling obligations require organisations and member states to have coordinated response procedures that could have accelerated cross-border law enforcement action against the network directing these attacks.","Structured incident reporting requirements would have ensured that any individual approached by foreign operatives could quickly escalate to authorities, potentially disrupting the IRGC's command chain earlier.","The creation of the HAYI front group as a fictitious claiming entity mirrors the ATT&CK technique of acquiring operational infrastructure to obscure the true sponsoring actor's identity and complicate attribution.","Continuous monitoring of open-source channels and threat intelligence feeds would have surfaced early indicators of the HAYI front group's propaganda activity and foreign-directed coordination before attacks escalated."]