ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - May 7, 2026

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

Iran SITREP: Fragile Ceasefire Holds Amid Regional Escalation
Fragmented Botnet Infrastructure Fuels Stealthy DDoS Campaign
CISA Urges Critical Infrastructure to Prepare for Geopolitical Cyber Crises

Iran SITREP: Fragile Ceasefire Holds Amid Regional Escalation

Despite recent setbacks, such as Iran’s retaliation against commercial and military targets, shipping disruptions in the Strait of Hormuz, and more, the April 8 ceasefire continues to hold. To this end, Project Freedom was paused after one day amid reports that a memorandum of understanding (MOU) to end the war was circulating.
Major stock indices surged and oil prices dropped in response to reports of the MOU. This is likely a reflection of the higher likelihood the MOU will lead to an agreement because it represents the United States moving a step closer to accepting certain Iranian demands in the short term.
Clashes between Hezbollah and Israel continue daily, with Hezbollah notably increasing its use of armed first person view (FPV) drones—particularly those of the fiber optic variety, which are considered immune to electronic jamming. If these drone capabilities continue to improve, the conflict is likely to evolve into a prolonged confrontation.
In the cyber front, pro-Iran hacktivist group “Handala Hack Team” claimed to have breached the IT infrastructure of the Port of Fujairah, United Arab Emirates. The group alleged the theft of over 430,000 sensitive documents related to port operations, oil infrastructure, and shipping activity.

Fragmented Botnet Infrastructure Fuels Stealthy DDoS Campaign

Source: https://hackread.com/low-and-slow-ddos-attack-hits-2-45-billion-5-hours/

What we know: In mid-April, threat actors launched 2.45 billion malicious requests against a major platform within five hours, in a distributed “low and slow” DDoS campaign. The attack reportedly peaked at 205,344 requests per second, while evading standard rate-limiting defenses.

Context: The campaign leveraged a fragmented infrastructure, distributing traffic across more than 1.2 million IP addresses and 16,402 autonomous system numbers (ASNs), with no single network contributing more than 3 percent of the total traffic volume. Attackers reportedly used a “pulsed cadence” technique to evade rate limits, keeping requests per IP low while sustaining a continuous high-volume flood.

Analyst note: The campaign likely reflects an evolution in DDoS tradecraft, with attackers using adaptive techniques to evade conventional detection and rate-limiting controls. Similar attacks are likely to increase as threat actors adopt infrastructure fragmentation and behavioral evasion tactics that reduce the effectiveness of traditional network defenses.

CISA Urges Critical Infrastructure to Prepare for Geopolitical Cyber Crises

Source: https://www.securityweek.com/cisa-critical-infrastructure-must-master-isolation-recovery/

What we know: Cybersecurity and Infrastructure Security Agency (CISA) has launched its “CI Fortify” initiative, urging critical infrastructure sectors to prepare for geopolitical cyber crises that could disrupt internet, telecommunications, and third-party technology services.

Context: The guidance emphasizes isolation and recovery planning, including disconnecting operational technology from external networks, maintaining backups, and preparing manual fallback operations to ensure essential services continue during major cyberattacks.

Analyst note: Recent pro-Iran and anti-Western cyber campaigns reflect a growing focus on disruption, espionage, and data theft targeting U.S. and allied infrastructure. CISA’s CI Fortify initiative will likely strengthen critical infrastructure resilience and limit adversaries’ ability to access, persist within, and disrupt sensitive networks.

DEEP AND DARK WEB INTELLIGENCE

Spear user Fortitude: Untested threat actor “Fortitude” has advertised a dataset containing the personal information of more than 14,000 users of a popular live-streaming platform on dark web forum Spear. The dataset allegedly includes streamers’ full names and associated email addresses, with the actor claiming the data is recent.

VULNERABILITY AND EXPLOIT INTELLIGENCE

CVE-2026-0300: CVE-2026-0300 is a buffer overflow vulnerability affecting internet-exposed Palo Alto Network’s PAN-OS User-ID Authentication Portals. The flaw is being actively exploited in the wild, with over 5,800 exposed VM-Series firewalls reportedly reachable online, primarily in Asia and North America. Palo Alto Networks stated that exploitation has been limited so far and mainly affects organizations exposing the User-ID Authentication Portal to untrusted or public networks.

Affected products: The affected products are included in this advisory.