Situation Report: Heightened Threat Environment – Potential Retaliation by Iranian Threat Actors Following U.S. Strikes on Iran (Updated June 25, 2026)

(TLP:AMBER+STRICT) The U.S. and Iran are currently engaged in fragile negotiations. Despite a ceasefire, the potential for Iranian or Iranian proxy threat activity, in both the cyber and physical domains, remains a serious concern.

California Water Service (Cal Water) has shared findings from its independent investigation into the cyber attack claimed by the Iranian-linked group Handala, stating that the threat actor did not breach the utility’s internal networks or OT systems. Cal Water, which engaged Google’s Mandiant unit to support the investigation, reported that the unauthorized activity was limited to a small number of user accounts…