Situation Report: Heightened Threat Environment – Potential Retaliation by Iranian Threat Actors Following U.S. Strikes on Iran (Updated April 16, 2026)

(TLP:AMBER+STRICT) The conflict between the U.S. and Iran is ongoing. Although a two-week ceasefire is in effect, significant tensions continue. The deal remains fragile and conditional on reopening the Strait of Hormuz.

Additionally, Anomali Threat Research reported that Iranian cyber operations have entered a more dangerous phase. As CISA, the FBI, and the NSA have confirmed Iran-linked actors are exploiting industrial control system (ICS) devices across U.S. critical infrastructure, including water and wastewater utilities, this marks a shift from warning to confirmed intrusion activity, reinforcing that adversaries may already have access to operational environments.

In a related development, according to open-source reports, Pro-Iranian threat actor Ababil of Minab has claimed responsibility for cyber attacks against the Los Angeles County Metro Transit Authority (LACMTA).