MTS-ISAC Cybersecurity Advisory: 030226

Stakeholders Share Activity Possibly Tied to Iranian Reconnaissance against Maritime

Summary

On Monday, March 2, 2026, maritime transportation system (MTS) stakeholders shared reconnaissance threat activity potentially linked to Iranian-nexus threat clusters, including those associated with Charming Kitten (also known as Mint Sandstorm). The reported activity includes scanning and probing of externally exposed services, typosquatted domains, and phishing attempts.

We appreciate these shares. If your organization has seen activity related to this advisory or other suspicious activity, please contact the MTS-ISAC.

Identified Threat Activity Information

Indicators: Domains:

CIDRs: (Limited Network LTD) (Limited Network LTD)

IPs: (Limited Network LTD) (Limited Network LTD)

bytl[.]ink

services-activities[.]site bytli[.]ink lnked[.]inkfylor[.]cyou 185[.]186[.]244[.]0/24

172[.]94[.]9[.]0/24

185[.]93[.]89[.]37

185[.]93[.]89[.]138

MITRE ATTACK Techniques Seen/Used

T Code

Technique Name

Why It Applies

T1595

Active Scanning

Scanning and probing of externally exposed services.

T1046

Network Service Scanning

Probing externally exposed services is network service scanning.

T1583.001

Acquire Infrastructure: Domains

“typosquatted domains,” which requires domain acquisition.

T1566

Phishing

Phishing attempts.

Recommended Actions

The following are some of the best practices to counter malicious email attacks:

  • Provide regular phishing awareness training to all employees and crew; help them understand how to identify and report suspicious emails and messages to the security team (including how to handle links & attachments).
  • Consider implementing additional email security technologies / tools to detect and filter spam, phishing attacks, and potentially malicious attachments or
  • As a best practice, do not respond to the sender of a suspicious email using email – even if the user is known. A compromised email account may be monitored by an adversary who may redirect the email and respond on-behalf-of the Use an alternate contact method, such as calling the sender.

It is recommended that you block or monitor the shared threat indicators, and report sightings back to the MTS-ISAC. Prepare your organization for distributed denial of service (DDoS) attacks, ransomware, and espionage campaigns.

Continue to conduct vulnerability scans and monitor for geolocation anomalies.

Please share firewall logs, phishing emails, other suspicious activity, and sightings with the MTS-ISAC for further analysis, trending, and reporting to the maritime community.

All maritime transportation system (MTS) organizations are encouraged to consider implementing NIST 800-53 (Rev. 5) security controls1, or another security framework, to help manage risk to within their organization’s acceptable limits.

Additional guidance can be found at CISA’s Shield-Up website: https://www.cisa.gov/shields-up. Furthermore, CISA has a page dedicated to Iran: https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran.

Contact Us

Please continue to use heightened awareness and contact the MTS-ISAC if there are questions or your organization has similar activity to report: https://www.mtsisac.org/contact. We appreciate the shares!

1 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf