| Development | Why It Matters |
|---|---|
| ESET confirms FilthyFeline (OilRig/APT34 subgroup) and MuddyWater resumed operations | The operational pause was infrastructure-driven, not strategic. With Iranian internet restrictions eased, these groups are actively targeting Israel and the U.S. again. |
| XWorm C2 infrastructure expanding on Iranian ISPs | Three new high-confidence XWorm command-and-control nodes confirmed on MTN Irancell, Mobin Net, and Patron Technology Persia, plus active Sliver C2 on Giti Secure Cloud. Iranian domestic C2 footprint is growing. |
| VeloCloud Orchestrator dual-CVE exploitation (CVSS 9.9 + 10.0) | Both CVE-2026-114625 and CVE-2026-16812 are on CISA's Known Exploited Vulnerabilities catalog. Volt Typhoon confirmed exploiting CVE-2026-16812 to build covert relay networks across telecoms, defense contractors, and critical infrastructure. |
| VMware ESXi logging bypass (CVE-2026-41709) added to KEV | Despite a low CVSS score (2.7), this is a confirmed zero-day exploited by WARP PANDA (China-linked) to erase forensic evidence post-compromise. Any actor with VMware access — including Iranian APTs known to operate in vCenter environments — can use this to hide. |
| AI-integrated offensive frameworks now operational | ARTEX, Cairn, and NIK C2 represent a new generation of attack tooling where AI agents select TTPs, analyze stolen data in real time, and deploy ransomware — all within a single session. ESET confirms APT groups are already using LLMs for malware development and decoy creation. |
| Unauthorized AI relay services actively exfiltrating developer credentials and IP | A grey-market relay service documented by Symantec routes genuine OpenAI Codex and Anthropic Claude Code traffic through attacker-controlled servers with full filesystem access. Active since early 2026; organizations in industrial automation, semiconductors, pharmaceuticals, shipping, and petrochemicals confirmed affected. |
| Phase | Timeframe | Cyber Activity |
|---|---|---|
| Conflict onset | Feb-Mar 2026 | IRGC-linked proxy groups (Cyber Av3ngers, Handala, DieNet) launch initial hacktivist campaigns against Israeli targets. ICS/OT systems targeted. |
| Escalation | Apr-Jun 2026 | APT33, APT34, APT42, MuddyWater conduct espionage campaigns. Handala conducts IO dumps. IOCONTROL malware deployed against industrial systems. |
| Operational pause | Jul-Aug 2026 | Iranian internet restrictions degrade APT operational capability. C2 infrastructure goes quiet. Hacktivist proxy groups fall silent. |
| Infrastructure rebuild | Sep 2026 | XWorm and Sliver C2 nodes begin appearing on Iranian ISPs (Mobin Net, Arvan Cloud, Giti Secure Cloud). Pre-positioning indicators emerge. |
| Acceleration | Oct 1-26, 2026 | Operation CameraSwarm (14,530 weaponized Dahua IP cameras), Dell PowerProtect dual CVSS 9.8 auth bypass disclosed, AI exploitation frameworks mature. |
| Resumption confirmed | Oct 27-29, 2026 | ESET validates FilthyFeline and MuddyWater are active again. XWorm C2 expands to three Iranian ISPs. VeloCloud critical CVEs added to KEV. ARTEX/Cairn/NIK C2 go operational. |
FilthyFeline (OilRig/APT34 subgroup) and MuddyWater (MOIS; UNC3313, TEMP.Zagros) resumed after Iranian internet restrictions eased, mostly against Israel plus some U.S. firms. FilthyFeline took over a cellular provider compromise in Uzbekistan from BladedFeline; Arid Viper hit the Palestinian Authority's foreign ministry. Track Cyber Av3ngers, APT42/CALANQUE, BANISHED KITTEN/Cotton Sandstorm/Emennet Pasargad, Pioneer Kitten/UNC5625, APT33/Peach Sandstorm, UNC1860, Agrius/UNC2428, UNC6446.
Three XWorm nodes (MTN Irancell, Mobin Net, Patron Technology Persia) plus Sliver with an open directory on Giti Secure Cloud: deliberate diversification. State actors use Sliver as a Cobalt Strike alternative.
VeloCloud CVE-2026-114625 (CVSS 9.9, escalation to superuser operator) and CVE-2026-16812 (CVSS 10.0, Volt Typhoon's Silent Train relay network across telecoms, defense, water, energy, transport, aviation). ESXi CVE-2026-41709 (CVSS 2.7) is a WARP PANDA zero-day that erases forensic evidence; APT33 and UNC1860 operate in vCenter.
ARTEX/Cairn (Nextron): LLM agents pick TTPs on attacker infrastructure, so victims see conventional tooling. NIK C2 (Cisco Talos): Go RAT with an OpenAI client, AES-256-GCM, WebSocket/HTTP failover, then screen-locking ransomware. ESET: APTs use LLMs for malware and decoys; UAC-0099 planted a decoy nuclear-weapon request to trigger LLM guardrails.
Symantec: a grey-market relay installs genuine Codex and Claude Code CLIs set to full-access sandboxing and routes prompts through third-party servers, exposing every prompt, file and secret. Active since early 2026 against firms in China, South Korea, Taiwan and Malaysia.
| Scenario | Probability | Basis |
|---|---|---|
| Additional Iranian APT infrastructure surfaces as MuddyWater/FilthyFeline operations ramp up post-pause. Expect new C2 domains and spearphishing campaigns targeting Israeli defense and government sectors. | 75% (HIGH) | ESET-confirmed resumption + expanding C2 footprint on Iranian ISPs + historical operational patterns |
| Iranian actors begin exploiting recently disclosed vulnerabilities (PHP2Shell CVE-2026-109618/109619, VeloCloud CVE-2026-114625, BeyondTrust) within the next 7–14 days | 50% (MODERATE) | Consistent with historical 5–15 day Iranian weaponization timelines; PHP-based web application exploitation is a known Iranian preference |
| Hacktivist proxy groups (Cyber Av3ngers, Handala, DieNet) resurface with new IO campaigns or ICS-targeting operations | 35% (LOW-MODERATE) | 197+ days of silence is anomalous given the active kinetic conflict; more likely a collection gap than genuine cessation, but cannot confirm without restored OSINT visibility |
| AI-integrated frameworks adopted by Iranian operators for target reconnaissance or initial access automation | 30% (LOW-MODERATE) | ESET confirms APT LLM usage is already occurring; ARTEX/Cairn lower the barrier; but no direct evidence of Iranian adoption yet |
| Coordinated destructive cyber operation timed to a kinetic escalation event | 20% (LOW) | Multiple destructive IRGC-affiliated actors remain operationally silent — historically a precursor to coordinated action — but no specific warning indicators |
| Focus Area | ATT&CK Techniques | Detection Guidance |
|---|---|---|
| Iranian spearphishing resumption | T1566.001 (Spearphishing Attachment), T1059 (Command & Scripting Interpreter) | Increase scrutiny on inbound emails with attachments from unknown senders targeting executive, defense, and government personnel. Watch for MuddyWater's characteristic macro-enabled documents and OilRig's DNS-tunneling payloads. |
| XWorm/Sliver C2 communications | T1071.001 (Web Protocols), T1573.001 (Encrypted Channel), T1105 (Ingress Tool Transfer) | Monitor for beaconing to the Iranian ISP ranges listed in the IOC table below. XWorm typically uses T1059.001 (PowerShell) for execution. Sliver uses mTLS, WireGuard, or HTTP(S) C2 — look for anomalous TLS connections to low-reputation IPs. |
| VMware ESXi log tampering | T1562.002 (Disable Windows Event Logging) | Audit ESXi syslog forwarding configurations. If ESXi logs suddenly stop arriving at your SIEM, treat as a high-priority investigation trigger — this is exactly what CVE-2026-41709 enables. |
| SD-WAN management plane compromise | T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts), T1021 (Remote Services) | Monitor VeloCloud Orchestrator authentication logs for privilege escalation patterns. Alert on any user account accessing "superuser operator" functions. Audit Cisco SD-WAN vManage for similar anomalies. |
| AI framework artifacts | T1588.002 (Obtain Capabilities: Tool), T1505.003 (Web Shell), T1027 (Obfuscated Files) | Deploy Nextron YARA rules: HKTL_ARTEX_Oct26, HKTL_ARTEX_Docker_Oct26, PUA_NORMA_Usage_Oct26, LOG_Norma_UA_Oct26. Hunt for ARTEX/Norma User-Agent strings in proxy logs. |
| NIK C2 activity | T1071.001 (Web Protocols), T1056.001 (Keylogging), T1486 (Data Encrypted for Impact) | Monitor for WebSocket connections to 87.120.196[.]120 or DNS resolution of total-sitevv[.]lol. Hunt for SSL certificates with CN=nik-panel. NIK C2 uses AES-256-GCM — look for anomalous encrypted channels with dual-protocol failover (WebSocket → HTTP). |
| Unauthorized AI relay services | T1199 (Trusted Relationship), T1567 (Exfiltration Over Web Service) | Audit developer workstations for ~/.codex/config.toml with sandbox_mode="danger-full-access" and ~/.claude/settings.json with non-standard ANTHROPIC_BASE_URL. Monitor DNS for resolution of relay domains listed above. |
IOC Blocking Table:
5.121.18[.]167178.131.57[.]23562.3.14[.]10846.38.138[.]5087.120.196[.]120total-sitevv[.]lolvibe[.]aiok[.]meaiok[.]mesorryios[.]ionuoda[.]vipclaudechn[.]commirbuds[.]comrawchat[.]cnsharedchat[.]ccvibe[.]skk[.]moe
Block at perimeter firewalls, DNS sinkholes and endpoint platforms. 5.121.18[.]167 XWorm C2, MTN Irancell (AS44244), first seen Oct 28; 178.131.57[.]235 XWorm C2, Mobin Net (AS50810); 62.3.14[.]108 XWorm C2, Patron Technology Persia (AS200436); 46.38.138[.]50 Sliver C2, Giti Secure Cloud (AS204104), open directory; 87.120.196[.]120 NIK C2 panel; total-sitevv[.]lol NIK C2 domain. The last nine chips are unauthorized AI relay services. Hashes for the relay installers (setup-codex.ps1, setup-claudecode.ps1) and further indicators via Anomali ThreatStream Next-Gen and partner feeds.
Hunting Hypotheses:
HUNT 01
Hypothesis: MuddyWater has pre-positioned access in your environment during the "quiet period" and will activate it now that operations have resumed.
Hunt for: dormant scheduled tasks or services created between July–September 2026 that beacon to Iranian IP ranges; PowerShell execution with encoded commands; anomalous DNS-over-HTTPS traffic.
HUNT 02
Hypothesis: An attacker has exploited CVE-2026-41709 to disable ESXi logging and is operating undetected in your virtualization layer.
Hunt for: gaps in ESXi log timelines; VMs with unexpected snapshots or configuration changes; vCenter API calls from unusual source IPs.
HUNT 03
Hypothesis: A developer workstation has been configured with an unauthorized AI relay, exfiltrating code and credentials through a seemingly legitimate AI coding assistant.
Hunt for: outbound connections to the relay domains listed in the IOC table; modified AI CLI configuration files (
~/.codex/config.toml, ~/.claude/settings.json); AI relay installer scripts (setup-codex.ps1, setup-claudecode.ps1). File hash IOCs for these installers are available via Anomali ThreatStream.Financial Services
Banking, Payments
Primary threat
OilRig/APT34 targets finance; FilthyFeline is active.
Secondary threat
SD-WAN at branches; AI relay IP loss.
Actions
- Audit SWIFT and core banking logs for dormant accounts from the Jul-Sep quiet period; harden email gateways (T1566.001); review SD-WAN management exposure; bar unauthorized AI coding relays for trading developers.
Energy
OT, BMS
Primary threats
Cyber Av3ngers silent 197 days: retooling, not cessation.
Secondary threat
SCADA and SD-WAN management planes.
Actions
- Hunt IOCONTROL; assess SCADA/BMS management interfaces; segment IT/OT; review RUGGEDCOM, Capital Embedded, Industrial Edge advisories.
Healthcare
Clinical, Research
Primary threat
NIK C2 credential theft plus ransomware.
Secondary threat
ESXi hosting EHR; AI relay leaks research.
Actions
- Block NIK C2; audit ESXi hosting EHR (CVE-2026-41709 can delay IR and notification); review AI tool policy for research teams.
Government
Defense, Diplomacy
Primary threat
MuddyWater and FilthyFeline target government; Arid Viper collects diplomatic data.
Secondary threat
Pioneer Kitten edge exploitation (BeyondTrust).
Actions
- Heighten spearphishing defenses for Iran-policy staff; emergency ESXi patch; audit VPN; assess VeloCloud and Cisco SD-WAN.
Aviation / Logistics
Hormuz, Logistics
Primary threat
Silent Train hit aviation via VeloCloud.
Secondary threat
Airport cameras; satellite comms.
Actions
- Emergency VeloCloud patch; hunt Sliver beacons to 46.38.138[.]50.
No sector cards match the selected filters.
Block the XWorm, Sliver and NIK C2 IPs and
total-sitevv[.]lol at the perimeter. Verify ESXi syslog forwarding on all hosts; a gap may mean CVE-2026-41709 exploitation.SOC Analyst
Patch ESXi for CVE-2026-41709 (builds ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389). Patch VeloCloud Orchestrator for CVE-2026-114625 (CVSS 9.9) and CVE-2026-16812 (CVSS 10.0), both KEV with nation-state exploitation.
Incident Responder
No immediate actions for the selected roles.
Deploy Nextron YARA rules and ARTEX/Norma User-Agent hunts; add NIK C2 JARM
28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b. Hunt MuddyWater pre-positioning (Jul-Sep scheduled tasks, encoded PowerShell, DoH beacons). Audit developer AI CLI configs, block relay domains.SOC AnalystThreat Hunter
Review Siemens (RUGGEDCOM, Capital Embedded, Industrial Edge) and Mitsubishi GENESIS advisories; schedule patching.
ICS / OTIncident Responder
No 7-day actions for the selected roles.
Assess SD-WAN management plane exposure and segment it. Set AI agent governance: proxy-only, allow-listed endpoints, no full-access sandboxes, egress DLP. Update IR playbooks for AI-driven attacks (TTP attribution degrades). Run a tabletop on a destructive Iranian operation tied to kinetic escalation.
CISO / ExecIncident Responder
No 30-day actions for the selected roles.
The Bottom Line
The pause is over, the tooling has evolved and the attack surface is expanding. Act on specific intelligence, starting with the IMMEDIATE actions today.
1
Is the pause over? Expect escalating Iranian activity.
2
Is AI tooling compressing your response window?
3
Are SD-WAN, VMware and AI toolchains protected?