| Development | Significance |
|---|---|
| CVE-2026-63077 added to CISA KEV (Aug 5) | TeamCity unauthenticated RCE — active exploitation confirmed by 5+ independent sources. Supply-chain compromise vector for any organization using TeamCity build pipelines. |
| OilRig deploys fresh Mimikatz tooling (Aug 4) | New credential-harvesting capability refresh indicates active campaign preparation — lateral movement operations likely imminent. |
| MuddyWater/Dalbit ransomware crossover reaches highest confidence | Iran-DPRK operational overlap confirmed: shared Hive ransomware tooling, shared infrastructure, overlapping targets (US, Saudi Arabia, multi-sector). |
| APT42 BELLACIAO/SHELLAFEL web shell campaign expands (Aug 1–3) | Eight verticals targeted including energy, government, healthcare, and manufacturing — campaign metadata updated Aug 7 in threat feeds. |
| Remcos RAT C2 confirmed active on Iranian academic infrastructure (Aug 7) | IP 62.60.226[.]42 operating on port 43155, hosted by Iranian Research Organization for Science & Technology — active today. |
| ASN 213790 C2 expansion continues | Four high-confidence malicious IPs now tracked on this Tehran-based hosting cluster, with financial services, government, manufacturing, and telecom targeting tags. |
| Three new ICS advisories (Aug 6) | ABB Ability Zenon (energy/utilities), Johnson Controls TL280 (building automation), Medixant RadiAnt (healthcare imaging) — all relevant to Iranian ICS targeting patterns. |
| CVE-2026-9198 (IBM Langflow) in KEV (Aug 4) | First AI/LLM orchestration platform with unauthenticated RCE in active exploitation — signals emerging AI infrastructure attack surface. |
| Pro-Iran hacktivist groups remain silent | Zero activity from Handala, Cyber Toufan, BANISHED KITTEN, or CyberAv3ngers this cycle — atypical given conflict intensity. |
| Phase | Timeframe | Cyber Activity |
|---|---|---|
| Conflict begins | 2026-02-28 | Iran conflict escalation begins — sustained multi-vector cyber operations initiated |
| Initial ICS disruption | 2026-07-26 – 2026-07-31 | 30+ Minnesota water systems attacked by CyberAv3ngers; FBI/EPA confirm expansion to seven states |
| Espionage expands to eight verticals | 2026-08-01 – 2026-08-03 | APT42 BELLACIAO/SHELLAFEL web shell expansion targets energy, government, healthcare, manufacturing |
| CI/CD and AI attack surfaces weaponized | 2026-08-03 – 2026-08-05 | CVE-2026-18577 (N-central), CVE-2026-9198 (Langflow), and CVE-2026-63077 (TeamCity) all added to CISA KEV; OilRig deploys fresh Mimikatz variant; MuddyWater/Hive ransomware hash updated |
| Current (Day 160) | 2026-08-03 – 2026-08-07 | ASN 213790 C2 expansion at 3x normal tempo; Remcos RAT C2 confirmed active on Iranian academic infrastructure |
Why it matters: JetBrains TeamCity is the backbone of CI/CD pipelines across defense, technology, and enterprise environments. CVE-2026-63077 provides unauthenticated remote code execution via the agent polling protocol — meaning no credentials are needed to compromise build servers.
Iranian actor alignment: Pioneer Kitten (also known as Fox Kitten, IRGC-affiliated) has a documented pattern of exploiting newly-disclosed vulnerabilities in development tools and network appliances within days of KEV listing. Their historical targets include defense industrial base contractors — exactly the organizations running TeamCity pipelines.
Related vulnerabilities in the same product: CVE-2026-44413 (CVSS 8.2), CVE-2026-49371 (CVSS 7.1), CVE-2026-49372 (CVSS 7.5), CVE-2026-49373 (CVSS 7.1).
What we know: MuddyWater (Iranian MOIS), Dalbit, and Silent Chollima (North Korean) are sharing Hive ransomware tooling and infrastructure. This is confirmed at the highest confidence level — three independent corroboration axes satisfied (shared TTPs, shared infrastructure on ASN 213790, and overlapping victimology across US, Saudi Arabia, Thailand, and Cyprus).
Strategic implication: This is not opportunistic overlap. The shared infrastructure and tooling suggest either deliberate tool-sharing agreements, contractor relationships, or coordinated obfuscation. For defenders, this means ransomware incidents attributed to "Hive" or "LockBit" may actually be state-sponsored operations with espionage objectives hiding behind criminal personas.
Targeted sectors: Commercial, construction, defense, energy, government, financial services, manufacturing, telecom.
OilRig (also known as APT34, Helix Kitten, MOIS-linked) deployed a fresh Mimikatz variant on August 4. This is significant not for the tool itself — Mimikatz is ubiquitous — but for the timing. A credential-harvesting capability refresh during an active conflict period signals imminent lateral movement operations, likely targeting organizations where initial access has already been achieved.
ASN 213790 ("Limited Network," Tehran) has become a signature Iranian APT hosting cluster. Four high-confidence malicious IPs are now tracked, with targeting tags spanning financial services, government, manufacturing, and telecom. Separately, Remcos RAT command-and-control is confirmed active on Iranian academic infrastructure (IP 62.60.226[.]42, port 43155).
Key insight: Automated threat intelligence systems are tagging some of this infrastructure as "APT28" (Russian) due to behavioral signatures. This is a misattribution — the infrastructure is Iranian. Organizations should not dismiss these IOCs based on incorrect Russian attribution.
Three new ICS advisories this week affect systems directly relevant to Iranian targeting: ABB Ability Zenon — deployed in energy grid environments, vulnerable to security bypass and system crash; Johnson Controls TL280 — building automation/physical security, information disclosure; Medixant RadiAnt DICOM — healthcare imaging, application crash via malicious files.
Combined with the CyberAv3ngers' confirmed seven-state water system campaign (July 26–31), the ICS/OT attack surface continues to expand while Iranian actors have demonstrated both capability and intent.
CVE-2026-9198 in IBM Langflow (an AI/LLM orchestration platform) represents the first AI-specific critical vulnerability with confirmed active exploitation. The attack chains an auto_login function (which mints SUPERUSER tokens) with code execution via exec(). Any organization running AI/ML pipelines should treat this as a wake-up call — AI infrastructure is now a confirmed attack surface, not a theoretical one.
| Scenario | Probability (72-hour) | Basis |
|---|---|---|
| TeamCity exploitation attributed to Iranian actor (likely Pioneer Kitten/Fox Kitten) | 70% | Historical pattern of rapid exploitation post-KEV; CI/CD aligns with DIB targeting |
| APT42 BELLACIAO campaign produces new IOCs targeting energy/government in Middle East | 50% | Campaign metadata updated Aug 7 in threat feeds; eight-vertical expansion confirmed Aug 1–3 |
| Pro-Iran hacktivist groups resurface with new wiper variant or persona | 30% | Current silence is atypical; matches historical retooling patterns before coordinated destructive ops |
| OilRig lateral movement campaign detected in enterprise environment | 45% | Fresh Mimikatz deployment + historical OilRig tempo suggests 5–10 day window between tooling refresh and operation |
| Additional AI/ML platform vulnerabilities disclosed or exploited | 35% | Two AI-platform CVEs now in active exploitation (Langflow + ServiceNow AI); attack surface discovery phase |
Technique: T1190, T1195.002 Detection: Monitor TeamCity agent polling endpoints for unauthenticated connections. Alert on new build agent registrations from unexpected IP ranges. Audit build pipeline outputs for injected artifacts. Query logic: Look for process execution chains originating from TeamCity agent processes (e.g., java.exe → cmd.exe/bash) that don't match known build scripts.
Technique: T1003.001, T1055 Detection: Monitor for LSASS memory access by non-standard processes. Alert on process injection patterns (CreateRemoteThread, NtMapViewOfSection). Deploy YARA rules for the specific OilRig Mimikatz hash. Query logic: process_access WHERE target_process = "lsass.exe" AND source_process NOT IN (known_security_tools)
Technique: T1219, T1071 Detection: Monitor for outbound connections to port 43155. Alert on Remcos RAT network signatures (encrypted C2 beacon pattern). Check DNS logs for resolution of Iranian academic institution domains. Query logic: network_connection WHERE dest_port = 43155 OR dest_ip IN (62.60.226.42)
Technique: T1071, T1571 Detection: Create a watchlist for ASN 213790 ("Limited Network") and ASN 214192. Alert on any egress traffic to these ranges. Correlate with authentication failures or data exfiltration patterns. Query logic: network_connection WHERE dest_asn IN (213790, 214192)
Technique: T1219, T1078 Detection: Audit N-central authentication logs for anomalous account creation or privilege escalation. Monitor for N-central agent deployment to endpoints outside normal onboarding workflows.
| Threat | ATT&CK |
|---|---|
| Hunt Hypothesis 1: TeamCity Supply-Chain Compromise | T1190 T1195.002 |
| Hunt Hypothesis 2: Mimikatz/Credential Harvesting | T1003.001 T1055 |
| Hunt Hypothesis 3: Remcos RAT Communication | T1219 T1071 |
| Hunt Hypothesis 4: ASN 213790 Infrastructure Communication | T1071 T1571 |
| Hunt Hypothesis 5: RMM Tool Abuse (N-central) | T1219 T1078 |
Block the above at perimeter firewalls, proxies, and DNS. Hashes: 3ce60bc180bd17367b576ff1d26c7819cae9ca71f727603f5b73b67dc0193b67, 1ca62a560ee6885b9c9187ade5c8933ec28a52323ffbc39f8e2ba9c9fb151247, d4715827692a248f1fbeecd60f9a99b7bd639198e64c2f400710c52503eba1f8. Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
- Block all traffic to/from ASN 213790 and ASN 214192 at network perimeter
- Review SWIFT/payment system segmentation — ensure no lateral path from corporate network to transaction infrastructure
- Audit for Hive/LockBit ransomware indicators in endpoint telemetry; treat any detection as potential state-sponsored operation requiring elevated IR response
- Immediately assess ABB Zenon deployment exposure; apply vendor mitigations per ICSA-26-218-01
- Verify IT/OT network segmentation — ensure no path from internet-facing systems to Zenon HMI/SCADA
- Deploy network monitoring at IT/OT boundary for anomalous protocols or unexpected connections to ICS controllers
- Patch or isolate RadiAnt DICOM viewers; validate that DICOM file ingestion from external sources is sandboxed
- Audit AI/ML platforms used in diagnostics for Langflow or similar orchestration tools; check for CVE-2026-9198 exposure
- Ensure medical device network segments cannot be reached from compromised corporate endpoints
- Audit all CI/CD infrastructure (TeamCity, Jenkins, GitLab) for CVE-2026-63077 and related vulnerabilities; patch or isolate immediately
- Review OAuth application permissions in M365/Azure AD environments — APT42's HOLLOWGRAPH technique abuses calendar API for C2
- Implement conditional access policies blocking authentication from Iranian IP ranges (ASN 213790, 214192, and associated ranges)
- Conduct credential hygiene audit: enforce LSASS protection, disable WDigest, enable Credential Guard
- Inventory all RMM tools in use (N-central, ConnectWise, AnyDesk); patch N-central to 2026.3 HF1 immediately for CVE-2026-18577
- Audit MSP access to internal systems — an MSP compromise via N-central auth bypass can provide direct access to client environments
- Validate that flight-critical and safety-critical systems are air-gapped from corporate networks accessible via RMM tools
77.90.185[.]28, 77.90.185[.]248, 62.60.226[.]42, 185.93.89[.]75, 94.183.240[.]65 — confirmed Iranian APT/C2 infrastructure.auto_login functionality. Restrict network access to AI orchestration APIs.The most important finding this week may be what we are not seeing. Pro-Iran hacktivist groups — CyberAv3ngers (IRGC-CEC), Handala, Cyber Toufan, BANISHED KITTEN (IRGC) — have gone quiet. These are the same groups that attacked 30+ water systems across seven US states just twelve days ago. Their silence, combined with the infrastructure expansion on ASN 213790 and OilRig's credential tooling refresh, matches a pattern we have observed repeatedly in this conflict: operational pause before coordinated escalation. Meanwhile, the confirmed Iran–North Korea ransomware partnership (MuddyWater/MOIS + Dalbit + Silent Chollima sharing Hive tooling) means that the next "ransomware" incident hitting your organization may actually be a state-sponsored operation with intelligence collection objectives hiding behind a criminal facade. Your incident response playbooks need to account for this reality. The TeamCity vulnerability is your most urgent action item. It is being actively exploited today. Iranian actors have historically weaponized CI/CD vulnerabilities within days of KEV listing.