| Date | Development | Significance |
|---|---|---|
| 2026-08-03 – 2026-08-06 | Iranian C2 infrastructure expanded at 3x normal tempo. Three new high-confidence IPs appeared on ASN 213790 ("Limited Network," Tehran) within 72 hours — up from the steady-state of 1–2 per week observed in prior weeks | This network now hosts both APT command-and-control and ransomware affiliate infrastructure |
| This week | MuddyWater ransomware crossover confirmed at highest confidence. Fresh Hive ransomware samples with triple attribution (MuddyWater + Dalbit + Silent Chollima) confirmed targeting commercial sectors in the US and Saudi Arabia | The convergence of Iranian state espionage with ransomware-as-a-service is now fully validated |
| 2026-08-03 – 2026-08-05 | Two critical KEVs weaponize CI/CD and RMM attack surfaces. CVE-2026-63077 (JetBrains TeamCity, CVSS 9.8) enables unauthenticated RCE in CI/CD pipelines. CVE-2026-18577 (N-able N-central) is a second KEV listing for the same product after the first patch proved incomplete | Authentication bypass enabling full account takeover of remote management platforms |
| 2026-08-01 – 2026-08-03 | APT42 BELLACIAO and SHELLAFEL campaigns expanded to eight verticals. Active web shell deployments confirmed against energy, government, healthcare, and manufacturing targets across multiple countries | Campaign scope widened between August 1–3 |
| 2026-08-05 | Iranian fake resume campaign updated with new GitHub-based lures. Aerospace-sector hiring pipelines are being targeted with refreshed malicious repositories | A persistent social engineering vector that has now been updated this cycle |
| 2026-08-04 | CVE-2026-9198 (Langflow, CVSS 9.8) added to CISA KEV. Unauthenticated RCE against AI/LLM platform default deployments | Represents an emerging convergence of AI infrastructure and state-sponsored targeting, consistent with intelligence indicating Iran-backed groups are actively recruiting AI expertise for offensive operations |
| Phase | Timeframe | Cyber Activity |
|---|---|---|
| Conflict begins | 2026-02-28 | Iran-Israel conflict cyber dimension begins — start of sustained Iranian cyber operations |
| Initial ICS disruption | 2026-07-26 – 2026-07-31 | CyberAv3ngers attacks 30+ Minnesota water systems; FBI/EPA confirm expansion to 7 US states |
| Espionage campaigns widen | 2026-08-01 – 2026-08-03 | APT42 updates BELLACIAO/SHELLAFEL campaigns, expanding espionage targeting to energy, government, healthcare across 8 verticals; CVE-2026-18577 re-added to CISA KEV |
| CI/CD and AI attack surfaces weaponized | 2026-08-04 – 2026-08-05 | CVE-2026-9198 (Langflow) and CVE-2026-63077 (TeamCity) added to CISA KEV; Iranian fake resume campaign updated with new GitHub lures |
| Current (Day 160) | 2026-08-03 – 2026-08-06 | ASN 213790 adds 3 C2 nodes in 72 hours — 3x normal tempo; APT42 BELLACIAO and PINEDROP campaigns confirmed active |
The following IRGC and MOIS-affiliated groups are confirmed active or recently active in this campaign cycle:
| Actor | Affiliation | Current Activity | Primary Targets |
|---|---|---|---|
| APT42 (Charming Kitten) | IRGC-IO | BELLACIAO/SHELLAFEL web shells active | Energy, healthcare, government, manufacturing |
| MuddyWater (Cavern Manticore) | MOIS | Ransomware crossover with Hive; operationally silent since ~July 30 | Commercial, construction, government (US, Saudi Arabia) |
| CyberAv3ngers (HYDRO KITTEN) | IRGC-CEC | Post-attribution retooling after 7-state water campaign | US water/wastewater ICS/SCADA |
| Pioneer Kitten (Fox Kitten) | IRGC-affiliated | Historical CI/CD exploitation pattern; probable CVE-2026-63077 interest | DIB contractors, CI/CD infrastructure |
| UNC5625 | Iran-nexus | PINEDROP backdoor against ME government entities | Government, technology |
| PULSAR KITTEN | Iran-nexus | Satellite/telecom phishing (silent since late July) | US aerospace, telecommunications |
Unauthenticated RCE via the agent polling protocol. Affects all versions before 2026.1.3 and 2025.11.7. This is not just an application vulnerability — it's a supply-chain multiplier. Compromising CI/CD enables downstream attacks against every product built through that pipeline. For defense industrial base contractors, this means potential compromise of weapons system firmware, avionics code, or classified project builds. Pioneer Kitten's historical exploitation of Citrix, Ivanti, and PTC Windchill makes this a high-probability next target.
This is the second KEV listing for N-central — the original patch for CVE-2026-18556 was incomplete. Authentication bypass enables full account takeover of remote management platforms. RMM tools provide god-mode access to managed endpoints; a compromised N-central instance gives attackers the same access as your MSP.
Unauthenticated RCE against AI/LLM platform default deployments. Combined with intelligence indicating Iran-backed groups are actively recruiting AI experts for offensive operations, this vulnerability represents an emerging convergence of AI infrastructure and state-sponsored targeting.
The convergence of Iranian state espionage actors with ransomware-as-a-service operations is now confirmed at highest confidence. MuddyWater's operational crossover with Hive ransomware — targeting commercial sectors in the US and Saudi Arabia — represents a strategic blurring of state and criminal operations. This serves dual purposes: revenue generation under sanctions pressure, and plausible deniability during destructive operations that can be attributed to "criminal" actors.
Confirmed Hive ransomware samples associated with this crossover are available via Anomali ThreatStream. File hashes should be retrieved directly from ThreatStream to ensure indicator integrity.
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| Additional ASN 213790 IPs surface as Iranian operators expand pre-positioned infrastructure | 70% | 72 hours | 3x tempo increase sustained over current cycle |
| CVE-2026-63077 (TeamCity) exploited by Iranian actors | 50% | 7 days | Pioneer Kitten's historical pattern of rapid KEV weaponization against CI/CD tools |
| Hacktivist silence breaks with new destructive operation (wiper/DDoS) | 40% | 7–14 days | 2-cycle quiet gap matches Handala/Cyber Toufan retooling cadence |
| MuddyWater ransomware operations expand to energy/healthcare verticals | 35% | 14 days | APT42 BELLACIAO already targeting these sectors; MuddyWater follows access paths |
| Iranian exploitation of N-central (CVE-2026-18577) for MSP-to-victim pivoting | 30% | 14 days | RMM tools are force multipliers; incomplete patch signals ongoing exposure |
Hunting hypothesis: Iranian operators are using Tehran-based infrastructure on ASN 213790 for C2 communications over non-standard ports. Look for outbound connections to this ASN that bypass standard web proxy paths. Monitor for any traffic to/from AS213790 ("Limited Network," Tehran) Alert on connections to 77.90.185[.]28, 77.90.185[.]248, 185.93.89[.]75, 94.183.240[.]65, 2.188.214[.]142 Hunt for DNS tunneling patterns (high-entropy subdomain queries) resolving to this ASN Correlate with T1572 (Protocol Tunneling) — Iranian actors frequently use DNS-over-HTTPS for C2
Hunting hypothesis: Threat actors will scan for and exploit TeamCity agent polling endpoints within days of KEV publication. Monitor TeamCity agent communication ports for unauthenticated connection attempts Alert on unexpected agent registrations or polling from external IPs Review TeamCity audit logs for unauthorized build configurations or artifact modifications Hunt for T1059 (Command and Scripting Interpreter) execution spawned from TeamCity processes
Hunting hypothesis: Attackers exploiting CVE-2026-18577 will create or hijack administrative accounts to deploy payloads across managed endpoints. Monitor N-central for new admin account creation or privilege escalation Alert on bulk policy changes or script deployments to managed endpoints Hunt for T1219 (Remote Access Software) being used outside normal MSP maintenance windows Correlate with T1021.001 (Remote Desktop Protocol) lateral movement from RMM servers
Hunting hypothesis: MuddyWater hands off initial access to ransomware operators who deploy Hive variants. Look for the handoff pattern: initial access via phishing or supply chain → reconnaissance pause → ransomware deployment. Deploy hash-based detections for confirmed Hive samples — retrieve current file indicators from Anomali ThreatStream (see IOC table note below) Monitor for T1204.002 (Malicious File) execution from email attachments or downloaded archives Hunt for Hive-specific behaviors: volume shadow copy deletion, .hive extension encryption, ransom note creation Alert on T1486 precursors: vssadmin delete shadows, bcdedit /set {default} recoveryenabled No
Hunting hypothesis: Iranian operators distribute malware via GitHub repositories disguised as coding challenges or resume portfolios, targeting aerospace and defense hiring pipelines. Monitor for executable downloads from GitHub repositories by HR/recruiting endpoints Alert on T1204.002 execution of files from recently-created GitHub repos Hunt for unusual process execution chains originating from document viewers or archive extractors on recruiting team workstations
| Threat | ATT&CK |
|---|---|
| 1. ASN 213790 Command-and-Control (T1071 — Application Layer Protocol, T1571 — Non-Standard Port) | T1572 |
| 2. TeamCity Exploitation Attempts (T1190 — Exploit Public-Facing Application) | T1059 |
| 3. RMM Tool Abuse — N-central (T1190, T1078 — Valid Accounts) | T1219 T1021.001 |
| 4. Hive Ransomware / MuddyWater Initial Access (T1195.002 — Supply Chain Compromise, T1486 — Data Encrypted for Impact) | T1204.002 T1486 |
| 5. Fake Resume / Social Engineering (T1566.001, T1036 — Masquerading) | T1204.002 |
Block the above at perimeter firewalls, proxies, and DNS. Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
- Block all ASN 213790 IPs at network perimeter and verify no historical connections exist in 90-day logs
- Monitor for Hive ransomware precursors — mass file encryption, shadow copy deletion, lateral movement via SMB
- Iranian actors use ransomware for both revenue and destruction — do not assume a ransomware event is purely criminal; treat as potential state-sponsored destructive operation requiring national-level incident response notification
- Audit all internet-facing OT/ICS systems against the 6 new CISA ICS advisories (Schneider IGSS, MikroTik, Toptech fuel systems, Mitsubishi CC-Link, libiec61850)
- Hunt for BELLACIAO/SHELLAFEL web shells (T1505.003) on Exchange and SharePoint servers; monitor for living-off-the-land techniques post-web-shell deployment
- Verify network segmentation between IT and OT; ensure safety instrumented systems (SIS) are air-gapped from control networks
- Verify all remote access tools (VPN, RMM) are patched — N-central CVE-2026-18577 and any Citrix/Ivanti appliances
- Monitor for web shell deployment on patient portal and EHR-adjacent web servers; hunt for T1078 (Valid Accounts) abuse via compromised RMM credentials
- Prepare HHS/OCR breach notification and patient safety impact assessments; coordinate with HC3 (Health Sector Cybersecurity Coordination Center)
- Hunt for PINEDROP backdoor indicators on government networks; audit recently hired personnel who submitted GitHub-hosted portfolios
- Monitor for T1505.003 (Web Shell) on government web applications; hunt for unusual outbound connections from .gov/.mil endpoints to ASN 213790
- Coordinate with counterintelligence on fake resume campaigns targeting aerospace/defense personnel that may aim to place operatives or compromise cleared personnel
- Patch TeamCity instances to 2026.1.3+ — aerospace CI/CD pipelines building avionics or flight system code are high-value supply chain targets
- Monitor for T1036 (Masquerading) via GitHub repositories shared during hiring processes; hunt for unauthorized code commits or build artifact modifications in CI/CD
- Audit all third-party code dependencies; verify GitHub Actions are pinned to commit SHAs rather than mutable version tags; implement code signing for all build artifacts
77.90.185[.]28, 77.90.185[.]248, 185.93.89[.]75, 94.183.240[.]65, 2.188.214[.]142 — confirmed Iranian C2 infrastructure.Five months into this conflict, Iranian cyber operations are not winding down — they are methodically expanding. The pattern is unmistakable: infrastructure build-out at accelerated tempo, fresh ransomware tooling confirmed against US targets, critical vulnerabilities in the exact tool categories Iranian actors prefer (CI/CD, RMM, perimeter appliances) entering active exploitation catalogs, and hacktivist proxies in a quiet phase that historically precedes destructive waves. The MuddyWater-ransomware convergence deserves particular executive attention. When a state intelligence service operates ransomware, the calculus changes entirely: data destruction may be the goal, not data recovery. Your ransomware playbook needs a branch for "this may be a state-sponsored destructive operation disguised as criminal extortion." Do not wait for the next CyberAv3ngers headline. The infrastructure is being built now. The vulnerabilities are being cataloged now. The access is being established now.