Skip to main content
TLP:GREEN  ·  Iran / Israel Conflict
Iran's Cyber War Just Went Global:

What CISOs Need to Know Right Now

HIGH. Upgraded from ELEVATED. Three converging factors - MuddyWater's geographic expansion to U.S. targets, confirmed Iranian attribution in cold-chain infrastructure attacks, and a volatile diplomacy-plus-kinetic escalation cycle - have pushed the threat environment to HIGH for Western critical infrastructure organizations.

I am a
My sector

DateEventSignificance
Nov 2, 2026U.S. strike on Iran's Qeshm Island anti-aircraft facilityOpens Iran's doctrinal cyber retaliation window
Nov 3, 2026CVE-2026-119977 (WordPress Core RCE) added to CISA KEVUnauthenticated RCE in WordPress 4.7–7.1.3 during upgrade windows; CVSS 8.1
Nov 5, 2026Five-agency advisory (CISA/FBI/HHS/USDA/DoT) on cold-chain attacksConfirms active targeting of industrial refrigeration and cold-chain monitoring systems globally
Nov 6, 2026CVE-2026-19868 (SonicWall SSLVPN SAML bypass) added to CISA KEVAuthentication bypass allowing MFA circumvention; CVSS 7.5
Nov 8, 2026Houthi missile strikes on Riyadh airport and Saudi Eastern Province oil corridorDual-trigger escalation environment; 24–72 hour hacktivist surge window
Nov 8, 2026Operation Snowball report published (Malbear Labs)Autonomous AI agent conducted full kill-chain intrusion of European telecom over 2 weeks
Nov 9, 2026Fresh MuddyWater POWERSTATS samples surface targeting U.S.Geographic expansion from Israel to the U.S. homeland — campaign broadening consistent with wartime escalation
Nov 9, 2026New Sliver and Moukthar C2 infrastructure identified on IRGC-affiliated networksActive command-and-control on Iranian ASNs including an IRGC-linked cultural institute
Nov 9, 2026Pioneer Kitten/Fox Kitten records 180 days of zero detected activity during active conflictAnomalous silence in DIB-targeting actor is the most operationally concerning signal this cycle; dormant access activation risk is elevated
Nov 9, 2026Iran launches diplomatic offensive; Qatar PM meets Trump; Rubio calls war "unpopular but necessary"Dual-track diplomacy + kinetic operations = peak cyber pre-positioning window

PhaseTimeframeCyber Activity
Conflict onsetFeb 28, 2026Iranian APTs shift from espionage to pre-positioning for retaliation
Escalation periodMar-Jun 2026MuddyWater, APT42/CHARMING KITTEN, OilRig/APT34 intensify operations against Israeli targets; hacktivist proxies (Handala, Cyber Toufan) conduct DDoS and defacement campaigns
DIB pre-positioningMar-May 2026Pioneer Kitten/Fox Kitten associated with VPN exploitation and dormant access in defense industrial base networks - then goes silent
Cold-chain campaign emergesSep-Oct 2026Industrial refrigeration attacks detected in Europe; blood banks in France targeted; Danfoss chillers specifically named
Kinetic escalationNov 2, 2026U.S. strikes Qeshm Island; Houthi missiles hit Riyadh (Nov 8)
Geographic expansionNov 9, 2026MuddyWater POWERSTATS campaign pivots to U.S. targets; five-agency cold-chain advisory with Iran attribution; UK deploys military cyber teams

Actor: MuddyWater (also tracked as UNC3313, TEMP.Zagros, Mercury, Seedworm, Static Kitten) - affiliated with Iran's Ministry of Intelligence and Security (MOIS).

Actors: CyberAv3ngers (IRGC-affiliated, ICS/OT targeting capability) is the most likely operational group, though formal attribution remains at the "several analysts and officials informally suspect Iranian involvement" level per Google Threat Intelligence reporting.

Actor: Unattributed (Chinese-language operator instructions; nationality unconfirmed); CVE-2021-4034 (PwnKit privilege escalation); and CVE-2020-7961 (Liferay RCE); It used Sliver v1.7.8 with Cloudflare domain fronting for C2 (also: PwnKit).

T1562.001

Two new additions to CISA's Known Exploited Vulnerabilities catalog demand immediate attention, particularly given Iranian threat actors' well-documented preference for VPN and edge-device exploitation: CVE-2026-19868 - SonicWall SSLVPN SAML/MFA Bypass (CVSS 7.5) Allows authenticated users to bypass SAML and multi-factor authentication entirely (also: UNC757, Lemon Sandstorm).

Five active command-and-control IP addresses geolocated to Iran were identified on November 9, running Sliver and a previously undocumented framework called Moukthar: Three IPs running Sliver C2 across Iranian hosting providers including ArvanCloud (ASN 202468).

Pioneer Kitten/Fox Kitten - the IRGC-linked group known for exploiting VPN appliances (Fortinet, Ivanti, BeyondTrust) and maintaining long-term dormant access in defense industrial base (DIB) networks - has produced zero detected activity for 180 days during an active war.

ScenarioProbabilityBasis
MuddyWater U.S.-targeting campaign produces additional IOCs as phishing waves land; expect SimpleHelp or Atera RMM tool abuse as secondary payload70%Geographic expansion confirmed Nov 9; campaign infrastructure is active
If Qatar-mediated negotiations produce a pause/ceasefire signal, hacktivist proxies (Handala, YEMEN CYBER GROUP) surge within 24–48 hours to demonstrate capability before standing down60%Consistent with historical proxy behavior during diplomatic windows
Cold-chain attacks expand to U.S. military commissary and logistics systems50%Campaign already global in scope; U.S. military cold-chain is a logical escalation target during active conflict
Pioneer Kitten/Fox Kitten dormant access activates if negotiations fail and kinetic escalation resumes40%180-day silence is anomalous; activation would be consistent with IRGC doctrine of holding access for decisive moments
Additional autonomous AI-agent intrusion campaigns surface across other sectors35%Operation Snowball demonstrates the capability exists; tooling (DeepSeek Flash, Sliver) is commercially available

IOC Blocking Table:
45.147.77[.]21095.38.176[.]143109.122.240[.]198194.110.24[.]98217.60.241[.]17146.70.53[.]182113.23.212[.]15api.tablacysexplorer[.]comtablacysexplorer[.]com

DNS blocklist. 45.147.77[.]210 Sliver C2, ASN 51889 (Iran); 95.38.176[.]143 Sliver C2, ASN 202468 / ArvanCloud (Iran); 109.122.240[.]198 Moukthar C2, ASN 62048 / Avini Institute — IRGC-affiliated (Iran); 194.110.24[.]98 Sliver C2, Webdade (Iran); 217.60.241[.]17 Tofsee/Gheg C2, ASN 51396 / Pfcloud (Iran), port 418; 146.70.53[.]182 Operation Snowball SSH access (port 2299); 113.23.212[.]15 Operation Snowball tool staging (port 8000); api.tablacysexplorer[.]com Sliver C2 beacon, Cloudflare-fronted (Operation Snowball); tablacysexplorer[.]com Parent domain of Sliver C2 infrastructure. Hashes: 951b860f16055b844cdf6ec146e5b9d9cc49e6388f3ed9ab6fb7ecc4636f4d27 (POWERSTATS backdoor, U.S.-targeting); dd0820da1443fdde0d172421a0e4b99a18d8c68517bc7328ff2d06c01d26e9bd (POWERSTATS backdoor, U.S.-targeting); 4a6a2cd420b08f4422b59e7d81f28df3634e7024f8c5586af4e5212e82c22019 (POWERSTATS backdoor, U.S.-targeting); 282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207 (POWERSTATS / MuddyWater (Google TI corroborated)). Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.

Hunting Hypotheses:
HUNT 01 · T1566.001, T1059.001, T1547.001, T1071.001
Hunt Hypothesis 1: MuddyWater POWERSTATS Delivery
What to look for: Spearphishing emails with macro-enabled Office documents or LNK files delivering PowerShell-based backdoors. Secondary deployment of SimpleHelp or Atera RMM agents on endpoints where no legitimate RMM deployment exists; Detection: Alert on powershell.exe spawned by Office processes (winword.exe, excel.exe). Hunt for unauthorized RMM tool installations. Retrohunt the four verified POWERSTATS hashes (listed in IOC table below) across endpoint telemetry for the past 30 days.
HUNT 02 · T1071.001, T1573.002, T1105
Hunt Hypothesis 2: Sliver C2 Beaconing to Iranian Infrastructure
What to look for: Outbound HTTPS connections to the Iranian C2 IPs and the api.tablacysexplorer[.]com domain. Sliver uses mutual TLS (mTLS) — look for self-signed certificate handshakes on non-standard ports; Detection: TLS certificate anomaly detection (self-signed certs to Iranian ASNs). DNS queries for tablacysexplorer[.]com. Netflow analysis for persistent beaconing patterns to ASN 51889, 202468, 62048, 51396.
HUNT 03 · T1505.003, T1078, T1133
Hunt Hypothesis 3: Pioneer Kitten/Fox Kitten Dormant Access
What to look for: Webshells on Fortinet, Ivanti Connect Secure, and BeyondTrust appliances. Dormant VPN sessions with anomalous authentication patterns. Indicators of SlumberRAT, TwoFace, or SilkySand malware families.
HUNT 04 · T1190, T1078, T1565.002, T1489
Hunt Hypothesis 4: Cold-Chain OT Manipulation
What to look for: Unauthorized changes to refrigeration controller setpoints. Internet-exposed Danfoss or similar industrial refrigeration control panels. Default credentials on OT controllers.
HUNT 05 · T1190, T1068, T1059.006, T1543.002, T1041
Hunt Hypothesis 5: AI-Agent Intrusion Patterns (Operation Snowball)
What to look for: Rapid, sequential exploitation of multiple CVEs on the same target within minutes (not hours). Automated lateral movement with no human dwell time. Perl or Python scripts appearing on systems with no development purpose. Sliver beacons with Cloudflare domain fronting.

Financial Services
Banks, Fintech, Insurance
Primary threat
MuddyWater's current campaign originated as SimpleHelp RMM phishing against Israeli financial institutions and has now expanded to U.S. targets.
Actions
  • Audit all RMM tool installations; 0022 (also: AnyDesk, Pink Sandstorm).
Energy
Oil & Gas, Grid, ICS/OT
Primary threats
The cold-chain attacks have direct implications for energy sector organizations operating industrial control systems, and Pioneer Kitten's historical targeting of energy infrastructure makes this sector a primary concern.
Actions
  • Conduct an emergency audit of all internet-exposed OT/ICS interfaces.
Healthcare
Hospitals, Pharma, Blood Supply
Primary threats
Healthcare organizations face a dual threat: cold-chain attacks targeting pharmaceutical and blood supply storage, and data exfiltration campaigns like Operation Snowball that compromised millions of patient records.
Actions
  • Immediately verify the integrity of cold-chain monitoring systems.
Government
Defense, DIB, State & Federal
Primary threats
Government and defense organizations are at the intersection of every threat in this report - MuddyWater's U.S. targeting, cold-chain attacks on military commissary systems, and the 180-day silence from Pioneer Kitten in DIB networks.
Actions
  • Launch a dedicated hunt sprint for Pioneer Kitten/Fox Kitten.
Aviation / Logistics
Airports, Logistics, Cargo
Primary threat
The Houthi missile strikes on Riyadh airport (November 8) and the cold-chain logistics targeting create a combined physical-cyber threat to aviation and logistics organizations.
Actions
  • Elevate monitoring of airport and logistics OT systems.
No sector cards match the selected filters.

Block Iranian C2 infrastructure at perimeter firewalls: 45.147.77[.]210, 95.38.176[.]143, 109.122.240[.]198, 194.110.24[.]98, 217.60.241[.]17. Add api.tablacysexplorer[.]com and tablacysexplorer[.]com to DNS blocklists. Ingest four verified MuddyWater POWERSTATS hashes into EDR blocklists and run retrohunt across all endpoint telemetry for the past 30 days. Block Operation Snowball infrastructure: 146.70.53[.]182 (port 2299) and 113.23.212[.]15 (port 8000). Patch SonicWall SSLVPN to remediate CVE-2026-19868 (SAML/MFA bypass). Review authentication logs for any SAML-bypass events since November 1. Patch WordPress Core to version 7.1.4+ to remediate CVE-2026-119977 (unauthenticated RCE). Audit upgrade logs for anomalous staging-path access. Remove all cold-chain controller management panels from the public internet. Verify refrigeration setpoints have not been tampered with. Implement out-of-band temperature monitoring.
SOC Analyst
No immediate actions for the selected roles.
Hunt for Moukthar C2 framework signatures across network telemetry. Treat any traffic to ASN 62048 (Avini Cultural Institute) as high-confidence IRGC infrastructure. Conduct Pioneer Kitten/Fox Kitten hunt across Fortinet, Ivanti, and BeyondTrust VPN appliances. Search for dormant webshells (T1505.003), SlumberRAT, TwoFace, and SilkySand. Audit Cisco BroadWorks XSP deployments for CVE-2026-20320 (XXE on port 2208). Disable external entity resolution in the OCI XML parser. Implement full CISA cold-chain hardening guidance: enforce strong credentials on all controllers, segment OT onto dedicated VLANs, configure safe operating limits with temperature deviation alerts. Audit all RMM tool installations enterprise-wide. Flag any SimpleHelp, Atera, or AnyDesk instance not deployed by IT.
SOC Analyst
No 7-day actions for the selected roles.
Evaluate AI-agent intrusion detection capabilities. Operation Snowball proves autonomous AI can conduct full kill-chain intrusions with no human dwell-time signature. Review whether behavioral analytics, UEBA, and SOC playbooks account for machine-speed, 24/7 attack patterns. Commission enhanced open-source intelligence collection - evaluate commercial Telegram monitoring services (Flashpoint, Recorded Future) for Iranian hacktivist channels (Handala, Cyber Toufan, YEMEN CYBER GROUP). Current OSINT collection has been degraded for three consecutive cycles, creating blind spots in hacktivist and information operations monitoring. Review and update incident response plans for ICS/OT scenarios with physical consequences (spoiled food, compromised blood supplies, disrupted pharmaceutical storage). The cold-chain campaign has crossed from cyber incident to physical safety event - ensure IR plans include facilities management, public health notification, and regulatory reporting. Brief executive leadership on the cold-chain threat as a physical safety issue, not solely a cybersecurity concern. Commission a red team assessment of detection capabilities against autonomous AI-agent intrusion patterns - specifically testing whether current detections catch machine-speed exploitation chains, 24/7 operational tempo, and adaptive defense evasion.
SOC Analyst
No 30-day actions for the selected roles.
The Bottom Line

The Iran conflict's cyber dimension has entered a new phase; the cyber pre-positioning that has been building for 254 days may activate.

1
Block Iranian C2 infrastructure.
2
Ingest four verified MuddyWater POWERSTATS hashes.
3
Block Operation Snowball infrastructure.
No items found.