| Date | Event | Significance |
|---|---|---|
| Oct 22 | Siemens ICS advisory batch — 8 advisories covering SIMATIC S7, APOGEE/TALON BMS, RUGGEDCOM, WinCC, Industrial Edge | Expanded OT/ICS attack surface; APOGEE/TALON BMS advisories directly relevant to building management in government and military facilities |
| Oct 23 | CVE-2026-115560 disclosed — third PHP2Shell flaw affecting session upload progress | No patch available. Workaround: disable session.upload_progress.enabled in php.ini |
| Oct 24 | Researcher Adel Karimi confirms successful PHP2Shell RCE via honeypot — 800 KiB memory disclosure followed by payload delivery | Proof of exploitation in the wild; moved from theoretical to confirmed |
| Oct 25 | TWOSTROKE campaign targeting Azerbaijan/Turkey updated; credential theft via compromised Israeli websites reported | Iranian-nexus espionage operations active in conflict-adjacent geographies |
| Oct 26 | CISA adds CVE-2026-109618 and CVE-2026-109619 to Known Exploited Vulnerabilities catalog; federal patch deadline set for Oct 29 | Mandatory patching for federal agencies; strong signal for all organizations |
| Oct 26 | Gheist GitHub Actions campaign confirmed still active — 850+ accounts, 13,500+ malicious branches, AWS Secrets Manager enumeration | Supply-chain compromise with no external C2 to block; exfiltration occurs through GitHub's own API |
| Oct 26 | Siemens Software Center CVE-2026-110936 confirmed actively exploited via ClickFix/Romulus malware delivery platform | Novel supply-chain vector into OT environments — Siemens update manager weaponized |
| Oct 27 | XWorm C2 (178.131.57[.]235, Tehran) and Sliver C2 (45.147.77[.]210, Iran) confirmed active with fresh samples | Persistent Iranian-hosted C2 infrastructure; XWorm node tracked since April 2026 |
| Oct 27 | CERT-UA/Dutch AIVD confirm Operation CameraSwarm — 14,530 Dahua cameras compromised for military surveillance | IP cameras confirmed as state-sponsored intelligence collection platforms |
| Phase | Timeframe | Cyber Activity |
|---|---|---|
| Onset, pre-positioning | Feb 28 - Sep 2026 | Confrontation begins Feb 28 (now eight months old); XWorm C2 active since ~April; CameraSwarm compromises Jun-Jul; Gheist first reported Sep |
| PHP2Shell wave | Oct 22 - 26 | Siemens batch, third PHP flaw, honeypot RCE, CISA KEV listing, Gheist and Software Center exploitation |
| Current (month 8) | Oct 27, 2026 | XWorm and Sliver C2 active with fresh samples; CameraSwarm confirmed by CERT-UA and AIVD |
CVE-2026-109618 (CVSS 9.8) and CVE-2026-109619 (CVSS 8.1): unauthenticated RCE in PHP (~70% of websites), 32.51 million services exposed per Censys. CVE-2026-115560 has no patch; only session.upload_progress.enabled=0. 35+ vendors (Siemens, SonicWall) list affected products. Pioneer Kitten (Fox Kitten, UNC5625) weaponized Fortinet, Pulse Secure and Citrix within days, so Iranian adoption in 7-14 days is highly probable.
XWorm v5.6 (Mobin Net, active ~6 months) and Sliver (self-signed, expired TLS) nodes stay live; neither is attributed. Profiles updated within 30 days: APT34 (OilRig), APT35 (Charming Kitten), APT42, MuddyWater (UNC3313), UNC4444 (Imperial Kitten), UNC1860 (ShroudedSnooper), Agrius (UNC2428), Tortoiseshell, BANISHED KITTEN, Cotton Sandstorm, LYCEUM, Scarred Manticore, UNC6446. MuddyWater and Pioneer Kitten are silent: pre-positioning.
CERT-UA, Hunt.io and AIVD: a Russian-speaking operator hit 58 Ukrainian cameras via CVE-2017-7921, CVE-2020-25078, CVE-2021-33044, CVE-2021-33045 and CVE-2021-36260 (plus TP-Link and MikroTik enumeration); CameraSwarm compromised 14,530 Dahua cameras (Jun-Jul) and planted backdoor p2pwn / p2password on 1,923, surviving resets. Image recognition tracked vehicles, weapon deliveries and personnel.
Eight advisories (Oct 22): S7 Webserver API, APOGEE/TALON/Desigo, RUGGEDCOM CROSSBOW and APE1808, Industrial Edge, S7-1500, WinCC. CVE-2026-110936 (Software Center) is exploited via Romulus/ClickFix; with SSA-566512 (PHP2Shell) the PHP-to-ICS surface widens.
850+ accounts, 13,500+ branches (ci-sync-*, sync-check.yml); Base32 secrets leave via GitHub's API, so no C2 to block. AWS Secrets Manager credentials are used within hours for cloud movement. Overlap with Storm-0940/CovertNetwork-1658.
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| PHP2Shell exploitation expands from scanning to targeted attacks against government and military web applications | 70–80% | 7 days | KEV confirmation, 32.5M exposed services, historical pattern of rapid weaponization |
| Iranian actors (particularly Pioneer Kitten/UNC5625) adopt PHP2Shell for initial access operations | 65–75% | 7–14 days | Pioneer Kitten's documented pattern of rapid adoption of internet-facing exploits (Fortinet, Pulse Secure, Citrix) |
| Siemens Software Center exploitation via Romulus/ClickFix adopted by additional threat actors, potentially including Iranian groups targeting ICS | 40–60% | 14–30 days | Active exploitation confirmed; Romulus appears to be a commercial/affiliate delivery platform lowering the barrier to entry |
| Pro-Iran hacktivist groups (Handala, DieNet, 313 Team) resume information operations after current operational pause | 40–60% | 7–21 days | Multi-cycle silence is atypical; anniversary dates and geopolitical triggers historically reactivate these groups |
| Iranian actors exploit Dahua camera P2P vulnerabilities for BDA collection against Israeli/allied military facilities, mirroring Russian TTPs | 30–40% | 30 days | TTP convergence documented; Iranian groups have demonstrated interest in surveillance collection |
| Gheist campaign pivots from secret exfiltration to code injection in enterprise CI/CD pipelines | 30–40% | 14–30 days | AWS Secrets Manager access already confirmed; CI/CD pipeline manipulation is the logical next step |
| Priority | Detection | ATT&CK | Data Source |
|---|---|---|---|
| P1 | PHP webshell creation in web roots post-Oct 21 | T1505.003 | File integrity monitoring, web server logs |
| P1 | Outbound connections to Iranian ASNs (AS50810, AS51889, AS62442) | T1071.001 | Firewall, proxy, DNS logs |
| P1 | XWorm hash matches on endpoint | T1059.001 | EDR, AV |
| P2 | GitHub branch creation matching ci-sync-* | T1195.002 | GitHub audit logs |
| P2 | AWS Secrets Manager enumeration from new principals | T1528 | CloudTrail |
| P2 | Dahua camera account p2pwn present | T1078 | Camera management audit |
| P3 | Unsigned DLL in Siemens Software Center directories | T1574.001 | EDR, Sysmon |
| P3 | Self-signed expired TLS on outbound HTTPS (Sliver pattern) | T1573.002 | TLS inspection, proxy logs |
IOC Blocking Table:
45.147.77[.]210178.131.57[.]23578.157.46[.]765.202.169[.]252
Block the above at perimeter firewalls, proxies, and DNS; alert on any connection. 45.147.77[.]210 Sliver C2 (AS51889); 178.131.57[.]235 XWorm C2 (AS50810, Mobin Net, Tehran); 78.157.46[.]76 Iranian proxy (AS62442); 5.202.169[.]252 Iranian infrastructure. Hashes: SHA-256, XWorm v5.6 4af95610a49dc2bd621cb0fdbfde52cbbae89adc5c5b2cdcd499777f0704a0f5; SHA-1, XWorm f376b561ae7d4be6f39b942975c72af235bcdd41; MD5, XWorm 3368824d65d514a328b8a59cfa97e6b1; MD5, associated malware a6d687e7d11440308a4198cc9666c585. Additional IOCs via Anomali ThreatStream Next-Gen and partner feeds.
Hunting Hypotheses:
HUNT 01 · T1190
Hunt 1: PHP2Shell Post-Exploitation (T1190 → T1059.004 → T1505.003)
Search web server logs for anomalous POST requests to PHP endpoints with payloads >800 KB (consistent with the memory disclosure technique observed in honeypot captures); Hunt for new
.php files created in web-accessible directories after October 21; Monitor for unexpected session.upload_progress activity in PHP error logs; Look for php.ini or .user.ini modifications disabling security settings.HUNT 02 · T1071.001
Hunt 2: XWorm/Sliver C2 Beaconing (T1071.001, T1573.002)
Query DNS and proxy logs for connections to AS50810 (Mobin Net) and AS51889 (Gostaresh Pardazesh Dana Negar) — any traffic to these Iranian ASNs warrants investigation; Hunt for Sliver's default self-signed TLS certificate pattern (expired cert, non-standard issuer) on outbound HTTPS connections; Monitor for PowerShell execution (T1059.001) spawned by unexpected parent processes — XWorm's primary execution method.
HUNT 03 · T1195.002
Hunt 3: Gheist Supply-Chain Artifacts (T1195.002, T1528)
Audit GitHub organization activity logs for branch creations matching
ci-sync-* pattern; Search for workflow files at .github/workflows/sync-check.yml across all repositories; Look for commit messages containing ci: sync config from unfamiliar contributors; Monitor AWS CloudTrail for Secrets Manager ListSecrets and GetSecretValue API calls from new or unexpected IAM principals.HUNT 04 · T1078
Hunt 4: Dahua/Hikvision Camera Compromise (T1078, T1125)
Query DHCP/DNS logs for Dahua devices (OUI
3C:EF:8C, 40:2C:76, A0:BD:1D) communicating on TCP/37777; Audit camera management consoles for user account p2pwn — presence confirms compromise; Monitor for P2P/Easy4IP cloud connectivity from camera subnets to external endpoints; Check for 127.0.0.1 DVRIP authentication events in camera audit logs (indicator of local exploitation).HUNT 05 · T1574.001
Hunt 5: Siemens Software Center DLL Hijack (T1574.001)
Monitor for unsigned DLL loads in Siemens Software Center installation directories; Hunt for
rundll32.exe or regsvr32.exe execution with Siemens-related paths; Alert on ClickFix-style browser-to-PowerShell execution chains (clipboard paste → PowerShell → DLL drop).Financial Services
Banking, Payments
Primary threats
PHP2Shell on banking portals, payment gateways.
Secondary threat
Gheist secrets; M365 token replay.
Actions
- Rotate GitHub tokens issued before Oct 15; FIDO2/passkeys and CAE in Entra ID.
Energy
Generation, Distribution
Primary threats
Siemens APOGEE/TALON, S7, WinCC, RUGGEDCOM (CROSSBOW SQLi hits substations).
Secondary threat
Cyber Av3ngers (IRGC).
Actions
- PHP2Shell plus Siemens is a dual vector; update Software Center to v4.0.9.8+.
Healthcare
Portals, EHR
Primary threats
PHP2Shell on portals, EHR, device consoles.
Secondary threat
Hospital cameras; vendor Gheist exposure.
Actions
- Audit cameras for
p2pwn; disable P2P/Easy4IP; get vendors' GitHub attestations.
Government
Federal, Military Sites
Primary threats
Oct 29 federal deadline (BOD 22-01); BMS runs HVAC, access, fire suppression.
Secondary threat
CameraSwarm; MuddyWater (MOIS) silence.
Actions
- Audit cameras near military, diplomatic, logistics sites.
Aviation / Logistics
Aerospace, Logistics
Primary threat
UNC6446 aerospace phishing; Arista VeloCloud CVE-2026-114625 (CVSS 9.9).
Secondary threat
Airport, port cameras; GitLab CVE-2026-110264, CVE-2026-97229 (CVSS 10.0).
Actions
- Keep camera networks off the internet; patch self-hosted GitLab.
No sector cards match the selected filters.
Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and set
session.upload_progress.enabled=0 (CVE-2026-115560); federal deadline Oct 29. Patch Arista VeloCloud for CVE-2026-114625 (CVSS 9.9): any authenticated user can become superuser.Incident Responder
Block Sliver
45.147.77[.]210, XWorm 178.131.57[.]235, plus proxy 78.157.46[.]76 and 5.202.169[.]252; SIEM watchlist, alert on 90-day history. Deploy XWorm hash signatures to all EDR.SOC Analyst
No immediate actions for the selected roles.
Audit GitHub for
ci-sync-* and .github/workflows/sync-check.yml; rotate tokens issued before Oct 15; require PR reviews on workflow changes. Update Siemens Software Center to v4.0.9.8+ (CVE-2026-110936), audit for rogue DLLs. Patch GitLab CVE-2026-110264 and CVE-2026-97229 (CVSS 10.0, unauthenticated RCE).Threat HunterIAM AnalystIncident Responder
Audit Dahua/Hikvision cameras for
p2pwn; disable P2P/Easy4IP; update firmware; limit TCP/37777 to management VLANs. Review Siemens ICSA-26-295: APOGEE/TALON BMS and WinCC first.ICS / OT
No 7-day actions for the selected roles.
Diversify OSINT (Recorded Future, Mandiant Advantage, Telegram) after a five-cycle gap. Red team the PHP-to-ICS chain. Update IR playbooks for camera compromise with physical security. Brief the board at the eight-month mark: quiet Iranian groups are pre-positioning.
CISO / ExecIncident Responder
Build detection for Siemens Software Center DLL hijack across Siemens desktop tools in OT.
SOC AnalystICS / OT
No 30-day actions for the selected roles.
The Bottom Line
IT, OT, physical security and military intelligence now overlap; adversary silence is warning, not comfort.
1
Is PHP patched? Patch velocity is measured in days.
2
Are cameras, BMS and update managers in scope? If it has an IP, yes.
3
Silence is preparation. Is your detection ready when it breaks?