| Development | Significance |
|---|---|
| FBI/USSS confirm the FortiBleed campaign is ongoing... | Threat actors are locking legitimate administrators out of their own... |
| IMPERIAL KITTEN built a fraudulent logistics/shipping... | First Iranian APT to deploy an interactive chat platform for social... |
| CHARMING KITTEN confirmed weaponizing ChatGPT... | First documented use of AI platform sharing features as a... |
| Citrix NetScaler CVE-2026-88779 added to CISA KEV... | Confirms sustained, systematic edge-device targeting |
| Six ICS/SCADA advisories dropped simultaneously (Oct... | An unusual disclosure density during an active conflict where Iranian... |
| Fresh Agentemis/Cobalt Strike C2 infrastructure identified on... | Consistent with pre-positioning patterns tracked throughout the... |
| MuddyWater has maintained operational silence for 30+... | The gap between stated intent and observed activity suggests active... |
| Phase | Timeframe | Cyber Activity |
|---|---|---|
| Kinetic campaign begins | Late Feb - Mar 2026 | US-Israeli military campaign against Iran begins; NCI joint advisory... |
| New tradecraft develops | Aug - Sep 2026 | IMPERIAL KITTEN develops logistics/shipping fraud infrastructure... |
| Allied attribution, maritime targeting | Sep 16-28, 2026 | GCHQ uncovers Iranian espionage against dissidents/journalists; FBI... |
| KEV surge, kinetic trigger, ICS advisories | Oct 1-6, 2026 | CISA adds Citrix CVE-2026-88779 to KEV; RBI warns of financial crisis... |
| Current (Day ~222) - FortiBleed scale confirmed | Oct 7, 2026 | FBI/USSS advisory confirms 86,644 compromised FortiGate devices... |
The FBI/USSS advisory quantifies FortiBleed's scale for the first time: 86,644 compromised FortiGate firewalls/SSL VPN gateways across 194 countries. Attackers use credentials from prior breaches and infostealer logs for credential stuffing against management interfaces, then extract password hashes for offline cracking and create persistent...
In early September, CHARMING KITTEN targeted an Israeli academic institution with ChatGPT shared-conversation links via WhatsApp, deploying DiskPlant which installs PowerLink RAT using the Dropbox API for C2 - a living-off-trusted-services chain where both platforms are typically whitelisted. This technique won't remain exclusive to CHARMING...
IMPERIAL KITTEN abandoned its historical job-recruitment lures for infrastructure masquerading as a legitimate logistics/shipping company with an interactive chat platform - the first such deployment by any Iranian APT. This directly aligns with the maritime dimension of the conflict and the FBI's active investigation into Iran-linked tanker...
CISA's October 6 batch covers Hitachi Energy RTU500/REB500/Asset Suite/SOI and Johnson Controls EasyIO - products explicitly within HYDRO KITTEN's (Cyber Av3ngers) known targeting scope, demonstrated via ZodiacRAT and the ScratchWiper destructive tool. The convergence of fresh disclosures with confirmed threat actor capability against these...
MuddyWater has been silent 30+ days - historically preceding retooling or major operational shifts. BANISHED KITTEN/Handala has shown no wiper activity since the late-September Five Eyes ChosenBrick advisory despite publicly announcing intensified operations following Khamenei's death. The gap between announced intent and observed activity...
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| IMPERIAL KITTEN operationalizes logistics chat platform against... | 70% | 7–14 days | Infrastructure built and tested; CrowdStrike assesses "likely"... |
| FortiBleed access is leveraged by Iranian-nexus actors (Pioneer... | 60% | 7–14 days | Pioneer Kitten's documented Fortinet exploitation history; 86,644... |
| BANISHED KITTEN/Handala launches new destructive wiper campaign... | 50% | 7–21 days | Announced intensification post-Khamenei death; operational silence... |
| Dormant Iranian access in DIB contractor networks is activated... | 40% | Contingent on kinetic event | Pre-positioned access via Pioneer Kitten and UNC6446 aerospace... |
| ChatGPT/AI platform weaponization technique adopted by additional... | 60% | 30–60 days | Technique is simple, effective, and exploits universal trust in AI... |
Hunt Hypothesis: CHARMING KITTEN is delivering...
Hunt Hypothesis: PowerLink RAT uses Dropbox API for...
Hunt Hypothesis: FortiBleed actors are creating...
Hunt Hypothesis: Iranian-hosted Cobalt Strike...
Hunt Hypothesis: Iranian actors may exploit newly...
| Threat | ATT&CK |
|---|---|
| 1. ChatGPT and AI Platform Abuse (T1566.003, T1204.002) | T1566.003 T1204.002 T1059.001 |
| 2. Dropbox API C2 (T1102.002, T1071.001) | T1102.002 T1071.001 T1547... |
| 3. FortiGate Account Manipulation (T1098, T1531, T1078) | T1098 T1531 T1078 |
| 4. Agentemis/Cobalt Strike Beaconing (T1071.001, T1573) | T1071.001 T1573 |
| 5. ICS/OT Anomaly Monitoring (T1190, T0831) | T1190 T0831 |
Agentemis/Cobalt Strike C2 (217.60.241[.]17, port 443; 87.107.191[.]39, port 53); unknown malware on TIC backbone (78.39.51[.]23, port 7443); Remcos RAT (217.60.241[.]19, port 5903); SOCKS proxy (95.38.235[.]192). Block at perimeter firewalls and add to SIEM watchlists.
- Audit all FortiGate devices in perimeter/DMZ; implement out-of-band management; segment SWIFT from VPN-accessible zones
- Inventory all Hitachi Energy deployments; isolate internet-facing management interfaces; apply ICSA-26-279 firmware updates
- Verify FortiGate devices haven't been compromised; test EHR recovery from offline backups against admin-lockout scenarios
- Hunt for dormant VPN sessions and GitHub-hosted implant callbacks in DIB-connected networks; patch Dell System Update to 2.3.0.0+
- Brief staff on fraudulent logistics platforms with interactive chat; implement domain monitoring for typosquats of your brand
We are at the six-month mark of an active military conflict with a nation-state possessing sophisticated, diverse, battle-tested cyber capabilities. The intelligence shows an adversary that is innovating, not retreating: CHARMING KITTEN weaponizing the AI tools your employees use daily, IMPERIAL KITTEN building social engineering infrastructure tailored to your supply chain, over 86,000 compromised firewalls blurring the line between criminal ransomware and state-sponsored espionage, and six...