| Development | Significance |
|---|---|
| FortiSIEM CVE-2026-106173 - Horizon3.ai published a full proof-of-concept exploit on October 20 for a CVSS 9.8 unauthenticated RCE in FortiSIEM's gRPC service. | The clock is now ticking |
| BeyondTrust CVE-2026-102764 - CISA added this CVSS 9.8 authentication bypass to KEV, confirming active exploitation. | Direct Iranian APT relevance confirmed |
| UNC7034 / BANISHED KITTEN - Google Threat Intelligence profiled a new Iranian espionage cluster on October 20, targeting journalists, political dissidents, and opposition figures via AiTM phishing that bypasses MFA. | New actor, active since July 28 |
| Ivanti Connect Secure zero-day chain - CVE-2026-111357 and CVE-2026-104935 confirmed exploited in the wild as of October 13, enabling root-level control of VPN appliances. | Organizations that have not yet patched remain directly exposed |
| ConnectWise Cloud Backup supply-chain compromise - Between October 14-16, over 300 Microsoft 365 tenants were compromised, with Global Administrator self-elevation confirmed. | Forensic review of Entra ID audit logs from October 10 onward is warranted |
| UNC6446 aerospace phishing campaign updated on October 21, indicating active, continuing operations against the aerospace/defense vertical. | Ongoing threat, not historical |
| Agentemis/CobaltStrike C2 infrastructure refreshed on October 21, with geographic expansion to China, Hong Kong, Japan, and Singapore. | Jurisdictional arbitrage complicates attribution and takedown |
| Hitachi Energy ICS advisories published for RTU500 and MicroSCADA X SYS600, expanding the exploitable attack surface for ICS/OT environments Cyber Av3ngers has previously targeted. | Expands attack surface, no active exploitation confirmed yet |
| Hacktivist silence reaches Day 11+. | Historical precedent indicates this pattern precedes coordinated campaigns |
| Date | Event | Significance |
|---|---|---|
| Feb 28, 2026 | Iran conflict begins | Day 0 — cyber operations commence alongside kinetic activity |
| Jul 28, 2026 | UNC7034 (BANISHED KITTEN) first observed | New Iranian espionage cluster begins AiTM operations against dissidents |
| ~Oct 10, 2026 | Pro-Iran hacktivist groups go silent | Last known operations by Handala, DieNet, 313 Team, UWAYS QARANI |
| Oct 13, 2026 | Fortinet publishes FG-IR-26-180 | FortiSIEM CVE-2026-106173 advisory released; patch available (v7.5.1) |
| Oct 13, 2026 | Ivanti Connect Secure zero-day chain confirmed | CVE-2026-111357 + CVE-2026-104935 exploited in the wild for root-level VPN control |
| Oct 14–16, 2026 | ConnectWise Cloud Backup supply-chain compromise | 300+ M365 tenants compromised; Global Administrator self-elevation confirmed |
| Oct 16, 2026 | CISA urges BeyondTrust patching | CVE-2026-102764 (CVSS 9.8) and CVE-2025-61624 (FortiOS) added to KEV |
| Oct 20, 2026 | Horizon3.ai publishes FortiSIEM PoC exploit | Full exploit code for CVE-2026-106173 publicly available on GitHub |
| Oct 20, 2026 | CISA adds 6 new KEV entries | Including CVE-2026-96652 (Plex Media Server SSRF) |
| Oct 20, 2026 | UNC7034 (BANISHED KITTEN) formally profiled | Google Threat Intelligence creates actor profile |
| Oct 20, 2026 | Zimbra zero-click exploitation disclosed | CVE-2026-73570 with blockchain-based C2 and AzCopy exfiltration |
| Oct 20, 2026 | MuddyWater/UNC3313/UNC5667 profiles updated | ThreatStream records refreshed, though no new campaign reporting |
| Oct 21, 2026 | Agentemis C2 infrastructure refreshed | Iranian-hosted CobaltStrike nodes active; scanning IPs added |
| Oct 21, 2026 | Hitachi Energy RTU500 + MicroSCADA ICS advisories | CISA publishes ICSA-26-293-04 and ICSA-26-293-05 |
| Oct 21, 2026 | UNC6446 aerospace phishing campaign updated | Ongoing targeting of aerospace/defense sector |
FortiSIEM CVE-2026-106173 (CVSS 9.8) is an unauthenticated RCE via path traversal in the gRPC service on TCP port 27918, achieving code execution within 60 seconds via a cron script overwrite.
Google Threat Intelligence formally profiled UNC7034 on October 20, revealing an Iranian cluster active since July 28. BANISHED KITTEN targets journalists and dissidents using AiTM phishing, OAuth consent phishing, and Android malware.
Iranian-hosted CobaltStrike BEACON infrastructure ("Agentemis") was refreshed on October 21, with active nodes on Iranian ASNs spanning China, Hong Kong, Japan, and Singapore. This five-country footprint complicates attribution and takedown, suggesting deliberate jurisdictional arbitrage.
Handala, DieNet, 313 Team, UWAYS QARANI, and Cyber Av3ngers have claimed zero operations for 11+ days - the longest pause of the conflict. During active conflict phases, these groups typically claim 2-5 operations per week.
CISA published advisories for Hitachi Energy RTU500 and MicroSCADA on October 21. MicroSCADA is used in electrical substations - infrastructure Cyber Av3ngers has demonstrated capability and intent to target. Additional advisories cover Moxa AIG-302 and HMS Networks PCAN.
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| Pro-Iran hacktivist silence breaks with coordinated multi-group campaign | 60% | 5 days | 11+ day pause exceeds 2× historical baseline; mirrors pre-positioning patterns before previous coordinated attacks |
| FortiSIEM CVE-2026-106173 exploited in the wild | 40% | 7 days | Public PoC on GitHub; Iranian actors (Pioneer Kitten) have demonstrated rapid Fortinet exploit adoption |
| BeyondTrust CVE-2026-102764 leveraged by Pioneer Kitten for DIB access | 30% | 14 days | CISA KEV confirms exploitation; actor's documented preference for remote access tool exploitation |
| Iranian adoption of autonomous AI exploitation frameworks (ARTEX-class) | 20% | 30 days | Open-source availability; Chinese actors already operationalizing; Iranian actors historically adopt proven tooling |
| ICS/OT targeting leveraging newly disclosed Hitachi Energy vulnerabilities | 15% | 30 days | Cyber Av3ngers have RTU targeting capability; new advisories expand attack surface; no exploitation confirmed yet |
Monitor TCP/27918 for connections from non-management subnets; deploy file integrity monitoring on /opt/charting/redishb.sh; alert on new cron jobs. ATT&CK: T1190 T1059.004 T1036
Audit BeyondTrust logs for unauthorized file operations; monitor outbound connections and sessions from unexpected geographies/ASNs. ATT&CK: T1190 T1078
Compromised endpoints beacon to Agentemis-tagged C2 infrastructure on HTTPS/443, DNS/53, or high ports.
Targeted personnel receive phishing links to AiTM proxy pages that capture session tokens post-MFA.
Threat actors probe or exploit Hitachi Energy RTU500 or MicroSCADA management interfaces exposed to IT networks.
Block at perimeter firewalls/proxies/DNS.
/opt/charting/redishb.sh or- Audit BeyondTrust deployments; review OAuth grants
- Inventory Hitachi RTU500/MicroSCADA deployments; apply ICSA-26-293-04/05 patches and verify IT/OT segmentation
- Patch FortiSIEM if deployed for monitoring; audit for shadow IT Plex deployments
- Enforce hardware security key MFA for Iran-policy personnel; verify Ivanti patching against the zero-day chain
- Review email security for engineering; pin CI/CD to commit SHAs
The Iranian cyber threat picture on Day 235 of the conflict is defined by a paradox: the quieter the surface, the louder the signal. Active C2 infrastructure is being maintained. New espionage actors are being deployed. Critical vulnerabilities in the exact products Iranian APTs prefer now have public exploit code. And the hacktivist groups that have been the most visible face of Iranian cyber operations have gone dark for longer than at any point in this conflict.