| Development | Detail |
|---|---|
| Iranian C2 confirmed active and refreshing | Sliver, AdaptixC2 and XWorm nodes on Arvan Cloud, Giti Secure Cloud and Mobin Net showed fresh timestamps Oct 27-28; one XWorm node nears expiration, so new indicators will outrun current blocklists. |
| Siemens Software Center exploited (CVE-2026-110936) | ClickFix lures run PowerShell that fetches an MSI sideloading a weaponized DLL beside a legitimate Siemens binary: Legion Loader, then a RAT on ICS engineering workstations. |
| Dell PowerProtect Data Domain: two CVSS 9.8 bypasses (CVE-2026-86397 / CVE-2026-86400) | Unauthenticated attackers can create privileged accounts or run commands as root on backup infrastructure, the last line of defense against ransomware and wipers. |
| AI-autonomous exploit chaining reaches operational maturity | Anthropic's unreleased model chained vulnerabilities across Chrome (62 CVEs, 13 sandbox escapes), Safari, Android, Windows (CVE-2026-33096) and Linux (CVE-2026-98432, CVSS 9.8, root in ~53 minutes, no login). CyberStrikeAI ran 44 AI agents against 19 organizations in Japan. |
| Destructive Iranian proxies go quiet | Cyber Av3ngers (IRGC-affiliated ICS), Cotton Sandstorm/Emennet Pasargad (information operations) and BANISHED KITTEN (wipers) are silent mid-conflict: often preparation, not reassurance. |
| PHP2Shell chain actively exploited (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) | CISA added the first two to KEV on Oct 26; the third (Oct 23) has no patch. About 32.5 million PHP services are in scope, and Iranian actors adopt PHP/web exploits fast. |
| CISA published four ICS advisories on October 27 | Mitsubishi Electric GENESIS64, EPICS Base, Siemens SIMATIC S7 API and APOGEE/TALON: energy, manufacturing and building management. |
| Operation CameraSwarm: 14,530 Dahua cameras weaponized | CERT-UA and AIVD (Oct 27): Iranian-linked operators compromised over fourteen thousand Dahua cameras across critical infrastructure sites. |
| SHADOW-EARTH-79 targets Starlink users in conflict zones | TrendAI: RTB ad infrastructure tracks Starlink users in 105 countries with over 90% bid dominance in several conflict-adjacent regions; CENTCOM personnel face de-anonymization risk. |
| Phase | Timeframe | Cyber Activity |
|---|---|---|
| Onset and C2 staging | Feb 28 - Oct 15 | Conflict begins Feb 28; Sliver + AdaptixC2 on Arvan Cloud (early Oct), XWorm on Mobin Net (Oct 10), Sliver open directory on Giti Secure Cloud (Oct 15) |
| Siemens and PHP2Shell | Oct 20 - 26 | Rewterz details ClickFix RAT campaign (Oct 20); CVE-2026-115560 disclosed (Oct 23); PHP2Shell on KEV and BANISHED KITTEN wiper update, no victims (Oct 26) |
| ICS, cameras, feeds | Oct 27 | CISA ICS advisories; CameraSwarm confirmed; APT34, UNC1860, MuddyWater, APT42 profiles updated; C2 nodes refreshed (Oct 27-28) |
| Current | Oct 28 | Dell dual CVSS 9.8 advisories; UNC757/Pioneer Kitten and UNC6446 updated; CVE-2026-48356 and CVE-2026-114625 (CVSS 9.9) added to KEV |
Dual-framework nodes on Arvan Cloud (ASN 202468) and Giti Secure Cloud (ASN 204104, open directory); XWorm on Mobin Net (ASN 50810) will rotate within the ASN, so monitor ASNs, not just IPs. Named actors: Pioneer Kitten/Fox Kitten/UNC5625, APT34/OilRig, APT35/Charming Kitten, APT42/CALANQUE, MuddyWater/UNC3313, UNC1860/ShroudedSnooper, Agrius/UNC2428, Cotton Sandstorm, Cyber Av3ngers, UNC757, UNC4444/Imperial Kitten/Crimson Sandstorm, UNC6446. MuddyWater and Pioneer Kitten are silent: pre-positioning.
The signed SiemensSoftwareCenter.exe sideloads archive.dll (Legion Loader, then a RAT) and may slip past allowlisting on engineering workstations.
CVE-2026-86397 creates privileged accounts, CVE-2026-86400 runs root commands, both unauthenticated. BANISHED KITTEN, Agrius, Qilin and Cactus target backups to block recovery.
Linux chain: root shell in ~53 minutes. CyberStrikeAI hit 19 organizations (16 in Japan). Storm-0940's ARTEX compromised 2,250+ M365 tenants via ConnectWise. Iranian access would collapse exploit timelines to hours.
66,208 targeted impressions; 90.1% bid dominance in Israel, 91.1% in Hungary; de-anonymization and script injection.
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| XWorm C2 rotates to new IP within ASN 50810 (Mobin Net) | HIGH (>80%) | 1–3 days | Current node approaching expiration; operator pattern suggests same-ASN rotation |
| New CISA KEV additions for PHP2Shell (CVE-2026-109618/109619) or Brotli/Node2Shell (CVE-2026-111497) | MODERATE-HIGH (50–65%) | 7 days | Active scanning continues; Iranian actors are historically fast PHP/web exploitation adopters |
| UNC757 (Pioneer Kitten) or UNC6446 produce new DIB-targeting campaign indicators | MODERATE (40–60%) | 7–14 days | Both updated this week; aerospace phishing campaign refreshed October 28 |
| Cyber Av3ngers resurface with new ICS targeting campaign | LOW-MODERATE (25–40%) | 14–30 days | Extended quiet period during active conflict is historically unusual; may precede coordinated operation |
| AI-autonomous exploitation tools adopted by Iranian threat actors | MODERATE (35–50%) | 30–90 days | Open-weight models and CyberStrikeAI-style platforms lower the barrier; Iranian actors have demonstrated rapid tool adoption |
| Destructive wiper deployment against Israeli or Gulf state targets | MODERATE (40–55%) | 14–30 days | BANISHED KITTEN campaign updated but quiet; conflict dynamics favor periodic destructive operations |
| Microsoft Teams exploitation escalates beyond Black Basta to Iranian actors | LOW-MODERATE (25–35%) | 30 days | 400+ incidents industry-wide; technique is proven and low-cost |
All traffic to/from ASN 202468 (Noyan Abr Arvan), ASN 204104 (Giti Secure Cloud), and ASN 50810 (Mobin Net Communication Company). These Iranian ASNs are confirmed C2 hosting providers. Implement ASN-level alerting, not just IP-level blocking — operators rotate IPs within the same ASN. Sliver mTLS handshake patterns on HTTPS (T1573.002). Sliver's mutual TLS implementation has distinctive certificate characteristics that can be signatured in Suricata/Snort. XWorm non-standard port C2 communications (T1571). Monitor for beaconing patterns on unusual ports from endpoints. AdaptixC2 HTTPS beacon traffic (T1071.001). Look for regular-interval callbacks to Iranian IP space. ATT&CK: T1573.002 T1571 T1071.001
SiemensSoftwareCenter.exe executing from %AppData%\Local\Programs or any non-standard Siemens installation directory (T1574.002). Legitimate installations use %ProgramFiles%. msiexec.exe spawning SiemensSoftwareCenter.exe — this is the ClickFix attack chain (T1218.007). archive.dll loaded by any Siemens binary — hunt across EDR telemetry (T1574.002). PowerShell downloading and executing MSI files from external domains (T1059.001 → T1218.007). fsquirt.exe, SyncHost.exe, SCSKAppLink.dll, INISAFECrossWebEXSvc.exe — binaries associated with North Korean (Lazarus/UNC2970) campaigns also active in this threat period. Registry Run Key modifications by XWorm (T1547.001) — monitor HKCU\Software\Microsoft\Windows\CurrentVersion\Run for unexpected entries. ATT&CK: T1574.002 T1218.007 T1059.001 T1547.001
Microsoft Teams external chat from unmanaged or consumer onmicrosoft[.]com tenants. Over 400 incidents industry-wide have been linked to Black Basta social engineering via Teams (T1566.003). Quick Assist sessions initiated by non-IT personnel — this is a confirmed lateral movement vector in Teams-based social engineering campaigns. ATT&CK: T1566.003
Block at perimeter firewalls, DNS sinkholes and endpoint platforms. 95.38.176[.]143 Sliver + AdaptixC2 (Arvan Cloud); 46.38.138[.]50 Sliver, open directory (Giti Secure Cloud); 178.131.57[.]235 XWorm (Mobin Net); 185.143.233[.]133 and 62.133.46[.]18 Iranian-hosted; 96.62.218[.]59 and wizardexpensive[.]com Siemens ClickFix hosting/C2; 2.27.248[.]127 serves AllMyBasic.msi; 45.135.242[.]28, 46.148.45[.]83, 185.55.226[.]108 flagged. Siemens ClickFix hashes: SHA-256 f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a, 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491; SHA-1 de3d53b264b0255e41d1bad4c1142d01f575c17d, 63bf1d4d88bfaeb7780b7210995d0605b2364f8b; MD5 f4647249fe4293818dda3c9ba2fd2e0d, 535291b5263cca14c9e8e6b4025ab80f. Associated malware SHA-256 030ce841d650bd7608e500f5df725da8758a0fd9fe0397842fb061f63cbf20a2. Additional IOCs via Anomali ThreatStream Next-Gen and partner feeds.
archive.dll load events. Search for AllMyBasic.msi in download logs and MSI installation records. Correlate msiexec.exe parent-child relationships with SiemensSoftwareCenter.exe.- WAF virtual patching for CVE-2026-115560; verify Dell PowerProtect backup integrity.
- Hunt IOCONTROL (Unitronics, SIMATIC); Software Center 4.0.9.8+; unidirectional gateways.
- Segment medical devices; restrict Quick Assist.
- Audit VPN/edge (Fortinet, SonicWall, Ivanti, Citrix, Cisco, Check Point, PAN-OS); FIDO2/WebAuthn; Starlink policy.
- Audit ConnectWise and M365 tenants; verify code signing; review Siemens, Mitsubishi, ABB ICS supply chain.
wizardexpensive[.]com; push all hashes to EDR. Hunt archive.dll, AllMyBasic.msi, msiexec.exe to SiemensSoftwareCenter.exe chains.onmicrosoft[.]com; disable Quick Assist for non-IT. Apply KEV patches: CVE-2026-109618, CVE-2026-109619, CVE-2026-48356, CVE-2026-114625 (VeloCloud, CVSS 9.9).C2 is live, Siemens exploitation is confirmed, Dell flaws are unauthenticated root, AI exploitation is operational. Silence from destructive actors is pre-positioning.