| Development | Significance |
|---|---|
| FBI/Secret Service... | Iranian-to-criminal access... |
| UNC6446 aerospace... | Active, ongoing DIB targeting |
| Lumen Black Lotus... | Demonstrates the expanding... |
| CISA publishes 7 ICS... | All relevant to energy/utility... |
| CISA KEV adds... | Both widely deployed in... |
| Citrix discloses... | Iranian actors have... |
| IMPERIAL KITTEN... | A generational capability... |
| Phase | Timeframe | Cyber Activity |
|---|---|---|
| Conflict begins | Feb 28, 2026 | US-Israeli military campaign... |
| Initial disruption | Mar - May 2026 | HYDRO KITTEN (Cyber Av3ngers... |
| Intelligence collection | Jun - Jul 2026 | MuddyWater (MOIS) conducts... |
| Pre-positioning begins | Aug 2026 | IMPERIAL KITTEN builds... |
| Capability evolution | Sep 2026 | CHARMING KITTEN weaponizes... |
| Current - weaponization at... | Oct 1-8, 2026 | FortiBleed confirmed by FBI... |
FBI/USSS confirmed FortiBleed is an ongoing, industrialized intrusion pipeline - 86,644 compromised FortiGate devices across 194 countries, with the broader campaign estimated to exceed 400,000. Chain: automated scanning, credential stuffing, GPU-accelerated cracking, new admin accounts, AD enumeration, then ransomware deployment by...
Eight vulnerabilities disclosed Sep 27 (advisory CTX697096). CVE-2026-88773 (CVSS 10.0) is pre-auth HTTP request smuggling - can bypass WAFs entirely. Six more score 7.2-9.8. Pioneer Kitten and Fox Kitten have repeatedly weaponized Citrix vulnerabilities (CVE-2023-3519, CVE-2024-21887) as their preferred initial access vector, typically within...
CrowdStrike documents two developments: fraudulent logistics/shipping infrastructure with an interactive chat platform (converging with FBI tanker investigations), and - more significantly - the the first observed cloud-conscious operational tradecraft from Iran-nexus adversaries. Iranian actors are moving from on-premise credential theft to...
CISA published seven ICS advisories Oct 1-6: Hitachi Energy RTU500 (EOL, no patches - replacement only), REB500, Asset Suite, SOI, and Johnson Controls EasyIO. RTU500 units control substation power distribution - precisely the infrastructure HYDRO KITTEN and SPECTRAL KITTEN have targeted in Israeli utilities during this conflict. Seven...
MuddyWater has maintained 30+ days of operational silence - historically preceding retooling and new campaign launches. BANISHED KITTEN/Void Manticore announced intensification but shown no new wiper deployment since late September - the gap between stated intent and activity suggests pre-positioning. CHARMING KITTEN shows no new activity since...
| Predicted Development | Probability | Timeframe | Basis |
|---|---|---|---|
| Iranian exploitation of... | 70% | Within 30 days | Historical pattern: Pioneer... |
| IMPERIAL KITTEN operationalize... | 65% | 2–4 weeks | CrowdStrike assessment of... |
| FortiBleed ransomware... | 80% | Ongoing | FBI confirmation of active... |
| MuddyWater resurfaces with... | 60% | 2–6 weeks | 30+ day silence historically... |
| CHARMING KITTEN deploys new... | 55% | 2–4 weeks | Infrastructure rotation... |
| Iranian-attributed ICS/OT... | 50% | 30–60 days | 7 ICS advisories in one week... |
| BANISHED KITTEN wiper... | 45% | 30–60 days | Stated operational intensifica... |
PoeLLM C2 infrastructure...
CISA KEV additions...
Active PoeLLM C2 servers...
- Audit FortiGate VPN for unauthorized admin accounts; review Azure AD conditional access for cloud-conscious tradecraft gaps
- Inventory Hitachi Energy RTU500 units; plan EOL replacement; verify IT/OT segmentation given FortiBleed's IT-side entry point
- Emergency FortiGate credential reset prioritizing clinician VPN accounts; patch Zammad for CVE-2026-102489
- Brief DIB personnel on UNC6446 fake resume lures; deploy Azure AD monitoring for device-code phishing and OAuth anomalies
- Alert logistics partners to the impersonation campaign; audit third-party logistics provider network access
Seven months into this conflict, Iranian cyber operations are not plateauing - they are evolving. FortiBleed has industrialized initial access at a scale now feeding ransomware operators across three affiliate groups. IMPERIAL KITTEN's leap to cloud-conscious tradecraft means the identity plane - Azure AD, OAuth, service principals - is now an active battleground most organizations aren't detecting. A CVSS 10.0 Citrix vulnerability sits unpatched across countless networks while actors with a...