| Development | Detail |
|---|---|
| France formally attributed IRGC's Shahid Kaveh unit | for the October 2026 cold-chain OT attacks — summoning Iran's ambassador, requesting arrest warrants, and pushing for European sanctions. A five-agency US advisory (CISA, FBI, HHS, USDA, DoT) on November 5 confirmed advance US knowledge and urged cold-chain hardening. |
| IRGC declared "offensive doctrine" | lifting the 2,000km missile range cap. Supreme Leader Mojtaba Khamenei warned of retaliation "unlimited by geography." The US evacuated refueling tankers from RAF Mildenhall (UK) on November 10–11 due to an assessed Iranian threat. |
| APT42 (CALANQUE ION) deployed a modernized GCollection phishing kit | a unified React 19 single-page application that harvests credentials across Google, Microsoft, Apple, Instagram, WhatsApp, Telegram, and Zoom, with real-time MFA relay interception and QR-code session hijacking. Infrastructure impersonates Israeli media, UK think tanks (Chatham House), and medical organizations (Hadassah). |
| Pioneer Kitten / Fox Kitten has been silent for approximately 181 days | the entire duration of the conflict's most intense phase. This IRGC-affiliated group, known for pre-positioning persistent access in defense-industrial base contractor networks via VPN exploitation, has produced no new observed activity. This silence is assessed as dormant pre-positioned access awaiting an activation trigger, not inactivity. |
| CISA added 11 vulnerabilities to the Known Exploited Vulnerabilities catalog | , including a SonicWall SSLVPN SAML authentication bypass (CVE-2026-19868), a WordPress Core RCE (CVE-2026-119977), and a Cisco BroadWorks XXE tied to the autonomous AI intrusion campaign known as Operation Snowball (CVE-2026-20320). A Microsoft Outlook zero-day enabling NTLM hash theft (CVE-2026-124194) was also confirmed actively exploited. |
| Russia's Turla (FSB) deployed a new "Cereal" toolset | on government Exchange servers in Romania and Kazakhstan, configured to collect NATO and EU email traffic — a parallel espionage threat exploiting the same geopolitical context, with direct implications for allied war planning communications. |
| Phase | Timeframe | Cyber Activity |
|---|---|---|
| Phase 1 | 28 Feb 2026 to Oct 2026 | War initiation; Iranian cyber operations begin escalating; IRGC-directed physical attack on allied airbase in UK; IRGC Shahid Kaveh unit manipulates OT controllers; fires result |
| Phase 2 | 5 Nov 2026 to 7 Nov 2026 | CISA/FBI/HHS/USDA/DoT confirm awareness, urge hardening; Includes SonicWall, WordPress, Cisco BroadWorks, Outlook 0-day; Strategic signaling - "no geographic limits" on retaliation |
| Phase 3 | 9 Nov 2026 to 10 Nov 2026 | First NATO member to publicly attribute IRGC OT sabotage; Fairford plot + 20 physical attacks across US and Europe; GTIG/Mandiant details modernized APT42 phishing kit |
| Phase 4 | 10 Nov 2026 to 10 Nov 2026 | ESET reveals FSB targeting NATO/EU email on Exchange servers; US military responds to assessed Iranian threat against UK base; Ceasefire-or-escalation inflection point |
Shahid Kaveh (IRGC) compromised ~700 internet-exposed Danfoss/Dixell refrigeration controllers via default credentials, manipulating temperature setpoints to cause physical damage - the first confirmed destructive IRGC cyber-physical attack on NATO civilian infrastructure.
APT42 (IRGC-IO) GCollection kit targets Google, Microsoft, Apple, Zoom, and Telegram with real-time MFA relay interception - defeating TOTP and push notifications. Infrastructure impersonates Chatham House, Hadassah, and Israeli Channel 14.
KEV-listed: CVE-2026-19868 (SonicWall SonicOS SSLVPN, CVSS 7.5) SAML bypass; CVE-2026-124194 (Outlook NTLM zero-day, CVSS 6.5); CVE-2026-119977 (WordPress RCE, CVSS 8.1); CVE-2026-20320 (Cisco BroadWorks XXE, CVSS 7.5) in Operation Snowball AI intrusion campaign.
Pioneer Kitten (Fox Kitten, Lemon Sandstorm, UNC6446, UNC2448) has been silent 181 days - the entire conflict duration. Assessed as dormant pre-positioned access in DIB networks via Fortinet/SonicWall/Ivanti exploitation, awaiting activation on diplomatic failure.
Turla (FSB) Cereal toolset deployed on Exchange servers in Romania and Kazakhstan - anomalous .NET assembly loading within Exchange worker processes. ESET attribution November 10, 2026. Targets: NATO/EU-addressed email traffic.
| Scenario | Probability | Timeframe | Rationale |
|---|---|---|---|
| Pro-Iran hacktivist surge (DDoS, defacement, wipers) targeting French government and allied websites | 70–80% | 24–48 hours | France attribution is a textbook hacktivist trigger. |
| IRGC-directed OT attacks against additional European cold-chain/industrial targets (UK, Germany, Romania) | 40–60% | 7–14 days | Shahid Kaveh has demonstrated capability and willingness. |
| APT42/CALANQUE ION phishing campaign targeting diplomatic and negotiation personnel involved in Qatar talks | 40–50% | 7 days | GCollection kit is freshly deployed with Zoom/Jitsi lures. |
| Dormant DIB contractor access activation (Fox Kitten/Pioneer Kitten) if diplomatic talks collapse | 20–35% | Contingent on diplomatic failure | 181 days of silence during peak conflict = pre-positioned access. |
| Cyber-enabled kinetic attack — using OT access to create physical damage conditions at military logistics facilities | 15–25% | 14–30 days | The refrigeration fires demonstrate the concept. Military cold-chain (commissaries, munitions storage) uses identical controller technology. |
Hunt for connections to the following C2 infrastructure and phishing domains.
Block the above at perimeter firewalls, proxies, and DNS. 172.86.80[.]60 C2 cluster 1 (Sep–Oct 2026); 144.172.97[.]222 C2 cluster 2 (May–Aug 2026); panel-bit-find[.]online and panel-bit-search[.]online Operator session management; c14-private-room[.]live Impersonates Israeli Channel 14; opening-chathamhouse-zoom[.]site Impersonates Chatham House/Zoom; hadassah-conference[.]online Impersonates Hadassah Medical; meeting-chathamhouse[.]online Impersonates Chatham House; join-groupcall[.]online Generic conferencing lure; yadlolim-zm-online[.]online Impersonates Yad L'Olim/Zoom; face-talk[.]online Video-call lure; event-invitation[.]eu[.]cc Event invitation lure; Session lure (7 indicators); online-talking[.]site and online-session[.]site Conferencing lure; online-roorn[.]life Conferencing lure (typosquat); Staging domain (4 indicators). Hashes: a10a1fe4afbf6bfdd108879a799e11bd1deb9559c489e5320db97ec4733914ab (SHA-256, GCollection Variant 1 (index-CWNEU8A9.js)); 4ec45ff95ac0e9f9b83a52114a1dc0f3330ffb8dfb9064925f297b0911bd5839 (SHA-256, GCollection Variant 2 (index-DEVrVHLH.js)); 63dbf5c5d0ddd45ef16537de417d8199a99a2f3368aa6d354ba4e2f582aba442 (SHA-256, GCollection Variant 3 (index-CGhRs5i6.js)); 3b36846232d68d717d78b09e425c3711 (MD5, GCollection Variant 1); 18b60524e2eadd5f3a0542e52b95483f (MD5, GCollection Variant 2); b5ebe0b3e157e804834bcd6a23dafa02 (MD5, GCollection Variant 3). Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
- Enforce FIDO2/WebAuthn MFA. Block GCollection domains at email gateway. Patch Outlook (CVE-2026-124194).
- Audit internet-exposed ICS/SCADA. Rotate credentials on Danfoss, Dixell, Siemens controllers. Patch SonicWall (CVE-2026-19868).
- Audit cold-chain monitoring per CISA advisory. Configure out-of-band alarms. Segment controllers from internet and clinical networks.
- Enforce FIDO2 MFA for diplomats. Audit Exchange for Turla Cereal indicators. Patch Outlook (CVE-2026-124194).
- Hunt VPN logs for Fox Kitten: dormant accounts, webshells, Rclone, Wasabi S3. Patch SonicWall (CVE-2026-19868) and Ivanti Connect Secure.
c14-private-room[.]live, opening-chathamhouse-zoom[.]site, hadassah-conference[.]online, meeting-chathamhouse[.]online. Block C2 IPs 172.86.80[.]60 and 144.172.97[.]222.The Iran conflict has entered a phase where the absence of activity is more dangerous than its presence.