| Development | Significance |
|---|---|
| MuddyWater (MOIS-linked) released five fresh POWERSTATS backdoor samples targeting the United States between October 21-22, continuing a sustained daily malware production tempo. | Consistent with active campaign pre-positioning, not routine maintenance |
| APT33/Elfin (IRGC-linked) deployed new TURNEDUP backdoor samples targeting U.S. retail - a notable departure from their traditional aerospace and energy focus. | May indicate genuine target broadening or false-flag staging infrastructure |
| PHP2Shell mass exploitation of CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.8) reached millions of exploitation attempts, confirmed by Amazon, Cloudflare, CISA, and Health-ISAC. | Universal attack surface Iranian actors are assessed likely to weaponize |
| Storm-0940 (China) used an agentic AI framework called ARTEX to scale the ConnectWise/SkyKick supply-chain compromise to 2,250+ Microsoft 365 tenants, including national security entities. | A capability Iranian operators will study and adopt |
| XWorm C2 infrastructure was identified on Iranian ISP Mobin Net (AS50810), freshly provisioned and actively beaconing. | New Iranian-hosted infrastructure confirms continued operational investment |
| GitLab CVE-2026-97229 (CVSS 10.0) - unauthenticated RCE via CI/CD regex processing - was disclosed, threatening every organization running GitLab pipelines. | Maximum severity score, broad exposure |
| FortiSIEM CVE-2026-106173 (CVSS 9.8) - a full proof-of-concept exploit was published and the vulnerability is in CISA KEV, placing Fortinet-dependent government and defense networks at immediate risk. | Public exploit code now available |
| Pro-Iran hacktivist groups remained silent for a 12th consecutive day - the longest sustained quiet period since the conflict escalated. | Historical precedent: 10-14 day silences have preceded coordinated wiper deployments |
| Date | Event | Significance |
|---|---|---|
| 2026-02-28 | Iran-Israel conflict escalation begins | Day 0 — Iranian cyber operations intensify across all domains |
| 2026-07-XX | UNC7034/BANISHED KITTEN begins AiTM dissident surveillance | New IRGC actor profiled; adversary-in-the-middle credential theft |
| 2026-10-10 | Hacktivist silence begins (~Day 0 of quiet period) | Cyber Av3ngers, Handala, DieNet, 313 Team cease visible operations |
| 2026-10-13–16 | ConnectWise/SkyKick supply-chain compromise | 300+ M365 tenants initially compromised; Global Admin self-elevation confirmed |
| 2026-10-17 | Amazon confirms pre-disclosure PHP2Shell exploitation | CVE-2026-109618/109619 exploited before public disclosure |
| 2026-10-19–22 | APT33 TURNEDUP samples targeting U.S. retail appear | Shift from traditional aerospace/energy targeting to retail vertical |
| 2026-10-20 | Horizon3.ai publishes full PoC for FortiSIEM CVE-2026-106173 | CVSS 9.8 exploit code now public; Google profiles UNC7034/BANISHED KITTEN |
| 2026-10-21 | CISA emergency PHP patching alert; MuddyWater POWERSTATS samples surge | Five fresh backdoor samples in 14 hours; Agentemis/CobaltStrike C2 refresh continues |
| 2026-10-22 | Storm-0940 ARTEX AI scales ConnectWise compromise to 2,250 tenants; XWorm C2 on Iranian ISP identified | Agentic AI in supply-chain attacks demonstrated; new Iranian C2 infrastructure provisioned |
MuddyWater (MOIS-linked) continues producing fresh POWERSTATS backdoor samples at a daily cadence - five new samples appeared between October 21-22, all targeting the United States. POWERSTATS is a PowerShell-based backdoor providing full remote access via HTTP-based C2.
APT33 (Elfin, Magnallium, Refined Kitten, IRGC-linked) has historically focused on aerospace, energy, and petrochemical sectors. New TURNEDUP backdoor samples collected October 19-22 are tagged with U.S. retail targeting - a significant departure.
CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.8) enable RCE through memory corruption in PHP's multipart request handling, affecting versions 5.4 through current releases. Amazon confirmed pre-disclosure exploitation; Cloudflare reports millions of attempts; one scanning IP overlaps with UNC5638 telemetry.
Storm-0940 (China-aligned) used an agentic AI framework called ARTEX to scale the ConnectWise/SkyKick supply-chain compromise to 2,250+ M365 tenants. OVHcloud confirmed credential-stealing payloads embedded in CLI binary versions 0.11.0-0.15.0, with ~250 downloads during the exposure window.
Cyber Av3ngers, Handala, Cyber Toufan, DieNet, and 313 Team have been completely silent for over twelve days - the longest sustained quiet period since the conflict escalated.
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| Iranian actors weaponize PHP2Shell (CVE-2026-109618/109619) for targeted initial access | 70% | 72 hours | MuddyWater and Pioneer Kitten have historically adopted mass-exploitation CVEs within 5–7 days of disclosure. |
| Pro-Iran hacktivist silence breaks with coordinated wiper or DDoS campaign | 60% | 7 days | Historical pattern: 10–14 day quiet periods precede major operations. |
| APT33 TURNEDUP campaign escalates beyond retail to aerospace/energy | 50% | 14 days | Retail targeting may be staging infrastructure; historical APT33 campaigns use compromised commercial infrastructure as pivot points to high-value targets. |
| Iranian operators adopt agentic AI techniques demonstrated by Storm-0940 | 40% | 90 days | MuddyWater's existing Power Automate abuse provides a foundation. |
| FortiSIEM CVE-2026-106173 exploited by Iranian actors against defense/government networks | 55% | 7 days | Full PoC is public. |
Hunt hypothesis: MuddyWater is delivering POWERSTATS via spearphishing attachments to U.S. organizations.
Hunt hypothesis: Internet-facing PHP applications are being scanned and exploited via malformed multipart requests targeting CVE-2026-109618/109619.
Hunt hypothesis: Hosts compromised by XWorm are beaconing to Iranian C2 infrastructure.
Hunt hypothesis: Compromised ConnectWise SkyKick service principals may have excessive permissions in your Entra ID tenant.
Hunt hypothesis: The 12+ day hacktivist silence may end with wiper deployment or large-scale DDoS.
Block the above at perimeter firewalls, proxies, and DNS.
- Patch internet-facing PHP instances to 8.2.35+; deploy WAF rules targeting malformed multipart/form-data requests
- Verify Hitachi Energy MicroSCADA X SYS600/RTU500 firmware against ICSA-26-293-04/05; confirm OT/IT network segmentation
- Block all nine PHP2Shell scanning IPs at the network perimeter; patch PHP on all patient portal and EHR-adjacent web servers
- Deploy POWERSTATS and TURNEDUP hashes to EDR; block Iranian C2 IP 178.131.57[.]235 at all network egress points
- Alert SOC to APT33 TURNEDUP indicators; hunt for spearphishing links in email logs referencing aviation industry themes
The Iranian cyber threat picture on Day 236 of the conflict is defined by a dangerous convergence: sustained APT malware production, a universally exploitable PHP vulnerability under mass exploitation, a CVSS 10.0 GitLab RCE, demonstrated agentic AI supply-chain capabilities, and an unprecedented hacktivist silence that historically precedes major destructive operations.