| # | Development |
|---|---|
| 1 | U.S. military cold-chain targeting confirmed. DoD investigating freezer compromises on U.S. military bases - first official acknowledgment campaign reached American military logistics. CISA/FBI/HHS/USDA/DoT joint advisory covers this campaign. |
| 2 | Blood supply attacks stopped just in time. France's EFS confirmed attackers manipulated temperature and defrost settings at three blood product storage facilities - caught before product integrity was compromised. |
| 3 | New Iranian C2 infrastructure stood up on strike day. Previously unseen C2 IP 194.110.24[.]98 (Webdade ISP, Tehran) appeared with a creation date of November 3 - the same day as the Qeshm Island strike. |
| 4 | Aerospace defense phishing campaign refreshed during retaliation window. UNC6446/GRITCASPIAN job-application phishing updated today (November 6), same-day refresh during active retaliation window. |
| 5 | Two new high-severity CVEs added to CISA KEV. CVE-2026-119977 (WordPress RCE, CVSS 8.1) and CVE-2026-123158 (OpenSSH auth bypass on Alpine Linux, CVSS 8.1). |
| 6 | MuddyWater POWERSTATS backdoor IOCs refreshed. Four new SHA-256 indicators confirmed; targeting government and manufacturing in U.S. and U.K. SimpleHelp RMM abuse against Israeli targets also confirmed. |
| 7 | CHARMING KITTEN weaponizes AI platforms. DiskPlant malware distributed via ChatGPT shared-conversation links - bypassing email security through trusted SaaS channels. |
| Phase | Timeframe | Cyber Activity |
|---|---|---|
| Phase 1 | 2026-02-28 to 2026-11-01 to 11-03 | Day 0 - cyber operations escalate in parallel with kinetic conflict; Initial OT/ICS targeting of Danfoss and Copeland controllers; 100+ retail stores affected; Danfoss end-of-life controllers exploited; U.S. military bases and French blood supply facilities targeted |
| Phase 2 | 2026-11-03 to 2026-11-04 | Most significant kinetic escalation - opens 48-96 hour cyber retaliation window; Infrastructure provisioned on strike day - potential retaliatory staging; Unauthenticated remote code execution during upgrade window; Mobile exploitation vector linked to watering-hole campaigns |
| Phase 3 | 2026-11-05 to 2026-11-05 | CISA, FBI, HHS, USDA, DoT confirm military and blood supply targeting; Trivial authentication bypass on Alpine Linux - critical for containerized environments; Fresh indicators for MOIS-affiliated operations against Israeli targets; AI platform weaponization for IRGC-IO-affiliated espionage |
| Phase 4 | 2026-11-06 to 2026-11-06 | Same-day refresh during retaliation window - DIB targeting active; Iran-hosted C2 at 217.60.241[.]17 and 87.107.191[.]39 still operational |
What began as attacks on European supermarket refrigeration systems has evolved into a multi-sector, multi-country campaign with strategic military implications.
Agentemis / Cobalt Strike Infrastructure Two Iran-hosted command-and-control servers tagged with both the Agentemis malware family and Cobalt Strike BEACON remain active with high confidence: 217.60.241[.]17 (AS51396, Pfcloud UG) - port 443, confidence 98; 87.107.191[.]39 (AS44436, Toosee Ertebatat Damavand) (also: APT42).
CVE-2026-119977 - WordPress Core Remote Code Execution (CVSS 8.1) Unauthenticated remote code execution affecting WordPress versions 4.7 through 7.1.3, exploitable during the upgrade window via predictable staging paths; - Safari Pointer Authentication Bypass (CVSS 5.5) Added to CISA KEV on November 4 (also: OpenWrt, APT29).
| Scenario | Probability | Basis |
|---|---|---|
| Pro-Iran hacktivist wave (Handala, YEMEN CYBER GROUP, DieNet, 313 Team) materializes within 48 hours | 65% | Historical pattern shows coordinated hacktivist surges following kinetic events; the current silence is anomalous and consistent with pre-coordination for maximum impact |
| Cold-chain attacks expand to additional military installations or allied NATO logistics bases in Europe | 50% | Campaign has demonstrated progressive scope expansion across three waves; military targeting confirmed; attacker infrastructure and TTPs are mature |
| UNC6446 phishing campaign yields initial access at a defense industrial base contractor | 40% | Same-day campaign update during retaliation window suggests active targeting; aerospace/defense sector is a confirmed Iranian priority |
| New wiper variant deployed against Israeli targets | 30% | Wipers are the expected retaliatory tool (BiBiWiper, ZeroShred, GoneXML precedents), but the absence during this window suggests a possible strategic pivot to below-threshold ICS/OT disruption |
| SPECTRAL KITTEN leverages existing Israeli utility access for disruptive action | 20% | Confirmed pre-positioned access exists; activation during retaliation window is plausible but would represent a significant escalation |
| SHA-256 | Context |
|---|---|
| ba24bb27130007aa4a9130f99804aa3702818deafeb8b2003b4b849c8a23d54d | MuddyWater APT — government/manufacturing targeting |
| 3090e2797dd9d859678400488676b4fd8c1c9a9adb435caa1c9f02dc2d9b454e | MuddyWater APT — government/manufacturing targeting |
| 07fb8e2f2831dcfd93c48b91998c447a25c16af9c995cc310ee543bed38c9794 | MuddyWater APT — government/manufacturing targeting |
| 4af95610a49dc2bd621cb0fdbfde52cbbae89adc5c5b2cdcd499777f0704a0f5 | MuddyWater APT — government/manufacturing targeting |
IOC Blocking Table:
Hashes: ba24bb27130007aa4a9130f99804aa3702818deafeb8b2003b4b849c8a23d54d (MuddyWater APT — government/manufacturing targeting); 3090e2797dd9d859678400488676b4fd8c1c9a9adb435caa1c9f02dc2d9b454e (MuddyWater APT — government/manufacturing targeting); 07fb8e2f2831dcfd93c48b91998c447a25c16af9c995cc310ee543bed38c9794 (MuddyWater APT — government/manufacturing targeting); 4af95610a49dc2bd621cb0fdbfde52cbbae89adc5c5b2cdcd499777f0704a0f5 (MuddyWater APT — government/manufacturing targeting). Hunt in logs (not network blocks): 217.60.241[.]17 (IPv4; Agentemis / Cobalt Strike BEACON C2, port 443; High (98)); 87.107.191[.]39 (IPv4; Agentemis / Cobalt Strike BEACON C2, port 53; High (80)); 217.60.241[.]14 (IPv4; Tofsee/Gheg C2, port 422; High (91)); 194.110.24[.]98 (IPv4; New C2, Webdade ISP Tehran, created 2026-11-03; Moderate (71)); gcc-sg[.]cloud (Domain; Iranian-linked infrastructure; Moderate); mfakuwait[.]online (Domain; Iranian-linked infrastructure; Moderate); moelcloud[.]online (Domain; Iranian-linked infrastructure; Moderate); stark-meet[.]com (Domain; Iranian-linked infrastructure; Moderate); stark-meet[.]online (Domain; Iranian-linked infrastructure; Moderate); stark-meet[.]website (Domain; Iranian-linked infrastructure; Moderate). Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
Hunting Hypotheses:
HUNT 01 · T1071.004
Hypothesis 1: Cobalt Strike BEACON over DNS (T1071.004 — Application Layer Protocol: DNS)
The C2 IP 87.107.191[.]39 operates on port 53, indicating DNS-based C2 tunneling. Hunt for:; Anomalous DNS query volume to non-standard resolvers; DNS TXT record queries with high entropy payloads; Outbound connections to port 53 that bypass corporate DNS resolvers; Named pipe creation patterns consistent with Cobalt Strike (
\\.\pipe\msagent_*, \\.\pipe\MSSE-*).HUNT 02 · T1190
Hypothesis 2: Cold-Chain OT Controller Compromise (T1190, T0831)
Hunt for:; Unexpected outbound connections from OT/ICS network segments to internet.
HUNT 03 · T1566.002
Hypothesis 3: UNC6446 Job Application Phishing (T1566.002 — Spearphishing Link)
Hunt for:; Emails to aerospace/defense personnel containing job application themes, recruiter impersonation, or career opportunity lures; .lnk file attachments or downloads from GitHub repositories not on the organization's approved list; Execution of binaries downloaded from GitHub raw content URLs by non-developer users; T1204.001 (User Execution: Malicious Link) — browser spawning PowerShell or cmd.exe after visiting GitHub URLs.
HUNT 04 · T1566.002
Hypothesis 4: CHARMING KITTEN AI Platform Delivery (T1566.002, T1204.001)
Hunt for:; Shared ChatGPT conversation links (chat.openai.com/share/*) arriving via email, messaging, or social media.
HUNT 05 · T1190
Hypothesis 5: WordPress RCE Exploitation — CVE-2026-119977 (T1190)
Hunt for:; HTTP requests to WordPress staging paths (
/wp-content/upgrade/, /wp-content/plugins/ with unusual filenames); Web shell indicators: requests to core-upgrader.php, wp-upgrader.php, core.php, or config.php in non-standard directories; New PHP files created in WordPress directories during or immediately after upgrade operations.HUNT 06 · T1078.001
Hypothesis 6: OpenSSH Alpine Bypass — CVE-2026-123158 (T1078.001)
Hunt for:; SSH authentication success events for accounts that should not have password-based login.
Financial Services
Banking Infrastructure, Data Centers
Primary threats
Financial institutions face dual exposure: direct targeting by Iranian APTs seeking economic disruption, and indirect risk through cold-chain supply chain dependencies (data center cooling systems use the same controller families being exploited).
Actions
- Audit data center cooling infrastructure. Prepare for hacktivist DDoS (also: AnyDesk, ConnectWise).
Energy
ICS/OT, Grid Infrastructure
Primary threat
The energy sector remains the highest-risk vertical given SPECTRAL KITTEN's confirmed pre-positioned access to an Israeli electrical utility and the broader cold-chain campaign's ICS/OT focus.
Actions
- Assume adversary presence in OT networks.
Healthcare
Cold-Chain, Medical Logistics
Primary threat
The blood supply attack against France's EFS is a direct warning to healthcare organizations worldwide.
Actions
- Audit all medical cold-chain systems.
Government
Web Apps, Mobile Devices
Primary threats
Government agencies face the broadest attack surface: WordPress-powered public websites (CVE-2026-119977), mobile device exploitation (CVE-2024-27834), and direct targeting by multiple Iranian APT groups conducting espionage and pre-positioning.
Actions
- Emergency WordPress patching. Mobile device security review.
Aviation / Logistics
Aerospace, Defense Contractors
Primary threats
The aerospace and defense sector is under active targeting by UNC6446/GRITCASPIAN, with a campaign refresh occurring today.
Actions
- Brief all personnel on job application phishing (also: DoD).
No sector cards match the selected filters.
Block C2 IPs at perimeter firewall and DNS: 194.110.24[.]98, 217.60.241[.]17, 87.107.191[.]39, 217.60.241[.]14. These are confirmed active Iranian C2 infrastructure. Deploy endpoint detection rules for MuddyWater POWERSTATS hashes listed in the IOC table above. Alert on SimpleHelp RMM installations not in your approved software inventory. Block domains: gcc-sg[.]cloud, mfakuwait[.]online, moelcloud[.]online, stark-meet[.]com, stark-meet[.]online, stark-meet[.]website at DNS and web proxy.
SOC Analyst
Audit all internet-exposed refrigeration, HVAC, and cold-chain controllers. Remove from public internet. Patch all WordPress installations to version 7.1.4+ to remediate CVE-2026-119977 (unauthenticated RCE). Scan for web shell artifacts in WordPress directories.
Incident Responder
Audit all Alpine Linux containers running sshd. Patch OpenSSH to 10.6p2+ or set
PasswordAuthentication no in sshd_config; Patch OpenSSH to 10.6p2+ or set PasswordAuthentication no in sshd_config (also: PasswordAuthentication, PoC).Threat Hunter
No immediate actions for the selected roles.
Implement detection rules for UNC6446/GRITCASPIAN job application phishing targeting aerospace/defense personnel. Alert on .lnk attachments and GitHub-hosted payloads from unrecognized repositories. Deploy cold-chain-specific monitoring: setpoint deviation alerts for refrigeration and HVAC controllers, independent temperature alarms that fire even if the primary controller is compromised. Hunt for Cobalt Strike BEACON indicators: DNS tunneling to non-standard resolvers (especially port 53 traffic to 87.107.191[.]39), named pipe patterns (
\\.\pipe\msagent_*, \\.\pipe\MSSE-*), and encoded PowerShell execution. Monitor for ChatGPT shared-conversation link delivery (chat.openai.com/share/*) as a malware vector - CHARMING KITTEN's DiskPlant delivery mechanism. Alert on downloads initiated from AI platform domains.SOC Analyst
Evaluate Telegram monitoring capability for pro-Iran hacktivist channels (Handala, Cyber Toufan, YEMEN CYBER GROUP, DieNet, 313 Team). The current hacktivist silence may reflect a collection gap rather than genuine inactivity.
CISO / Exec
Apply ICS patches: Hitachi Energy CoreTec and TRO600, Subnet Solutions PowerSYSTEM Center, Siemens Mendix Runtime. Verify compensating controls are in place for any systems that cannot be immediately patched.
Incident Responder
No 7-day actions for the selected roles.
Conduct lifecycle review of all ICS/OT controllers. Identify end-of-life devices - especially Danfoss and Dixell units - that no longer receive firmware updates.
Incident Responder
Commission an assessment of cold-chain cyber resilience across all facilities - including commissary, medical storage, pharmaceutical, and data center cooling. Review and update incident response playbooks for ICS/OT scenarios. Assess defense industrial base supply chain exposure. Brief the board on the evolving Iran conflict cyber dimension.
CISO / Exec
No 30-day actions for the selected roles.
The Bottom Line
We are at an inflection point in the Iran-Israel cyber conflict; For 251 days.
1
Patch WordPress and OpenSSH today.
2
Act on the IMMEDIATE actions today.
3
Act on the IMMEDIATE actions today.