| Development | Significance |
|---|---|
| ConnectWise SkyKick M365 supply-chain attack confirmed at scale. | Microsoft classified this as an active supply-chain attack |
| BeyondTrust CVE-2026-102764 received a CISA advisory and KEV designation. | BeyondTrust Remote Support typically receives firewall pass-through - a passport into your network |
| UNC6446/GRITCASPIAN aerospace phishing campaign refreshed on 19 October, updating job-application-themed lures targeting aerospace and defense personnel. | Direct threat to defense industrial base contractors |
| Iranian C2 infrastructure on ASN 51396 and ASN 44436 confirmed active with high confidence (80-90). | Persistence despite public reporting suggests ISP tolerance or deliberate state hosting |
| FortiOS CVE-2025-61624 added to CISA KEV - a path traversal vulnerability allowing authenticated admin file write/delete across FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. | Expands an already critical Fortinet attack surface |
| Ivanti CVE-2026-111357 published and exploited in the wild - a privilege escalation to root vulnerability in Ivanti Connect Secure, published October 15. | Adds to an already crowded edge device vulnerability crisis |
| APT42/Charming Kitten TAMECAT nuclear-sector campaign confirmed active through 18 October, with BELLACIAO/TAMECAT infrastructure refreshed October 16. | IRGC-IO maintains sustained nuclear-sector targeting |
| MuddyWater 4+ day operational pause following POWERSTATS deployment on 14-15 October against US targets, then silence. | Combined with hacktivist silence, more consistent with pre-positioning than de-escalation |
| Hacktivist silence extended to Day 11+. | Unprecedented quiet period in this conflict |
| Date | Event | Significance |
|---|---|---|
| 28 Feb 2026 | US-Israel military campaign against Iran begins | Day 0 — conflict initiates |
| Aug 2026 | BeyondTrust CVE-2026-102764 exploitation begins | Chinese espionage actors (Armory Castle) begin exploiting CVSS 9.8 zero-day months before patch |
| 27 Sep 2026 | UNC6446 GitHub-themed phishing campaign updated | Iranian-nexus aerospace targeting active |
| ~8 Oct 2026 | Iranian hacktivist groups go silent | Last observed activity from Handala, Cyber Toufan, DieNet, 313 Team |
| 12 Oct 2026 | 29-nation coalition condemns Iranian hybrid warfare | Condemnation explicitly names cyberattacks alongside kinetic operations |
| 14–15 Oct 2026 | MuddyWater deploys five fresh POWERSTATS samples | MOIS-affiliated group targets US entities; silent 4+ days as of this assessment |
| 15 Oct 2026 | ConnectWise SkyKick compromise begins | Attacker uses stolen application credential to access M365 tenants |
| 15 Oct 2026 | Ivanti CVE-2026-111357 published | Privilege escalation to root; exploited in the wild |
| 16 Oct 2026 | APT42/Charming Kitten refreshes BELLACIAO/TAMECAT infrastructure | IRGC-IO affiliated; nuclear-sector TAMECAT campaign confirmed active through 18 Oct |
| 16 Oct 2026 | CISA issues BeyondTrust advisory + KEV additions | CVE-2026-102764 (CVSS 9.8) and FortiOS CVE-2025-61624 added to KEV |
| 17 Oct 2026 | Huntress confirms 162 compromised M365 tenants | ConnectWise SkyKick attack scope validated; Global Admin self-elevation confirmed |
| 18 Oct 2026 | APT34 ThreatStream profile updated; TAMECAT campaign refreshed | Continued Iranian APT operational tempo |
| 19 Oct 2026 | UNC6446 aerospace phishing campaign refreshed | Active Iranian-nexus targeting of defense industrial base |
| 19 Oct 2026 | Iranian C2 IPs on ASN 51396/44436 reconfirmed active | 5+ months of persistent Agentemis/Cobalt Strike BEACON infrastructure |
The attacker weaponized an application identity - a service principal credential that inherently bypasses MFA, since application sign-ins are not user sign-ins. They authenticated to 162 M365 tenants in seconds using scripted automation, and in at least one case self-elevated to Global Administrator to entrench access and blind defenders.
CVE-2026-102764 (CVSS 9.8) allows an unauthenticated attacker to perform file operations on BeyondTrust Remote Support appliances due to inadequate message origin validation. Chinese actors tracked as Armory Castle have exploited this since August 2026 - at least two months before a patch existed.
Iranian C2 infrastructure on two Tehran-based ASNs continues operating at high confidence - Agentemis and Cobalt Strike BEACON nodes have persisted over five months despite public reporting.
This cycle alone added three new actively exploited or KEV-designated edge vulnerabilities: BeyondTrust (CVSS 9.8, exploited since August), Ivanti Connect Secure CVE-2026-111357 (exploited in the wild), and FortiOS CVE-2025-61624 (CISA KEV).
Handala, Cyber Toufan, DieNet, and 313 Team have produced no activity for over 11 days, including seven days after the 29-nation condemnation. Historically, diplomatic actions of this magnitude trigger retaliatory operations within 48-72 hours - this silence is unprecedented.
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| ConnectWise SkyKick investigation reveals additional compromised tenants beyond 162; Cloud Management customers also affected | 70% | 7 days | Shared application infrastructure across ConnectWise products; attacker demonstrated scripted automation |
| Iranian hacktivist groups break silence with data leak, defacement, or destructive operation | 50% | 7 days | 11+ day pause following 29-nation condemnation is anomalous; historical pattern is retooling before escalation |
| Iranian actors begin exploiting BeyondTrust CVE-2026-102764 | 45% | 30 days | CVSS 9.8 unauthenticated access matches Pioneer Kitten/Fox Kitten historical tradecraft against remote access tools |
| MuddyWater resurfaces with new delivery mechanism (Teams/Power Automate) rather than traditional POWERSTATS email | 35% | 14 days | Observed TTP evolution toward cloud-native tooling; 4+ day silence following fresh POWERSTATS deployment suggests capability development |
| Coordinated Iranian multi-unit cyber operation targeting critical infrastructure | 30% | 30 days | Simultaneous silence across hacktivist proxies + MuddyWater + persistent C2 infrastructure = pre-positioning indicators |
| Iranian exploitation of Ivanti CVE-2026-111357 attributed to UTA0576 | 40% | 14 days | UTA0576 is the tracked actor for prior Ivanti exploitation; October in-the-wild exploitation confirmed but unattributed |
IOC Blocking Table:
144.172.64[.]128217.60.241[.]1787.107.191[.]39217.60.241[.]1477.90.185[.]220195.254.165[.]5176.65.139[.]152preteheto[.]blog2mbpx9a2.preteheto[.]blogirancepat[.]xyz
Block the above at perimeter firewalls, proxies, and DNS.
Hunting Hypotheses:
HUNT 01 · T1199
ConnectWise Application Identity Abuse
Query Entra ID sign-in logs for the 5 ConnectWise application IDs; any sign-in from
144.172.64[.]128 confirms compromise.HUNT 02 · T1071.001
Iranian C2 Beacon Activity
Search DNS/proxy/firewall logs for the 5 listed C2 IPs; large DNS TXT responses to 87.107.191[.]39 may indicate VPN-over-DNS tunneling.
HUNT 03 · T1190
BeyondTrust Remote Support Exploitation
Review appliance logs for unauthenticated file operations and connections from non-standard source IPs on versions ≤26.2.3.
HUNT 04 · T1566.002
UNC6446 Aerospace Phishing
Search email gateway logs for job-application/recruitment-themed messages linking to unfamiliar domains.
HUNT 05 · T1059.004
FortiOS Path Traversal Exploitation
Review FortiOS CLI audit logs for unusual file deletions/writes to system directories on versions 6.4-7.6.4.
Financial Services
MSP
Primary threat
The ConnectWise breach has direct implications for institutions using MSPs for M365 administration; self-elevation to Global Admin via application identity abuse is a direct path to sensitive data.
Actions
- Audit all third-party application consent grants in Entra ID; revoke any ConnectWise application consents
Energy
ICS/OT
Primary threats
Cyber Av3ngers and UWAYS QARANI remain silent, but the expanding ICS attack surface - Eclipse Milo OPC-UA and EseeCloud camera vulnerabilities - provides new exploitation vectors.
Actions
- Verify OPC-UA implementations are patched against ICSA-26-288-01; segment ICS/SCADA from IT with deny-all rules
Healthcare
BeyondTrust
Primary threats
Healthcare faces a dual threat: ransomware exploiting the same edge vulnerabilities nation-state actors use, and targeted espionage against pharmaceutical and biomedical research tied to the conflict.
Actions
- Patch BeyondTrust Remote Support immediately; review Ivanti for CVE-2026-111357 exploitation indicators
Government
Entra ID
Primary threats
Primary target across all three Iranian units - IRGC, MOIS, and IRGC-IO (APT42/Charming Kitten) - especially agencies in the 29-nation coalition or diplomatic functions.
Actions
- Hunt for ConnectWise application identity abuse in government M365 tenants; block all Iranian C2 IPs
Aviation / Logistics
UNC6446
Primary threats
UNC6446/GRITCASPIAN's aerospace phishing campaign refreshed on 19 October represents an active, current threat to aviation, aerospace, and defense logistics organizations.
Actions
- Alert aerospace/defense/logistics employees to job-application-themed phishing; enhance filtering for recruitment-themed messages
No sector cards match the selected filters.
Disable the ConnectWise Cloud Backup application in all Entra ID tenants; revoke Directory.ReadWrite.All consent grants for all ConnectWise application IDs.
Incident Responder
Block attacker IP 144.172.64[.]128 and hunt Entra ID sign-in logs, patch BeyondTrust Remote Support to 24.3.1+/26.2.4+, and block the 5 Iranian C2 IPs.
SOC AnalystIncident Responder
No immediate actions for the selected roles.
Patch FortiOS CVE-2025-61624 across all affected FortiOS/FortiPAM/FortiProxy/FortiSwitchManager instances; audit admin accounts for unauthorized access.
Incident Responder
Run AzureHound against all M365 tenants to map third-party application permissions, hunt for UNC6446 aerospace phishing, verify Ivanti is patched against CVE-2026-111357, and implement DNS inspection for non-standard query patterns.
SOC AnalystIncident Responder
No 7-day actions for the selected roles.
Commission a comprehensive audit of all MSP and vendor application consents in Entra ID, applying least privilege - the ConnectWise breach proves backup tools with broad permissions bypass MFA entirely.
CISO / Exec
Establish automated monitoring for Iranian hacktivist domain reconstitution, tabletop a coordinated Iranian multi-unit operation, and brief the board on the shift in supply-chain risk posture.
SOC AnalystCISO / ExecIncident Responder
No 30-day actions for the selected roles.
The Bottom Line
Day 233 of this conflict presents a threat landscape defined by two converging realities. First, your trusted tools are the target - the ConnectWise and BeyondTrust incidents are not anomalies, they are the new normal. Attackers are not breaking through your perimeter; they are walking through the doors you opened for your vendors. Until organizations treat vendor application consents with the same rigor as privileged user accounts, this attack surface will keep expanding.
1
Disable the ConnectWise application and patch BeyondTrust today.
2
Audit all MSP consent grants and hunt for Iranian C2 this week.
3
Prepare for the silence to break - tabletop a coordinated operation this month.