Overview of Cyber Threat Activity
Associated with Iran

Beginning in October 2025, a distributed Iran-nexus threat activity cluster initiated a coordinated campaign targeting enterprise VPN and gateway infrastructure. The dominant vector was high-volume credential stuffing against Cisco ASA SSL-VPN endpoints, executed by six IPs within the Farahoosh Dena /24 subnet (176.46.158.x) using a shared static CSRF token (516cfbe7ebdc7b1aeb85c07863b5fc34e9ec7672) as a unifying operational signature. Credential complexity escalated systematically from trivial sequences through policy-compliant variants, reflecting a structured multi-pass spraying methodology. Late October saw a sustained surge from 50 to 544 daily alerts, signaling deliberate campaign intensification. By November, the same Farahoosh Dena infrastructure generated approximately 4,696 combined alerts, while a parallel FortiGate credential-stuffing campaign emerged from Romanian-attributed FEO PREST SRL infrastructure (62.60.135.x), deploying harvested South African corporate credentials—indicating active breach-data marketization and multi-vendor VPN targeting.

December 2025 marked a strategic inflection point as the campaign transitioned from concentrated, single-vector credential stuffing to a bifurcated operational model. The FEO PREST SRL precision layer (62.60.135.x) evolved to deploy credentials referencing named individuals at specific organizations—SQM mining conglomerate, Altus-branded entities, GPS-coded employer accounts—signalling a shift from opportunistic dictionary attacks to precision targeting using harvested breach data. Simultaneously, a distributed Iranian domestic scanning tier expanded across six state-linked ISPs, introducing CDN-laundering techniques via the Noyan Abr Arvan Iranian cloud provider to conceal true origin IPs traced to MTN Irancell. Novel capabilities included cloud/DevOps secrets harvesting (.env, AWS credentials, Laravel logs), HP LaserJet MFP management interface targeting, and country-specific fuzzing of Chinese infrastructure.

January 2026 showed a notable reduction in overall alert volume (160 alerts versus prior baselines) while maintaining the bifurcated infrastructure model. FEO PREST (62.60.131.73) pivoted to exclusive Kenya-focused targeting, while the Iranian domestic cluster sustained broad geographic opportunism across Serbia, China, Japan, and the Middle East. Episodic burst activity—peaks on January 4–5, 16, and 25–28—separated by multi-day dormancy indicated coordinated campaign phases rather than continuous scanning. A novel baithive request containing structured JSON-like fragments from CGI GLOBAL LIMITED (94.183.188.135) suggested active experimentation with new payload vectors. The 42.5% prevalence of unknown-to-threat-intel IPs confirmed sustained infrastructure rotation discipline, consistent with a deliberate operational pause or reconfiguration period.

February 2026 represented the most significant escalation of the campaign period, with alert volume nearly quadrupling to 605 alerts. China emerged as the dominant external target geography (104 alerts). The deployment of out-of-band (OOB) callback exploitation using the shared domain produce.seetong.com across two FEO PREST nodes confirmed active exploitation maturity beyond reconnaissance, validating server-side RCE and SSRF chains. A shared PHPUnit CVE-2017-9841 exploit framework was distributed across 12+ distinct ISPs with near-identical URL sequences, demonstrating coordinated playbook distribution within an affiliate network. A compromised academic resource—Tehran University of Medical Science (194.225.213.122)—appeared as an attack source. Peak activity concentrated on February 21–22 (205 combined alerts within 48 hours)—the highest two-day intensity across the entire observation period.

March 2026 recorded minimal activity—only two alerts—from a single IP (213.176.18.65, E-Large HongKong) exclusively targeting Chinese infrastructure via PHPUnit CVE-2017-9841 path enumeration. While operationally distinct from the Iran-nexus cluster in infrastructure and volume, the China-exclusive geographic focus and shared PHPUnit exploit framework echo techniques observed across multiple prior months. The sharp contrast with February's intensity may indicate a deliberate operational pause, detection-driven withdrawal, or transition to a new infrastructure generation cycle consistent with the rotation discipline documented throughout the campaign.