Overview of Cyber Threat Activity Associated with Iran

Initial Escalation (Oct–Nov 2025)

Beginning in October 2025, a distributed Iran-nexus threat activity cluster initiated a coordinated campaign targeting enterprise VPN and gateway infrastructure. The dominant vector was high-volume credential stuffing against Cisco ASA SSL-VPN endpoints, executed by six IPs within the Farahoosh Dena /24 subnet (176.46.158.x) using a shared static CSRF token (516cfbe7ebdc7b1aeb85c07863b5fc34e9ec7672) as a unifying operational signature. Credential complexity escalated systematically from trivial sequences through policy-compliant variants, reflecting a structured multi-pass spraying methodology. Late October saw a sustained surge from 50 to 544 daily alerts, signaling deliberate campaign intensification. By November, the same Farahoosh Dena infrastructure generated approximately 4,696 combined alerts, while a parallel FortiGate credential-stuffing campaign emerged from Romanian-attributed FEO PREST SRL infrastructure (62.60.135.x), deploying harvested South African corporate credentials—indicating active breach-data marketization and multi-vendor VPN targeting.

Operational Bifurcation & Tactical Maturation (Dec 2025)

December 2025 marked a strategic inflection point as the campaign transitioned from concentrated, single-vector credential stuffing to a bifurcated operational model. The FEO PREST SRL precision layer (62.60.135.x) evolved to deploy credentials referencing named individuals at specific organizations—SQM mining conglomerate, Altus-branded entities, GPS-coded employer accounts—signalling a shift from opportunistic dictionary attacks to precision targeting using harvested breach data. Simultaneously, a distributed Iranian domestic scanning tier expanded across six state-linked ISPs, introducing CDN-laundering techniques via the Noyan Abr Arvan Iranian cloud provider to conceal true origin IPs traced to MTN Irancell. Novel capabilities included cloud/DevOps secrets harvesting (.env, AWS credentials, Laravel logs), HP LaserJet MFP management interface targeting, and country-specific fuzzing of Chinese infrastructure—indicating compartmentalized operational teams or shared tasking with distinct mission sets.

Tactical Consolidation & Reduced Tempo (Jan 2026)

January 2026 showed a notable reduction in overall alert volume (160 alerts versus prior baselines) while maintaining the bifurcated infrastructure model. FEO PREST (62.60.131.73) pivoted to exclusive Kenya-focused targeting with 28 alerts comprising country-specific attacks and fuzzing probes, while the Iranian domestic cluster sustained broad geographic opportunism across Serbia, China, Japan, and the Middle East. Episodic burst activity—peaks on January 4–5, 16, and 25–28—separated by multi-day dormancy indicated coordinated campaign phases rather than continuous scanning. A novel baithive request containing structured JSON-like fragments from CGI GLOBAL LIMITED (94.183.188.135) suggested active experimentation with new payload vectors. The 42.5% prevalence of unknown-to-threat-intel IPs confirmed sustained infrastructure rotation discipline despite reduced tempo, consistent with a deliberate operational pause or reconfiguration period.

Major Escalation & Active Exploitation (Feb 2026)

February 2026 represented the most significant escalation of the campaign period, with alert volume nearly quadrupling to 605 alerts from January's 160. China emerged as the dominant external target geography (104 alerts), with FEO PREST (62.60.131.73) executing precision fuzzing and secrets harvesting against Chinese infrastructure. The deployment of out-of-band (OOB) callback exploitation using the shared domain produce.seetong.com across two Feo Prest nodes confirmed active exploitation maturity beyond reconnaissance, validating server-side RCE and SSRF chains. A shared PHPUnit CVE-2017-9841 exploit framework was distributed across 12+ distinct ISPs with near-identical URL sequences, demonstrating coordinated playbook distribution within an affiliate network. A compromised academic resource—Tehran University of Medical Science (194.225.213.122)—appeared as an attack source, indicating opportunistic use of institutional pivot infrastructure. Peak activity concentrated on February 21–22 (205 combined alerts within 48 hours), the highest two-day intensity across the entire observation period.

Residual Activity & Attribution Complexity (Mar 2026)

March 2026 (through the 24th) recorded minimal activity—only two alerts—from a single IP (213.176.18.65, E-Large HongKong) exclusively targeting Chinese infrastructure via PHPUnit CVE-2017-9841 path enumeration. While operationally distinct from the Iran-nexus cluster in infrastructure and volume, the China-exclusive geographic focus and shared PHPUnit exploit framework echo techniques observed across multiple prior months, suggesting either a loosely affiliated operator, a shared toolset within a broader ecosystem, or the tail end of a campaign cycle before potential re-escalation. The sharp contrast with February's intensity may indicate a deliberate operational pause, detection-driven withdrawal, or transition to a new infrastructure generation cycle consistent with the rotation discipline documented throughout the campaign.

Enterprise VPN Credential Stuffing

The dominant and most sustained attack vector throughout the campaign period (October 2025 through February 2026) was large-scale credential stuffing against enterprise SSL-VPN endpoints. Initial operations focused exclusively on Cisco ASA (/+webvpn+/index.html, /+CSCOE+/logon.html) using a shared CSRF token (516cfbe7ebdc7b1aeb85c07863b5fc34e9ec7672) as a unifying operational fingerprint across a Farahoosh Dena /24 subnet. By November, the attack surface expanded to include Fortinet FortiGate (POST /logincheck) via FEO PREST SRL infrastructure. Credential complexity escalated month-over-month: from generic defaults and trivial sequences in October, through leet-substitution variants in November, to named individual harvested credentials referencing specific organizations (SQM, Altus, GPS-coded employer accounts) by December. By February 2026, credentials included timestamped variants (fortigate2025, ranj@2026, sqm2025!) confirming real-time corpus maintenance. The evolution from wordlist-based spraying to precision breach-data targeting represents the most significant tactical progression across the observation period.

Distributed Aggressive Scanning & Trap Engagement

A persistent secondary vector involved high-frequency, low-payload TCP/UDP probing against honeypot infrastructure, sourced from dozens to hundreds of distinct IPs across Iranian state-linked and commercial ISPs (Iran Telecommunication Company PJS, Telecommunication Infrastructure Company, MTN Irancell, Iran Information Technology Company PJSC, Afranet, and 20+ smaller providers). This layer generated the majority of raw alert volume across all months. Individual IP hit counts were typically low (1–35 events), but the breadth across ISP space and consistent absence from third-party threat intelligence feeds indicated deliberate use of fresh or rotated IP pools. Peak nodes—185.164.254.28 (89 trap hits, Feb), 37.255.224.137 (35 trap hits, Oct), 2.179.194.138 (102 events, Nov)—demonstrated automated high-frequency tooling. This scanning tier is consistent with botnet-assisted capability testing, pre-compromise reconnaissance, or persistent infrastructure mapping operations.

Web Application Exploitation Frameworks (PHPUnit CVE-2017-9841)

A shared PHPUnit remote code execution exploit framework (CVE-2017-9841, targeting eval-stdin.php) emerged as a cross-ISP distributed capability by February 2026, deployed across 12+ distinct IP addresses spanning Sefroyek Pardaz Engineering, Varesh Cloud, Respina Networks, Vandad Vira Hooman, Tejarat Electronic, and others. The near-identical five-path URL sequence (/vendor/phpunit/, /lib/phpunit/, /phpunit/, /zend/vendor/, standalone layouts) across all nodes eliminates coincidence and confirms shared playbook distribution within a coordinated affiliate network. This vector persisted into March 2026 via E-Large HongKong infrastructure (213.176.18.65), suggesting the framework remains active beyond the primary Iran-nexus cluster. Successful exploitation enables unauthenticated remote code execution on production PHP environments shipping PHPUnit as a development dependency.

Cloud & DevOps Secrets Harvesting

Systematic enumeration of cloud credential and configuration exposure vectors emerged in November 2025 and intensified through February 2026. Targeted file paths included .env variants (with path-traversal encoded forms /%2e%2e%2f.env), AWS credential files (/.aws/credentials), PHP configuration (database.php, config.json, phpinfo.php), Laravel application logs (/storage/laravel.log), Kubernetes/Helm environment files (/helm/.env), and Node.js/Python settings files (/s3.js, /s3_config.json, /settings.py, /application.properties). This capability was concentrated within FEO PREST SRL infrastructure (62.60.135.189, 62.60.131.73) and CGI GLOBAL LIMITED, indicating an initial access brokering or cloud account takeover mission set. The targeting of Kubernetes-specific paths demonstrates familiarity with containerized infrastructure attack surfaces and supply chain exposure points.

Out-of-Band (OOB) Callback Exploitation

Active exploitation capability beyond passive reconnaissance was confirmed in February 2026 through OOB callback injection using the shared domain produce.seetong.com across two FEO PREST nodes (62.60.131.73 and 62.60.131.43). This technique validates server-side code execution for SSRF, RCE, and injection chain exploitation, representing a qualitative escalation from credential harvesting to confirmed active exploitation with exfiltration confirmation infrastructure. The shared OOB domain across two distinct IPs confirms operator-level infrastructure centralization and single-actor control of both nodes.

IoT & Embedded Device Targeting

IoT and embedded device exploitation appeared across multiple months as a tertiary capability. In October 2025, IP 178.173.218.62 (Shiraz Hamyar Co.) exploited a Netgear router RCE (setup.cgi?todo=syscmd) to deploy Mozi botnet malware (Mozi.m). November and December introduced systematic HP LaserJet MFP management interface targeting (/set_config_netIdentification.html, /set_config_IP.html, /set_config_deviceinfo.html, /cgi-bin/netset.cgi), with one instance submitting a DNS hijacking payload (hardcoded 95.x.x.x DNS server) against printer administration endpoints. The specificity of HP LaserJet MFP M426D model awareness indicates dedicated IoT/printer exploitation module use, enabling asset data harvesting and potential internal network pivoting via compromised print infrastructure.

CDN-Based IP Laundering & Attribution Obfuscation

A sophisticated anti-attribution capability emerged in December 2025 through the Noyan Abr Arvan Iranian cloud/CDN provider. Three IPs (94.101.182.11, 37.32.19.4, 94.101.182.13) routed attack traffic while concealing true origin addresses (94.101.179.184, 5.122.196.21, 188.121.120.21) behind X-Forwarded-For header manipulation and Akamai egress nodes. True origin IP 5.122.196.21 traced to MTN Irancell, confirming domestic infrastructure use with CDN proxying as an obfuscation layer. This technique—absent from October–November activity—represents a deliberate evasion capability uplift and indicates the actor monitors IP reputation systems and responds with countermeasures.

Strategic Recommendations

1. Transition from IP-based to behavioral detection architecture. The consistent zero-footprint threat intelligence status of all attacking IPs across six months confirms that signature-based IP blocklisting is structurally ineffective against this adversary. Invest in behavioral analytics capable of detecting CSRF token reuse, credential corpus patterns, subnet-coordinated authentication attempts, and PHPUnit exploit path sequences independent of source IP identity.

1. Implement a VPN and remote access hardening program as an organizational priority. The sustained, multi-month focus on Cisco ASA and Fortinet FortiGate endpoints—with escalating credential sophistication from wordlists to breach data—indicates these systems represent the adversary's primary initial access objective. Enforce certificate-based or FIDO2 authentication on all SSL-VPN endpoints, eliminating password-only authentication as a viable attack surface.

1. Establish a breach credential monitoring and response capability. The December 2025 observation of credentials referencing named individuals at specific organizations with timestamped variants confirms adversary access to current breach data markets. Implement continuous monitoring of organizational credentials against breach repositories, deploy automated forced resets on compromised credential detection, and integrate breach-password screening into identity provider authentication flows.

1. Develop a cloud security posture management (CSPM) program targeting secrets exposure. The systematic harvesting of .env, AWS credential, and Kubernetes/Helm configuration files across three consecutive months indicates a persistent adversary reconnaissance capability targeting cloud-native deployments. Mandate secrets scanning in all CI/CD pipelines, enforce infrastructure-as-code policy controls preventing secrets in application web roots, and deploy runtime cloud security monitoring.

1. Establish geopolitical threat context integration into security operations. The consistent China-exclusive targeting from multiple Iranian-attributed actors (25-hit thresholds, country-specific fuzzing payloads) and the Kenya/Serbia targeting patterns indicate geopolitically-tasked operations rather than purely financial motivation. Integrate geopolitical threat intelligence into SOC workflows to contextualize attack patterns and anticipate campaign pivots aligned with Iranian foreign policy interests.

1. Implement supply chain and dependency security controls for PHP environments. The shared PHPUnit CVE-2017-9841 exploit framework distributed across 12+ ISPs with identical URL sequences indicates a mature, widely-distributed capability targeting organizations that ship development dependencies in production builds. Enforce production build hygiene through composer --no-dev requirements, automated SAST/DAST scanning for exposed development tools, and WAF rules blocking known exploit paths.

1. Harden IoT and printer infrastructure against lateral movement exploitation. IoT botnet propagation (Mozi), HP LaserJet MFP DNS hijacking, and printer admin interface targeting across four months indicate persistent adversary interest in network-connected embedded devices as pivot points. Segment IoT/print infrastructure into isolated VLANs with no lateral internet access, deploy firmware integrity monitoring, and implement centralized DNS security to detect hijacking payloads.

1. Conduct a comprehensive incident response readiness assessment focused on Iran-nexus TTPs. The OOB callback infrastructure (produce.seetong.com), active exploitation confirmation, and compromised institutional pivot use (Tehran University of Medical Sciences) indicate the adversary has escalated beyond reconnaissance into active exploitation phases. Validate IR playbooks against documented Iranian APT TTPs, conduct tabletop exercises simulating credential-based VPN compromise with lateral movement, and establish pre-authorized containment procedures for high-confidence Iranian-nexus indicators.