CMP-202611-vbogsq · Other
NO FIX YET · SEE WHAT TO DO
Researcher MalwareHunterTeam shared an HTML phishing sample on 2026-11-04 that pretends to be an invitation to a 'Closed Expert Meeting Program Iran Nuclear Crisis: Development Scenarios Through the End of 2027' in Brussels on 14 Nov 2026, aimed at targets in Poland. MalwareHunterTeam suspects Russian or Russia-linked actors (not confirmed). The script in the HTML file redirects with a Windows search: URI (search-ms style) that opens a search view of a remote folder at \\38.244.132[.]48\iran_scenarios\i.raczynski_2\, labelled 'Iran Crisis', which is a usual way to get victims to run files from an attacker server. The script checks an 'isBlocked' flag before it redirects. The payload served from the share, the sender addresses and how it is delivered (email or other) are unknown. The sample crashed Edge in a VirusTotal sandbox.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
No product ranges from the sources yet.
Who cares campaign
Meeting Program: Iran Nuclear Crisis Scenarios 2027 | Brussels, 14 Nov 2026 and 'Closed Expert Meeting Program Iran Nuclear Crisis: Development Scenarios Through the End of 2027'Iran Crisis search windowAre you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.