{"id":"CMP-202611-vbogsq","kind":"campaign","aliases":[],"related":[],"title":"Phishing with an 'Iran Nuclear Crisis Scenarios 2027, Brussels 14 Nov 2026' meeting invite targets Poland; HTML attachment opens a Windows search window to remote server 38.244.132[.]48 (suspected Russia-linked)","description":null,"summary":"Researcher MalwareHunterTeam shared an HTML phishing sample on 2026-11-04 that pretends to be an invitation to a 'Closed Expert Meeting Program Iran Nuclear Crisis: Development Scenarios Through the End of 2027' in Brussels on 14 Nov 2026, aimed at targets in Poland. MalwareHunterTeam suspects Russian or Russia-linked actors (not confirmed). The script in the HTML file redirects with a Windows search: URI (search-ms style) that opens a search view of a remote folder at \\\\38.244.132[.]48\\iran_scenarios\\i.raczynski_2\\, labelled 'Iran Crisis', which is a usual way to get victims to run files from an attacker server. The script checks an 'isBlocked' flag before it redirects. The payload served from the share, the sender addresses and how it is delivered (email or other) are unknown. The sample crashed Edge in a VirusTotal sandbox.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-04T23:48:47+00:00","products":[],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Lure text: 'Meeting Program: Iran Nuclear Crisis Scenarios 2027 | Brussels, 14 Nov 2026' and 'Closed Expert Meeting Program Iran Nuclear Crisis: Development Scenarios Through the End of 2027'. An .html attachment whose script redirects to 'search:query=&crumb=location:\\\\38.244.132[.]48\\iran_scenarios\\...&displayname=Iran%20Crisis'. Network: SMB/WebDAV connections to 38.244.132[.]48. Sender domains and the payload are unknown.","fix":"Do not open the HTML attachment or any files shown in the 'Iran Crisis' search window. Block 38.244.132[.]48 at the firewall and proxy, block outbound SMB (445) and WebDAV to the internet, and consider disabling the search-ms: / search: URI handlers. Search mail and endpoint logs for the lure text and the IP; treat hosts that opened files from the share as compromised.","status":"open","published_at":null,"first_seen_at":"2026-11-04T23:48:47+00:00","triaged_at":"2026-11-04T23:48:47+00:00","updated_at":"2026-11-04T23:49:43+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-04':50B '-11':49B '-202611':34A '14':10A,76B '2':125B '2026':12A,48B,78B '2027':8A,72B '38.244.132':27A,120B '48':28A,121B 'actor':91B 'address':161B 'aim':79B 'attach':18A 'attack':142B 'brussel':9A,74B 'campaign':36B 'check':146B 'close':59B 'cmp':33A 'confirm':93B 'crash':174B 'crisi':6A,65B,128B 'deliv':166B 'develop':66B 'earli':38B 'early-warn':37B 'edg':175B 'email':167B 'end':70B 'expert':60B 'file':99B,139B 'flag':149B 'folder':118B 'get':135B 'html':17A,44B,98B 'i.raczynski':124B 'invit':14A,56B 'iran':4A,63B,122B,127B 'isblock':148B 'label':126B 'link':32A,90B 'malwarehunterteam':41B,84B 'meet':13A,61B 'ms':108B 'nov':11A,77B 'nuclear':5A,64B 'open':19A,111B 'payload':154B 'phish':1A,45B 'poland':16A,83B 'pretend':52B 'program':62B 'redirect':100B,152B 'remot':25A,117B 'research':40B 'run':138B 'russia':31A,89B 'russia-link':30A,88B 'russian':86B 'sampl':46B,173B 'sandbox':179B 'scenario':7A,67B,123B 'script':95B,145B 'search':22A,104B,107B,113B 'search-m':106B 'sender':160B 'serv':155B 'server':26A,143B 'share':42B,158B 'style':109B 'suspect':29A,85B 'target':15A,81B 'unknown':171B 'uri':105B 'usual':132B 'vbogsq':35A 'victim':136B 'view':114B 'virustot':178B 'warn':39B 'way':133B 'window':21A,23A,103B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":[],"ptokens":[],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"phishing","first_public_at":"2026-11-04T23:11:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-vbogsq","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T23:48:47+00:00","fetched_at":"2026-11-04T23:48:47+00:00","note":null}],"documents":[{"id":71252,"url":"https://x.com/malwrhunterteam/status/2118119086844748070","title":"@malwrhunterteam: Looks some supposedly Russian / Russia related actors are doing some targeting i","kind":"post","source":"x","publisher":null,"text":"Looks some supposedly Russian / Russia related actors are doing some targeting in Poland...\n\"Meeting Program: Iran Nuclear Crisis Scenarios 2027 | Brussels, 14 Nov 2026\"\n\"Closed Expert Meeting Program\nIran Nuclear Crisis: Development Scenarios Through the End of 2027\"\n🤔\n🤷‍♂️\n(1/4) https://t.co/4prR4eVQiC\n\nlikes 7 reposts 1","published_at":"2026-11-04T23:11:57+00:00","relation":"describes","confidence":null,"note":null},{"id":71251,"url":"https://x.com/malwrhunterteam/status/2118119092171530437","title":"@malwrhunterteam: The script inside the .html file will do a redirect if not \"isBlocked\": \"url=sea","kind":"post","source":"x","publisher":null,"text":"The script inside the .html file will do a redirect if not \"isBlocked\": \"url=search:query=&crumb=location:\\\\\\\\38.244.132[.]48\\\\iran_scenarios\\\\i.raczynski_2\\\\&displayname=Iran%20Crisis\"\n🤷‍♂️\n(2/4) https://t.co/YUCqb68znn\n\nlikes 2 reposts 1","published_at":"2026-11-04T23:11:58+00:00","relation":"describes","confidence":null,"note":null},{"id":71250,"url":"https://x.com/malwrhunterteam/status/2118119096352981450","title":"@malwrhunterteam: 🤷‍♂️\n(3/4) https://t.co/w8qrcNCBse","kind":"post","source":"x","publisher":null,"text":"🤷‍♂️\n(3/4) https://t.co/w8qrcNCBse\n\nlikes 2 reposts 0","published_at":"2026-11-04T23:11:59+00:00","relation":"describes","confidence":null,"note":null},{"id":71249,"url":"https://x.com/malwrhunterteam/status/2118119099855184057","title":"@malwrhunterteam: In a sandbox of VT, the .html sample looks crashes Edge strangely, even before a","kind":"post","source":"x","publisher":null,"text":"In a sandbox of VT, the .html sample looks crashes Edge strangely, even before any malicious traffic would happen...\n🤔\n🤷‍♂️\n(4/4) https://t.co/uEkv4FZOqw\n\nlikes 2 reposts 0","published_at":"2026-11-04T23:12:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}