An Investigation Into Years of Undetected Operations Targeting High-Value Sectors

Unit 42 published a set of March 2026 investigations and briefs covering multiple high-impact threats and active exploitations. Key observations include CL-UNK-1068 campaigns against high-value sectors (tunneling, reconnaissance, credential theft); web-based indirect prompt injection attacks targeting AI agents; an escalation of Iranian cyber activity; and exploitation of multiple critical vulnerabilities — notably BeyondTrust RCE (CVE-2026-1731) with VShell and SparkRAT and widespread exploitation of Ivanti EPMM zero-days (CVE-2026-1281, CVE-2026-1340). Additional coverage includes a high-sev