Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization
2026-03-16T20:51:40Z•4e6d41a6f5f5e39b158b9bbd955136ec7a8da7f307fb453d86a9b9453cdb7ddb
ai-prompt-injectionbeyondtrustchrome-geminicl-unk-1068cloud-detectionhandala-hackiranian-threatsivanti-epmmmicrosoft-intune-abusenation-state-espionagenotepad++-supply-chainot-securityphishingqr-code-phishingsparkratvoid-manticorevshellvulnerability-exploitationweb-shellswiper-malware
What happened
Unit 42 feed summarizing multiple March–Feb 2026 investigations and advisories: increased Iranian activity including wiper campaigns by Handala Hack (aka Void Manticore) using phishing and Microsoft Intune abuse; active exploitation of multiple critical vulnerabilities (BeyondTrust CVE-2026-1731 and Ivanti EPMM CVE-2026-1281/CVE-2026-1340) with web shells/backdoors; a high-severity Chrome Gemini bug (CVE-2026-0628) allowing extension-based privacy/local-file access (patched); China-linked espionage using custom backdoors; AI/agent prompt-injection weaknesses and web-based indirect attacks; Not
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- 4e6d41a6f5f5e39b158b9bbd955136ec7a8da7f307fb453d86a9b9453cdb7ddb
- Enrichment time
- 2026-03-16T20:51:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.