Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran (Updated March 26)

Unit 42’s March 2026 collection of briefings documents an escalation in state‑linked and financially motivated activity affecting multiple regions and sectors. Key themes: increased Iranian activity (including Boggy Serpens and Handala Hack) with more frequent phishing-delivered wipers and misuse of management tools (e.g., Intune); targeted espionage campaigns in Southeast Asia using USBFect, RATs and loaders; ongoing identity‑weaponization and evolution from wipers to broader destructive/espionage toolsets; and growing use of AI in malware and attacks against LLM/AI agent guardrails (prompt‑f