Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran (Updated March 26)

Palo Alto Networks Unit 42 (March 2026) publishes a set of threat briefs documenting an overall escalation in cyber risk tied to Iran-linked actors and concurrent, high-impact activity across multiple threat clusters. Key observations: increased wiper activity attributed to Handala Hack (aka Void Manticore) including misuse of Microsoft Intune and phishing; Boggy Serpens evolving with AI-enhanced malware and refined social engineering; ongoing espionage campaigns in Southeast Asia and against military targets using USBFect, RATs, loaders and custom backdoors; a long-running CL-UNK-1068 espione