Boggy Serpens Threat Assessment

Palo Alto Unit 42 collection (Mar 2026) highlights escalating Iranian-aligned cyberespionage and destructive activity (Boggy Serpens, Handala Hack/Void Manticore) using AI-enhanced malware, phishing, Microsoft Intune abuse, and identity weaponization. Unit 42 also documents widespread exploitation of critical product vulnerabilities (BeyondTrust, Ivanti, Chrome) with observed VShell/SparkRAT, web shells and backdoors, supply-chain compromise of Notepad++, and emerging attacks against LLM-based controls (prompt injection/AI judges and agentic browsers). Defenders should prioritize patching the