Unit 42 details recent Iranian cyberattack activity, sharing direct observations of phishing, hacktivist activity and cybercrime. We include recommendations for defenders.

Unit42 is a cybersecurity research team known for its  analysis of cyber threats, malware, and cyber attack trends. Through research reports, threat intelligence briefings, and data analysis, Unit42 offers insights into emerging cyber threats and adversary tactics. Readers can learn about threat detection methodologies, vulnerability trends, and cyber attack attribution to enhance their cybersecurity posture and protect their organizations from advanced cyber threats.

Unit 42

Following a joint U.S.-Israel military operation on Feb. 28, 2026, Iran's internet connectivity dropped to 1-4%, limiting sophisticated state-sponsored cyberattacks in the near term. However, Unit 42 has observed a surge in hacktivist activity from over 60 groups including Handala Hack, Dark Storm Team, DieNet, and pro-Russian collectives like NoName057(16), conducting DDoS attacks, data exfiltration, website defacements, and phishing campaigns against Israeli, Western, and Gulf targets. A malicious Android APK mimicking the Israeli RedAlert app is actively being used for mobile surveillance. Ransomware group Tarnished Scorpius has also listed an Israeli company on its leak site. Defenders are advised to maintain offline backups, patch internet-facing infrastructure, train staff on phishing, implement geographic IP blocking, and prepare breach communication plans.

Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran

How Palo Alto Networks and Unit 42 Can Help