[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/) * [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/evolution-of-iran-cyber-threats/) * [French](https://unit42.paloaltonetworks.com/fr/evolution-of-iran-cyber-threats/) * [Japanese](https://unit42.paloaltonetworks.com/ja/evolution-of-iran-cyber-threats/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Insights](https://unit42.paloaltonetworks.com/category/insights/ "Insights") * [General](https://unit42.paloaltonetworks.com/category/general/ "General") [General](https://unit42.paloaltonetworks.com/category/general/) # Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 6 min read Related Products [![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Justin Moore](https://unit42.paloaltonetworks.com/author/justin-moore/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:March 16, 2026 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [General](https://unit42.paloaltonetworks.com/category/general/) * [Insights](https://unit42.paloaltonetworks.com/category/insights/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Agonizing Serpens](https://unit42.paloaltonetworks.com/tag/agonizing-serpens/) * [Agrius](https://unit42.paloaltonetworks.com/tag/agrius/) * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/) * [Evasive Serpens](https://unit42.paloaltonetworks.com/tag/evasive-serpens/) * [OilRig](https://unit42.paloaltonetworks.com/tag/oilrig/) * [Shamoon](https://unit42.paloaltonetworks.com/tag/shamoon/) * [Telegram](https://unit42.paloaltonetworks.com/tag/telegram/) * [Wiper](https://unit42.paloaltonetworks.com/tag/wiper/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/?pdf=download&lg=en&_wpnonce=64814e76fb "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/?pdf=print&lg=en&_wpnonce=64814e76fb "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Iranian%20Cyber%20Threat%20Evolution:%20From%20MBR%20Wipers%20to%20Identity%20Weaponization&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fevolution-of-iran-cyber-threats%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fevolution-of-iran-cyber-threats%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fevolution-of-iran-cyber-threats%2F&title=Iranian%20Cyber%20Threat%20Evolution:%20From%20MBR%20Wipers%20to%20Identity%20Weaponization "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fevolution-of-iran-cyber-threats%2F&text=Iranian%20Cyber%20Threat%20Evolution:%20From%20MBR%20Wipers%20to%20Identity%20Weaponization "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fevolution-of-iran-cyber-threats%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Iranian%20Cyber%20Threat%20Evolution:%20From%20MBR%20Wipers%20to%20Identity%20Weaponization%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fevolution-of-iran-cyber-threats%2F "Share in Mastodon") Recent [cyberattacks attributed to Iranian threat actors](https://unit42.paloaltonetworks.com/handala-hack-wiper-attacks/) extend beyond typical network disruption. Rather than an isolated incident of sabotage, this type of attack sits within a broader context defined by Iran's reliance on asymmetric retaliation and historical proxy doctrine. Iran-aligned threat actors increasingly leverage cyberspace as a strategic equalizer. For the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS), cyber operations provide a low-cost, high-impact mechanism for retaliation without crossing any geographical boundaries. In this environment, global organizations face increased cyber risk, as traditional malware deployment intersects with novel identity abuse. The shift from custom-built wiper malware to native administrative abuse removes a critical detection guardrail that historically protected enterprise networks. ## From Custom Binaries to Identity Abuse Iranian cyber actors' current tactical shift is driven less by a lack of malware development capabilities than by the strategic advantages of living-off-the-land (LotL) techniques. Operations designed to cause disruption have undergone a change since 2023: Instead of relying heavily on bespoke tools, the methods now employed are part of a larger trend toward greater scale and improved evasion. During the recent wiper incidents, threat actors operating under the Void Manticore (Handala) persona did not deploy a novel wiper or traditional compiled malware. Instead, the attackers compromised highly privileged identities, pushing legitimate remote-wipe commands to over 200,000 devices globally. This shift from custom binaries to administrative abuse helps explain the current dynamic. In this context, Iranian advanced persistent threats (APTs) increasingly appear to view enterprise administrative tools not solely as IT infrastructure, but as weaponizable assets within a wider disruptive framework. This distinction is critical for understanding how Iranian state-aligned actors perceive mobile device management (MDM) platforms not as management tools, but as high-leverage attack vectors that bypass traditional endpoint detection and response (EDR) telemetry. ## Moving Up the Escalation Ladder Already in [2012](https://www.cfr.org/cyber-operations/compromise-of-saudi-aramco-and-rasgas) and 2016, Iranian actors were launching significant disruptive operations throughout the region. Tracing the history of their cyber retaliation against perceived geopolitical slights, we see a clear, escalating pattern of capability and intent over the last decade among groups linked to the IRGC and MOIS. ### The Blunt Instruments (2016--2019) During this period, threat actor groups such as [Curious Serpens](https://unit42.paloaltonetworks.com/curious-serpens-falsefont-backdoor/) (APT33, Elfin) and [Evasive Serpens](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/) (APT34, OilRig) targeted IT infrastructure with high-visibility disk-wiping malware. * **Shamoon resurgence:** Following its initial [debut](https://www.computerworld.com/article/1526242/kill-timer-found-in-shamoon-malware-suggests-possible-connection-to-saudi-ar.html) in 2012, [Shamoon 2](https://unit42.paloaltonetworks.com/unit42-second-wave-shamoon-2-attacks-identified/) and[Shamoon 3](https://unit42.paloaltonetworks.com/shamoon-3-modified-open-source-wiper-contains-verse-from-the-quran/) were deployed against Middle Eastern entities. These attacks utilized spearphishing to gain initial access, eventually relying on the Eldos RawDisk driver to bypass Windows APIs and overwrite the master boot record (MBR). * **ZeroCleare and Dustman:** Deployed heavily against the energy and industrial sectors, wipers like [ZeroCleare](https://thehackernews.com/2019/12/zerocleare-data-wiper-malware.html) and its successor [Dustman](https://www.darkreading.com/vulnerabilities-threats/dustman-attack-underscores-iran-s-cyber-capabilities) mirrored Shamoon's reliance on modified legitimate drivers to achieve destructive effects. In this era, Iranian actors prioritized visible retaliation over stealth. Their cyberattacks projected power and inflicted maximum operational immobilization. ### Ransomware Smokescreen: Plausible Deniability and Supply Chain Compromise (2020--2022) As scrutiny intensified, Iranian threat actors adapted their operational playbook to introduce plausible deniability. The strategic focus shifted from overt, state-sponsored sabotage to mirroring financially motivated cybercrime. This tactical pivot was primarily spearheaded by the threat actor group [Agonizing Serpens](https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/) (Agrius). * **The Agonizing Serpens wiper suite (Apostle and Fantasy):** Rather than relying on traditional spear phishing, Agonizing Serpens frequently exploited publicly available one-day vulnerabilities in public-facing web applications to drop custom [web shells](https://www.nozominetworks.com/blog/agrius-in-focus-dissecting-a-web-shell). Once initial access was established, the group [deployed](https://www.sentinelone.com/labs/from-wiper-to-ransomware-the-evolution-of-agrius/) payloads designed to blur the lines between espionage and extortion. * **Evolution of Apostle:** Initially observed as a pure wiper disguised as a ransomware operation, [early versions of Apostle](https://www.sentinelone.com/labs/from-wiper-to-ransomware-the-evolution-of-agrius/) lacked the actual capability to decrypt files, indicating that data destruction was the primary intent. Later variants, however, were patched to function as legitimate ransomware, complicating attribution and delaying incident response efforts by forcing defenders to treat the event as a standard cybercrime incident. * **Supply chain exploitation:** The deployment of the[Fantasy wiper](https://www.eset.com/hk/about/newsroom/press-releases/news/fantasy-a-new-agrius-wiper-deployed-through-a-supply-chain-attack0/) represented a significant escalation in Agrius's targeting methodology. By compromising a trusted third-party Israeli software developer, the threat actors executed a supply-chain attack that impacted downstream victims across multiple global verticals. Masquerading as a ransomware syndicate offered a critical strategic advantage to Iranian cyber actors by obfuscating state alignment while still achieving the desired effect of business disruption and economic damage. ### Hacktivism as a Front: Psychological Operations and Cross-Platform Destruction (2023--2025) Between 2023 and 2025, the threat landscape shifted once again. The traditional APT model gave way to a surge of state-directed hacktivist personas. Groups such as Void Manticore and the Handala Hack Team operated openly on platforms like [Telegram](https://cyberint.com/blog/threat-intelligence/handala-hack-what-we-know-about-the-rising-threat-actor/), leveraging destructive attacks as a component of broader psychological operations and information warfare. * **BiBi, Hatef, and Hamsa wipers:** The emergence of these malware families highlighted a critical technical evolution: cross-platform capability. While earlier wipers were strictly Windows-focused, threat actors deployed the .NET-based Hatef wiper for Windows environments alongside the [Bash-based Hamsa and BiBi wipers](https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group) targeting Linux servers. * **File-level destruction:** Technically, these [variants](https://arcticwolf.com/resources/blog/bibi-wiper-used-in-the-israel-hamas-war-now-runs-on-windows/) moved away from the complex MBR-wiping techniques of the Shamoon era. Instead, they opted for rapid, recursive file-level destruction, overwriting targeted files with 4096-byte blocks of random data. * **MultiLayer and BFG Agonizer:** Concurrently, collaborative deployments between Agonizing Serpens and Boggy Serpens (aka [MuddyWater](https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/)) introduced[highly modular wipers like MultiLayer and BFG Agonizer](https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/). These operations frequently abused legitimate remote monitoring and management (RMM) tools to distribute the payloads at scale. During this period, wipers became just one component of a hybrid threat model. Destructive deployments were consistently paired with aggressive data exfiltration, creating simultaneous hack-and-leak operations. ### The Era of Identity Weaponization (2026 and Beyond) The most recent [escalation](https://www.forrester.com/blogs/the-stryker-attack-enterprise-resiliency-plans-cant-ignore-uem/) in Iranian offensive cyber operations marks a fundamental departure from the previous decade of tradecraft. While the strategic motivations remain consistent, the technical execution has shifted from deploying compiled, custom malware to a highly destructive form of LotL. Instead of attempting to evade EDR agents with sophisticated wiper binaries, these groups are targeting the enterprise management plane itself. * **Exploitation of mobile device management (MDM):** The primary attack vector relies on the compromise of highly privileged identities with access to cloud-based management consoles, such as MDM/RMM platforms. * **Built-in command abuse:** Once administrative access is secured, threat actors abuse legitimate, built-in features --- specifically, the built-in remote wipe or factory reset commands. By broadcasting these commands across the entire managed tenant, attackers can simultaneously wipe hundreds of thousands of corporate laptops, servers, and mobile devices (including bring-your-own-device (BYOD) hardware) across global environments. * **The EDR hidden zone:** Because no traditional wiper malware is dropped, and no anomalous disk-writing processes are initiated by an unknown executable, EDR and antivirus platforms can remain largely blind to the activity. The destructive commands are authenticated, authorized, and delivered directly from trusted vendor infrastructure. This methodology offers unprecedented scale and speed. It eliminates the resource-intensive requirement to develop, test and update custom malware families while guaranteeing a catastrophic impact on the target's operational capabilities. ## The Outlook: A Changed Strategic Calculus For cybersecurity professionals and network defenders, the threat model has shifted significantly. The primary lesson from this evolutionary timeline is that an organization's infrastructure is only as strong as its weakest administrative credential. When threat actors can reliably turn the tools used to manage and secure a fleet into the very instruments of its destruction, the defensive paradigm must evolve from focusing purely on malware detection to enforcing strict identity resilience. For state-aligned threat actors, disrupting operations through native identity abuse is a highly efficient, scalable way to project power and inflict economic damage. By understanding this tactical evolution, organizations can transition from a posture of reactive malware hunting to one of verified, identity-centric resilience. To mitigate the risk of state-aligned administrative abuse, security teams must implement the following strategic countermeasures: * **Treat the management plane as Tier-0:** [Cloud-based management platforms](https://www.paloaltonetworks.com/resources/datasheets/cortex-cloud-ciem) must be classified as critical infrastructure. Changes to MDM policies, role assignments, and enrollment scopes should be subjected to the same rigorous change-control processes as domain controller modifications. * **Enforce strict conditional access and Zero Trust:** Access to administrative portals must be gated behind robust conditional access policies. Valid credentials and multi-factor authentication (MFA) are no longer sufficient; [access must also require verification](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-3.x-Documentation/Cortex-Cloud-Identity-Security) from a known, compliant, and cataloged corporate device. Stolen credentials attempting to authenticate from an unknown device or anomalous IP address range must trigger a hard block, not merely an MFA step-up prompt. * **Eliminate standing privileges:** Organizations must audit and radically reduce the number of accounts holding standing global administrator roles. Implement [privileged identity management (PIM)](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Privileged-Security-Admin) to ensure that administrative access is granted only on a Just-In-Time (JIT) basis, complete with approval workflows and strict timeboxing. * **Isolate and air-gap backups:** In an environment where the cloud tenant itself is compromised, cloud-connected backups are highly susceptible to the same destruction. Maintaining offline, air-gapped, and immutable backups is a non-negotiable requirement for ensuring organizational survivability against native administrative wiping operations. ## Additional Resources * [Insights: Increased Risk of Wiper Attacks](https://unit42.paloaltonetworks.com/handala-hack-wiper-attacks/) -- Unit 42, Palo Alto Networks * [Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/) -- Unit 42, Palo Alto Networks * [Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/) -- Unit 42, Palo Alto Networks *Updated March 23, 2026, at 3:26 p.m. PT, to add an Additional Resources section with links* Back to top ### Tags * [Agonizing Serpens](https://unit42.paloaltonetworks.com/tag/agonizing-serpens/ "Agonizing Serpens") * [Agrius](https://unit42.paloaltonetworks.com/tag/agrius/ "Agrius") * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/ "Curious Serpens") * [Evasive Serpens](https://unit42.paloaltonetworks.com/tag/evasive-serpens/ "Evasive Serpens") * [OilRig](https://unit42.paloaltonetworks.com/tag/oilrig/ "OilRig") * [Shamoon](https://unit42.paloaltonetworks.com/tag/shamoon/ "Shamoon") * [Telegram](https://unit42.paloaltonetworks.com/tag/telegram/ "Telegram") * [Wiper](https://unit42.paloaltonetworks.com/tag/wiper/ "wiper") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Insights: Increased Risk of Wiper Attacks](https://unit42.paloaltonetworks.com/handala-hack-wiper-attacks/ "Insights: Increased Risk of Wiper Attacks") ### Table of Contents * ### Related Articles * [The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "article - table of contents") * [2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "article - table of contents") * [Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "article - table of contents") ## Related General Resources ![Pictorial representation of a woman in glasses viewing a reflection of a monitor screen. The reflection features multicolored numbers, arrows, and graphs.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/07_Opinion_Overview_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 2, 2026 [#### An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation](https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/ "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation") ![New research reveals that AI safety refusal lives in a thin neural layer, highlighting the critical need for external, multi-layered security.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_General_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 28, 2026 [#### Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety](https://unit42.paloaltonetworks.com/perturbation-probing-llm-safety/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Jailbreak](https://unit42.paloaltonetworks.com/tag/jailbreak/ "Jailbreak") * [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/perturbation-probing-llm-safety/ "Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety") ![Pictorial representation of a male individual viewing multiple monitor screens. The blurred background indicates a female indiviual in the back, also viewing multiple monitor screens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/09_Myth-Busting_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 21, 2026 [#### Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain](https://unit42.paloaltonetworks.com/sdlc-supply-chain/) * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Npm packages](https://unit42.paloaltonetworks.com/tag/npm-packages/ "npm packages") * [Software supply-chain attack](https://unit42.paloaltonetworks.com/tag/software-supply-chain-attack/ "software supply-chain attack") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/sdlc-supply-chain/ "Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain") ![Pictorial representation of large-scale credential attacks. A vibrant city skyline at night, with tall skyscrapers and glowing digital beams extending into the sky, suggesting advanced technology and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 18, 2026 [#### Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)](https://unit42.paloaltonetworks.com/large-scale-credential-attacks/) * [Credential theft](https://unit42.paloaltonetworks.com/tag/credential-theft/ "credential theft") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/large-scale-credential-attacks/ "Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)") ![Pictorial representation of a group of people interacting with a dynamic 3D holographic display of colorful, undulating data waves on a table.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/11_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 4, 2026 [#### The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") * [Vulnerability Exploitation](https://unit42.paloaltonetworks.com/tag/vulnerability-exploitation/ "Vulnerability Exploitation") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/ "The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software") ![Pictorial representation of WebAuthn. A person wearing glasses with computer code reflected in the lenses. The focus is on the eye, and the code is clear and detailed.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) July 2, 2026 [#### How We Added WebAuthn to a Browser-Based RDP Client](https://unit42.paloaltonetworks.com/webauthn-added-to-browser-based-rdp/) * [IDA Pro](https://unit42.paloaltonetworks.com/tag/ida-pro/ "IDA Pro") * [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/ "Microsoft") * [RDP](https://unit42.paloaltonetworks.com/tag/rdp/ "RDP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/webauthn-added-to-browser-based-rdp/ "How We Added WebAuthn to a Browser-Based RDP Client") ![Pictorial representation of an individual typing on a laptop featuring pop-up screens of lists and tasks.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/11_Listicle_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) June 12, 2026 [#### Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered](https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/) * [Digital forensics](https://unit42.paloaltonetworks.com/tag/digital-forensics/ "digital forensics") * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/ "Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered") ![Pictorial representation of an aerial view of an individual working on a cumputer in an office setting.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/02_Opinion_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) June 8, 2026 [#### When "Hi, This Is IT" Comes Through Microsoft Teams](https://unit42.paloaltonetworks.com/microsoft-teams-phishing/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Identity](https://unit42.paloaltonetworks.com/tag/identity/ "identity") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/microsoft-teams-phishing/ "When “Hi, This Is IT” Comes Through Microsoft Teams") ![Pictorial representation of a woman standing in a server room holding a laptop that projects a digital code overlay.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 28, 2026 [#### 2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/) * [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius") * [Fighting Ursa](https://unit42.paloaltonetworks.com/tag/fighting-ursa/ "Fighting Ursa") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface") ![Pictoral representation of a man holding a cellphone with a bokeh skyline in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Listicle_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 27, 2026 [#### Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "Out of the Crypt: The Evolving Cyber Extortion Economy") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)