[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [German](https://unit42.paloaltonetworks.com/de/iranian-cyberattacks-2025/) * [English](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2025/) * [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/iranian-cyberattacks-2025/) * [French](https://unit42.paloaltonetworks.com/fr/iranian-cyberattacks-2025/) * [Japanese](https://unit42.paloaltonetworks.com/ja/iranian-cyberattacks-2025/) * [Korean](https://unit42.paloaltonetworks.com/ko/iranian-cyberattacks-2025/) * [Portuguese](https://unit42.paloaltonetworks.com/pt-br/iranian-cyberattacks-2025/) * [Chinese (Traditional)](https://unit42.paloaltonetworks.com/zh-hant/iranian-cyberattacks-2025/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/ "High Profile Threats") * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/ "Cybercrime") [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) # Threat Brief: Escalation of Cyber Risk Related to Iran (Updated June 30) ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 6 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Cloud](https://unit42.paloaltonetworks.com/product-category/cortex-cloud/ "Cortex Cloud")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Unit 42](https://unit42.paloaltonetworks.com/author/unit42/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:June 25, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Hacktivism](https://unit42.paloaltonetworks.com/category/hacktivism/) * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/) * [Agonizing Serpens](https://unit42.paloaltonetworks.com/tag/agonizing-serpens/) * [Boggy Serpens](https://unit42.paloaltonetworks.com/tag/boggy-serpens/) * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/) * [DDoS attacks](https://unit42.paloaltonetworks.com/tag/ddos-attacks/) * [Devious Serpens](https://unit42.paloaltonetworks.com/tag/devious-serpens/) * [Evasive Serpens](https://unit42.paloaltonetworks.com/tag/evasive-serpens/) * [GenAI](https://unit42.paloaltonetworks.com/tag/genai/) * [Iran](https://unit42.paloaltonetworks.com/tag/iran/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2025/?pdf=download&lg=en&_wpnonce=1628116e08 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2025/?pdf=print&lg=en&_wpnonce=1628116e08 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)]( "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Firanian-cyberattacks-2025%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)]( "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)]( "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Firanian-cyberattacks-2025%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)]( "Share in Mastodon") ## Executive Summary Unit 42 stopped monitoring this threat and updating the brief on Aug. 14, 2025. The recent conflict involving Iran, particularly its military engagements with Israel and the U.S., significantly heightens the risk of cyber spillover. This extends traditional battlegrounds into the digital realm. While we have not yet seen a dramatic uptick in Iranian-directed cyberattacks, further escalations could manifest as a surge in cyber operations by both state-sponsored groups and independent hacktivists. Their aim would be to disrupt, collect intelligence on or influence perceived adversaries. Iranian threat groups have a history of targeting critical infrastructure and sensitive industries across public and private enterprises globally and these attacks can have far-reaching consequences. Over the past two years, Unit 42 has observed Iranian-backed groups and hacktivists expanding their global cyber operations, including employing the following activities: * Opportunistically leveraging generative AI (GenAI) for social engineering and influence operations * Explicitly linking destructive attacks to geopolitical events These are in addition to activities these groups have historically been known for. It is possible these activities could further intensify in the context of recent events involving Israel and the U.S. These activities include: * Destructive attacks * Website defacements * Distributed-denial-of-service (DDoS) attacks * Data exfiltration and wiper attacks, reminiscent of [those we previously observed](https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/) from Iranian groups targeting the Israeli education and technology sectors We track threat activity across the globe, with Iran as one of four major nation-state actors we monitor, alongside China, Russia and North Korea. The primary objectives of [Iranian nation-state actors](#post-144269-_ami3q1ldy3z1) frequently include espionage and disruption. These groups employ a variety of tactics, techniques and procedures (TTPs), including targeted spear-phishing campaigns and the exploitation of known vulnerabilities. Specific observations include: * **Covert infrastructure for espionage:** A [recent case identified by Unit 42](https://unit42.paloaltonetworks.com/iranian-attackers-impersonate-model-agency/) revealed suspected covert Iranian infrastructure impersonating a German modeling agency to conduct cyberespionage. These operations deploy fake websites to collect extensive visitor data, suggesting strategic intelligence-gathering objectives. * **AI-enhanced social engineering:** [We recently observed](https://www.linkedin.com/posts/unit42_agentserpens-charmingkitten-powerless-activity-7337886288001363969-J_bY?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAA3mP0BdWCaedDmG9Z6SqRL_0leLGPtlf4) an Iranian threat group (Agent Serpens, aka CharmingKitten) using GenAI in a malicious PDF, which it masked as a document from the U.S. non-profit research organization RAND. The group deployed this PDF alongside targeted malware. * **Persistent destructive operations:** The Iranian-backed Agonizing Serpens APT group [targeted the Israeli education and technology sectors](https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/) from January-October 2023, aiming to steal sensitive data like personally identifiable information (PII) and intellectual property. In these attacks, it also deployed wipers to destroy systems and hinder forensic analysis. In the context of the ongoing geopolitical situation with Iran, we've identified four key areas of potential cyberthreat activity: * **Iranian nation-state threat actors:** In the near term, Iranian nation-state hackers are likely to leverage targeted attacks, from spear phishing emails aimed at diplomats to destructive wiper malware targeting organizations with ties to U.S. interests. * **Hacktivists:** It is likely that hacktivists supporting Iran will continue to conduct disruptive attacks and influence operations targeting U.S.-based interests both domestically and abroad. This includes DDoS attacks to disrupt internet access and influence operations on social media platforms. * **Cybercriminal groups:** These groups could opportunistically exploit global uncertainty to launch phishing campaigns, leveraging world events as a theme for malicious emails and attachments. * **Other nation-state actors:** There is a potential for other nation-state threat actors to use events to further their interests. These attacks could include false-flag operations where actors from somewhere other than Iran disguise their attacks to appear as if they originated from Iran. This was seen when Russia [previously hijacked Iran's cyber infrastructure in 2019](https://www.ncsc.gov.uk/news/turla-group-exploits-iran-apt-to-expand-coverage-of-victims) to piggyback into networks already compromised by Iranian actors. Palo Alto Networks customers can receive protections from and mitigations for this threat actor activity through the following products: * Next-Generation Firewalls with [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR), [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) and [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) The [Unit 42 Incident Response](https://start.paloaltonetworks.com/contact-unit42.html) team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk. | **Threat Groups Discussed** | **[Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens)** (aka APT42), [**Agonizing Serpens**](https://unit42.paloaltonetworks.com/tag/agonizing-serpens) (aka Pink Sandstorm), [**Boggy Serpens**](https://unit42.paloaltonetworks.com/tag/boggy-serpens) (aka MuddyWater), [**Curious Serpens**](https://unit42.paloaltonetworks.com/tag/curious-serpens) (aka Peach Sandstorm), **[Devious Serpens](https://unit42.paloaltonetworks.com/tag/devious-serpens)** (aka Imperial Kitten), **[Evasive Serpens](https://unit42.paloaltonetworks.com/tag/evasive-serpens), Industrial Serpens** | |-----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ## Current Scope of Cyberattacks Unit 42 tracks various Iranian state-sponsored actors under the constellation name *Serpens*. These groups could increase or escalate activity in the upcoming weeks. State-sponsored Iranian cyber capabilities are often used to project and amplify political messaging (often using destructive and psychological tactics). These efforts are likely to focus on regional targets (e.g., Israel) as well as what they deem high-value targets (e.g., politicians, key decision-makers and other directly involved entities). State-sponsored campaigns might target their victim's supply-chains, critical infrastructure, vendors or providers. The majority of the already-reported cyberattacks related to this event are intentionally disruptive denial-of-service (DoS) attacks. Third-party attackers such as hacktivists and proxy actors typically support one side or the other, aiming to negatively impact and influence the opposing side. As of June 22, 2025, [120 hacktivist groups](https://x.com/Cyberknow20/status/1936763837623202176) are reportedly active in response to these events. Other public reports indicate that both cybercriminal groups and state-supported proxy groups are also active. DDoS appears to be the most-reported attack method, followed by destructive attacks. Samples of destructive malware like data wipers related to these events have been observed by researchers. Destructive attacks also include destroying $90 million of funds in a June 2025 [crypto exchange breach](https://www.cnbc.com/2025/06/18/pro-israel-hackers-iran-crypto.html). Other [data breaches](https://www.mako.co.il/news-money/2025_q2/Article-2ee8f6375889791026.htm) and associated [data leaks](https://t.me/tapandegan_official/754) are intended to damage either side. Reports also indicate the [targeting of operational technology (OT)](https://www.hindustantimes.com/world-news/iranian-hackers-hijacking-home-security-cameras-to-spy-within-israel-101750396147899.html). These two are sometimes related, because data breaches of energy and other utility companies have also been reported in direct relation to these events. ## Iranian Threat Groups Tracked by Unit 42 * [Agent Serpens](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/#section6SubHeading2) (aka APT42) * An espionage and surveillance group focusing on Israel and the U.S., targeting dissidents, activists, journalists and other groups that are deemed to pose a risk or which protests against the Iranian government * **Initial access:** Primarily spear phishing, including credential harvesting with fake login pages, also watering hole attacks * [Agonizing Serpens](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/#section6SubHeading3) (aka Pink Sandstorm) * This group engages in espionage, ransomware and destructive malware attacks against targets in the Middle East, with a significant focus on attacks against Israel. * **Initial access:** Password attacks (e.g., brute force, password sprays) as well as exploitation of known vulnerabilities (followed by deployment of web shells) * [Boggy Serpens](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/#section6SubHeading4) (aka MuddyWater) * A cyberespionage group that provides stolen data and access to the Iranian government as well as other threat actors * **Initial access:** Spear phishing and exploitation of known vulnerabilities * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/) (aka Peach Sandstorm) * Espionage group active since 2013 targeting the aerospace, defense and energy sectors in the U.S., Middle East and Europe. The group has leveraged cloud infrastructure including Azure for C2. * **Initial access:** Broadly targeted password spray attacks or job recruitment based social engineering campaigns to deliver custom malware, including the [Falsefont](https://unit42.paloaltonetworks.com/curious-serpens-falsefont-backdoor/) or [Tickler](https://www.microsoft.com/en-us/security/blog/2024/08/28/peach-sandstorm-deploys-new-custom-tickler-malware-in-long-running-intelligence-gathering-operations/) backdoors. Once inside, the group is [known for](https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/) conducting discovery activities with tools including AzureHound and Roadtools to collect and dump data from Microsoft Entra ID. * [Devious Serpens](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/#section6SubHeading5) (aka Imperial Kitten) * An espionage group known for targeting IT providers in the Middle East as part of supply chain campaigns * **Initial access:** Social engineering through social media, credential spear phishing and watering-hole attacks, deploying web shells * [Evasive Serpens](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/#section6SubHeading6) (aka APT34) * A prolific espionage group known for broad targeting that aligns with nation-state interests * **Initial access:** Relies heavily on spear phishing, though it has also been associated with other more complex attacks such as credential harvesting campaigns and DNS hijacking * Industrial Serpens (aka Chrono Kitten) * An Iranian-proxy group associated with disruptive attacks (e.g., ransomware, wiper malware, hack-and-leak attacks) that align with state interests * **Initial access:** Social engineering to distribute Android spyware hosted on spoofed websites, password attacks (e.g. brute force, password sprays) and exploitation of known vulnerabilities ## Conclusion Given the variety of tactics that threat actors are using, a multi-layered defense is most effective as no single tool can provide complete protection against these adaptable threats. We recommend focusing on foundational security hygiene, a proven approach that provides resilient protection against a wide range of tactics. We recommend taking the following precautions to help mitigate impact from possible attacks. ### Tactical Recommendations * Increase response to any threat signals where possible, especially those associated with internet-facing assets such as websites, virtual private network (VPN) gateways and cloud assets * Ensure internet-facing infrastructure is up to date with security patches and other hardening best practices * Train employees on phishing and social engineering tactics and continuously monitor for suspicious activity * On June 30, CISA, the FBI, DoD Cyber Crime Center and NSA published a joint fact sheet, "[Iranian Cyber Actors May Target Vulnerable US Networks and Entities of Interest](https://www.cisa.gov/resources-tools/resources/iranian-cyber-actors-may-target-vulnerable-us-networks-and-entities-interest)," urging organizations to remain vigilant against potential targeted cyber operations by Iranian state-sponsored or affiliated threat actors. ### Strategic Recommendations * Begin or update business continuity plans for any staff or assets that digital or physical attacks could disrupt * Prepare to validate and respond to claims of breaches or data leaks * Threat actors might use claims (even if they're untrue) to embarrass or harass victims, or to disseminate political narratives As activity is likely to continue to be intensified throughout the duration of these events, it's important to remain vigilant to potential attacks. Hacktivists and state-supported threat actors have been opportunistic, leading to potentially unexpected sources being targeted. We will update this threat brief as more relevant information becomes available. ## How Palo Alto Networks and Unit 42 Can Help Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against threats related to aspects of these events. If you think you might have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 ### Next-Generation Firewalls and Prisma Access With Advanced Threat Prevention [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) has an inbuilt machine learning-based detection that can detect exploits in real time. ### Cortex [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR), [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) and [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) are designed to prevent the execution of known malicious malware. It is also designed to prevent the execution of unknown malware and other malicious activities using Behavioral Threat Protection and machine learning based on the Local Analysis module. *Updated June 26, 2025, at 1:34 p.m. PT to add entry on Curious Serpens to section on Iran-based threat groups tracked by Unit 42.* *Updated June 30, 2025, at 1:20 p.m. PT to update Tactical Recommendations section.* Back to top ### Tags * [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens") * [Agonizing Serpens](https://unit42.paloaltonetworks.com/tag/agonizing-serpens/ "Agonizing Serpens") * [Boggy Serpens](https://unit42.paloaltonetworks.com/tag/boggy-serpens/ "Boggy Serpens") * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/ "Curious Serpens") * [DDoS attacks](https://unit42.paloaltonetworks.com/tag/ddos-attacks/ "DDoS attacks") * [Devious Serpens](https://unit42.paloaltonetworks.com/tag/devious-serpens/ "Devious Serpens") * [Evasive Serpens](https://unit42.paloaltonetworks.com/tag/evasive-serpens/ "Evasive Serpens") * [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI") * [Iran](https://unit42.paloaltonetworks.com/tag/iran/ "Iran") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector](https://unit42.paloaltonetworks.com/cybercriminals-attack-financial-sector-across-africa/ "Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector") ### Table of Contents * ### Related Articles * [Tracking Iranian APT Screening Serpens' 2026 Espionage Campaigns](https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/ "article - table of contents") * [Paved With Intent: ROADtools and Nation-State Tactics in the Cloud](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/ "article - table of contents") * [That AI Extension Helping You Write Emails? It's Reading Them First](https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/ "article - table of contents") ## Related Resources ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)