Threats & Adversaries

Iran-aligned actors ramp up phishing and disruption

Unit 42 observed a surge in Iranian-aligned phishing, DDoS and hack-and-leak operations following Feb. 28 U.S.–Israel strikes.

1 source · Mar 3

Timeline

Mar 3 Reported by Unit 42

Sources

Mar 3 Unit 42
Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)
Unit 42 details recent Iranian cyberattack activity, sharing direct observations of phishing, hacktivist activity and cybercrime.
original

Part of the PlainSec briefing for 2026-03-27

Every edition of this story: Iran-aligned actors ramp up phishing and disruption

More from today

Threats & AdversariesIran-aligned actors ramp up phishing and disruptionUnit 42 observed a surge in Iranian-aligned phishing, DDoS and hack-and-leak operations following Feb. 28 U.S.–Israel strikes.1 source · Mar 3Timeline

Mar 3 Reported by Unit 42

Sources

Mar 3 Unit 42

Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)

Unit 42 details recent Iranian cyberattack activity, sharing direct observations of phishing, hacktivist activity and cybercrime.

Part of the PlainSec briefing for 2026-03-27Every edition of this story: Iran-aligned actors ramp up phishing and disruptionMore from today

TeamPCP injects credential-stealer into LiteLLM package

China‑linked Red Menshen embeds stealthy implants in telecom cores

All Checkmarx action tags overwritten in TeamPCP supply-chain compromise