Unit 42's Iran Threat Brief: What We're Seeing [Threat Vector]
CyberWire Daily
State-aligned units acting independently
Justin and Andy discuss how operational isolation and leadership changes can alter Iranian units' behavior and objectives.
Unit 42 is tracking more than 60 active hacktivist groups and Iran-linked threat actors right now. What are they actually doing, what should you believe, and what should you do about it?
In this episode of Threat Vector, David Moulton sits down with Justin Moore, Senior Manager of Threat Intelligence Research at Unit 42, and Andy Piazza, Senior Director of Threat Intelligence at Unit 42, to walk through the Unit 42 Iran Threat Brief and what the observed activity means for defenders.
You'll learn:
- What Unit 42 is actually observing from groups like Handala Hack, FAD Team, and Dark Storm, and what claims remain unverified
- Why Iran's reduced internet connectivity changes the threat picture in ways that aren't obvious
- What dispersed operators and proxy groups mean for organizations far outside the Middle East
- Which defensive actions matter most against the TTPs and IOCs Unit 42 has documented
- How to handle hacktivist claims that may be exaggerated or false
Justin Moore brings nine years of intelligence officer experience plus senior threat intel roles at Mandiant, Google, and TikTok before joining Unit 42. Andy Piazza has more than 20 years in security operations and threat intelligence, including leading IBM X-Force's global threat intel team.
Read the threat brief from Unit 42:
- Escalation of Cyber Risk Related to Iran (March 2026)
- Escalation of Cyber Risk Related to Iran (June 2025)
This episode is essential listening if you're: a CISO assessing current exposure, a threat analyst tracking Iran-linked groups, or a security leader who needs to explain the actual observed risk to your board.
Related Episodes:
- Inside the Mind of State-Sponsored Cyberattackers
- From Policy to Cyber Interference
#Cybersecurity #ThreatIntelligence
About Threat Vector
Threat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
Learn more about your ad choices. Visit megaphone.fm/adchoices
The AI-powered Podcast Player
