Threat Vector by Palo Alto Networks Unit 42's Iran Threat Brief: What We're Seeing
Mar 4, 2026
Andy Piazza, Senior Director of Threat Intelligence with 20+ years in ops, and Justin Moore, Senior Manager with intelligence and rapid‑response experience, walk through Unit 42’s Iran threat brief. They discuss active hacktivist groups and which claims are unverified. They explain how Iran’s outages shift activity worldwide. They highlight dispersed operators, TTPs to watch, and immediate defensive priorities.
AI Snips
Chapters
Transcript
Episode notes
Internet Outage Shifts Attack Origins
- Iran's near-total internet outage shifted most observed cyber activity to operators outside the country.
- Justin Moore explains globally dispersed pro-activists and regionally forward-deployed operators are carrying the retaliation while Iran's domestic connectivity is down.
Operational Isolation Increases Unpredictability
- Operational isolation inside Iran likely forces state-aligned units to act autonomously and unpredictably.
- Andy Piazza notes forward-deployed units may operate outside normal intelligence collection patterns during kinetic conflict.
Rapid Naming Over Formal Attribution In Chaos
- Unit 42 uses rapid naming of activist groups rather than full attribution during fast-moving events.
- Andy Piazza explains they track self-named handles and chat groups while categorizing claims into DDoS, defacement, or hack-and-leak.