Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization
Summary: Unit 42 reports that Iranian threat actors operating as Void Manticore (Handala) compromised highly privileged identities and pushed legitimate remote-wipe commands to over 200,000 devices worldwide, without deploying custom wiper malware. The report traces a shift since 2023 from bespoke disk-wiping tools used by groups like Curious Serpens (APT33) and Evasive Serpens (APT34) toward living-off-the-land abuse of enterprise management tools, including mobile device management platforms that bypass endpoint detection and response telemetry.
Bottom line: More than 200,000 devices were wiped through legitimate administrative commands, meaning the management plane itself is now the attack surface, and an organization's infrastructure is only as strong as its weakest administrative credential.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026