Unit 42: Iranian Cyber Actors Expanding From Espionage to Destructive Operations Against US Targets

Palo Alto's Unit 42 reports that Iranian threat actors—historically focused on espionage and data theft—are pivoting to destructive and disruptive operations against U.S. entities. The Handala Hack group's wiper attack on Stryker Corporation and coordinated death threats against dissidents represent a qualitative escalation in MOIS cyber doctrine, aligning offensive cyber with the kinetic war. FBI Director Patel's SSCI testimony confirmed a 'substantial increase' in Iranian spy actors targeting Americans.