What is the latest Iranian cyber threat evolution?

Iranian actors shifted from wiper malware like Shamoon to LotL techniques, abusing admin identities in MDM systems to wipe devices undetected.

How did Iranian hackers wipe 200,000 devices without malware?

By compromising privileged accounts and issuing legitimate remote-wipe commands via enterprise MDM platforms, evading traditional EDR.

Are companies safe from Iranian APTs like Void Manticore?

No—focus on MDM hardening, zero-trust for admins, and behavioral monitoring to counter identity weaponization.

🛡️ Security Tools

Iran's Hackers Swap Wipers for Identity Strikes

Forget the old disk-wipers; Iran's cyber crews are now hijacking your own admin tools to nuke devices. This sneaky pivot changes everything for global targets.

Threat Digest Apr 03, 2026 3 min read 10 views

Timeline graphic showing Iranian cyber evolution from Shamoon wipers to identity-based wipes

⚡ Key Takeaways

Iran shifted from noisy wipers (Shamoon) to stealthy LotL admin abuse for better evasion and scale. 𝕏
MDM platforms are now prime attack vectors—treat them as weapons, not tools. 𝕏
This evolution enables global disruption without custom malware, demanding new defenses. 𝕏

Published by

Threat Digest

Threat intelligence. Zero noise.

#IRGC hackers #Iranian APTs #Iranian cyber threats #MDM attacks #Void Manticore #identity abuse #living off the land #wiper malware

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by Palo Alto Unit 42

⚡ Key Takeaways

The 60-Second TL;DR

Threat Digest

Share this article

Worth sharing?

Related Stories

84% of Attacks Hijack Your Own Tools – And You're Still Blind

Iran's 27-Day Blackout Fuels Global Phishing Frenzy and Wiper Warnings

Iranian Hackers Erase Stryker's Digital Lifeline: Medtech's Nightmare Begins

CanisterWorm: Cybercrooks Hijack Iran Tensions for Cloud Data Heists

Stay in the loop