Security Check-in Quick Hits: Iranian Escalations, AI-Powered Attacks, Network Vulnerabilities, Healthcare Breaches, and Ransomware Trends

For March 2, 2026

Iranian Cyber Threats Heat Up Amid Geopolitical Tensions

In the shadow of escalating U.S.-Israel-Iran conflicts, Iranian state-sponsored hackers are ramping up operations against critical infrastructure worldwide. Recent reports highlight IRGC-linked groups like APT33 and APT35 probing operational technology (OT) and industrial control systems (ICS), including SCADA networks in power grids and ports. This comes amid a claimed leadership vacuum following reports of Khamenei’s status, potentially unleashing rogue cyber cells that are harder to predict or deter.

CISA has issued its highest-level emergency advisory, warning of imminent attacks on U.S. critical sectors. However, with CISA operating at just 38% capacity—no permanent director and most staff furloughed—the U.S. cyber defense posture is alarmingly vulnerable. Additionally, Iranian apps and websites have faced defacement and connectivity disruptions following strikes, raising fears of retaliatory cyberattacks. Hacktivist claims linked to Iran’s MOIS have targeted Jordan, blurring lines between propaganda and genuine intrusions.

These developments underscore a “danger window” in the next 72 hours, with the UK shifting to full wartime cyber defense mode. Organizations should prioritize threat hunting, patch management, and monitoring for indicators of compromise (IoCs) from groups like Hezbollah’s cyber units. As geopolitical tensions boil, proactive resilience is key to mitigating what could evolve into widespread disruptions.

AI-Driven Cyberattacks: The New Frontier of Speed and Sophistication

Artificial intelligence is transforming cyber threats, enabling low-skill attackers to execute breaches at unprecedented speeds. Recent incidents show AI-driven attacks compromising systems in as little as 72 minutes, with generative AI tools like GitHub Copilot vulnerable to prompt injection attacks that could expose entire code repositories.

Weekly threat recaps reveal rising risks from agentic AI in security operations centers (SOCs), including AI-augmented malware like SURXRAT, which downloads large language model (LLM) modules from platforms like Hugging Face. Vulnerabilities in tools like OpenClaw allow malicious sites to hijack AI agents via brute-force attacks, expanding the browser-to-endpoint threat surface. Supply-chain abuses, such as typosquatting in npm packages (e.g., StegaBin using Pastebin steganography for RAT delivery) and malicious Go modules, further amplify AI’s role in espionage and data theft.

State actors like Lazarus are blending AI with ransomware, targeting healthcare, while APT36 and MuddyWater leverage AI in multi-vector campaigns. To counter this, security teams must adopt AI for defense—automating triage and detection—while securing AI tools against exploitation. The era of AI-powered cyber warfare demands vigilance; ignoring it could lead to catastrophic breaches.

Critical Vulnerabilities Exposed in Network Devices

Network infrastructure remains a prime target, with recent disclosures highlighting severe flaws in key devices. CISA has updated indicators for detecting dormant RESURGE malware on Ivanti Connect Secure appliances, aiding in edge hunting and remediation efforts. Meanwhile, Juniper has flagged a critical vulnerability in its PTX Series routers, enabling full device takeover and necessitating rapid patching and control-plane forensics.

These issues compound broader OT/edge security risks, where IT-originated attacks linger with long dwell times. A newly modified CVE-2026-2634 (CVSS 9.8) allows malicious scripts to desynchronize the address bar from web content, potentially leading to phishing or spoofing attacks.

Admins should implement edge detection, update IoCs, and conduct vulnerability scans immediately. As attackers exploit these gaps—often via supply-chain vectors—the focus must shift to resilient architectures. Delaying patches could invite widespread network compromises, disrupting operations across sectors.

Major Data Breaches Hit Healthcare and Critical Sectors

Data breaches continue to plague sensitive sectors, with the University of Hawaiʻi Cancer Center falling victim to ransomware that exposed Social Security numbers of up to 1.15 million individuals. This incident requires a dual response: maintaining clinical continuity while addressing identity theft risks.

In Singapore, a dark web data leak has led to targeting of nearly 255 organizations linked to Critical Information Infrastructure (CII), sparking fresh concerns over national security. These events align with broader trends, including phishing kits like 1Phish for MFA-aware credential capture and ShinyHunters’ subdomain impersonation for SaaS theft.

Breaches often stem from supply-chain weaknesses, as seen in Lazarus’s healthcare-targeted ransomware. Victims should notify affected parties, offer credit monitoring, and enhance access controls. As data becomes the new oil, robust encryption and zero-trust models are essential to prevent escalation into larger crises.

Ransomware and Supply Chain Attacks on the Rise

Ransomware payments are declining overall, but median sizes are increasing, signaling a polarization in extortion tactics amid rising attacks. Groups like LockBit exploit vulnerabilities such as ActiveMQ RCE, while BlackByte tools aid defensive emulation.

Supply-chain abuses dominate, from malicious NuGet packages stealing API tokens to developer-targeted campaigns via Next.js repos. A stark reminder is the “largest tech outage in history” caused by a CrowdStrike software update, crippling global services and exposing critical infrastructure vulnerabilities.

DDoS campaigns, like those from DDOSIA and NoName057, target Israel, Germany, and sectors like telecom and municipal services. To combat this, organizations need layered defenses, regular backups, and supply-chain vetting. The evolving landscape demands agility—ransomware isn’t just a payout; it’s a systemic threat requiring collective action.