Daily Briefing for 03.18.26

Top stories.

• Iran's decentralized cyber operations continue despite strikes on leadership.
• Researchers explore an exposed Fancy Bear server.
• Business news: Three Israeli AI firms emerge from stealth with significant funding.

Iran's decentralized cyber operations continue despite strikes on leadership.

US and Israeli strikes on Iran's Ministry of Intelligence and Security (MOIS) reportedly killed two individuals tied to state-backed cyber operations, but activity from affiliated hacking groups continues, Forbes notes. Among those killed were Mohammad Mehdi Farhadi Ramin, charged by the Justice Department in 2020 for hacking US aerospace and defense firms, and Seyed Yahya Hosseiny Panjaki, an intelligence official linked by the FBI to cyberattacks and terror plots. Panjaki reportedly headed the MOIS unit that handled state-affiliated hacktivist groups, including Handala.

Iranian cyberattacks have continued, however, due to the decentralized nature of Iran's cyber capabilities. Handala has since claimed responsibility for a major attack on US medtech firm Stryker, and another MOIS-backed group disrupted Albania's parliament this past Sunday. Western organizations and allies should be prepared for sustained cyber risk amid the ongoing kinetic conflict.

Researchers explore an exposed Fancy Bear server.

Researchers at Ctrl-Alt-Intel have published an analysis of an exposed open directory on a server attributed to Russia's APT28 (also known as "Fancy Bear"). The server was discovered by researchers at Hunt.io in January, who published a report on a separate directory on the server. Hunt.io attributed the server to Fancy Bear based on TTPs outlined by ESET. Fancy Bear is a state-sponsored threat actor widely attributed to Russia's General Staff Main Intelligence Directorate (GRU).

The directory examined by Ctrl-Alt-Intel contained data stolen from "government and military entities across Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia," including more than 2,800 emails, hundreds of sets of credentials, and more than 11,000 harvested contact email addresses. The primary target was a Roundcube webmail instance belonging to Ukraine's State Migration Service (DMSU).

Business news: Three Israeli AI firms emerge from stealth with significant funding.

Israel-founded agentic AI security firm Surf AI has emerged from stealth with $57 million in funding led by Accel, with participation from existing investors Cyberstarts and Boldstart Ventures. The company says the funding "will support continued investment in product development, team expansion, and scaling for additional enterprise adoption."

Israeli AI-assisted endpoint security Bold Security has emerged from stealth with $40 million in funding from Bessemer Venture Partners, Picture Capital, and Red Dot Capital Partners. The company stated, "We're already deployed with great US enterprises, including Shutterfly, Spencer Stuart, and Tekion, and many others. With this funding, we're accelerating go-to-market and continuing to push the edge AI platform forward."

Agentic AI governance startup Onyx Security, also based in Israel, has launched with $40 million in funding from Conviction and Cyberstart. The company says the funding "will be used for expanding product and engineering teams, developing new AI models, and scaling go-to-market efforts to meet increasing demand for a secure AI control plane."

Read more in the Business Briefing at 4pm ET.