Cyberattacks and Unpredictable Targeting Remain an Iran Risk

Cyberattacks launched by Iranian nation-state hackers in reprisal for what the United States has codenamed Operation Epic Fury so far have been evident mainly in their absence. Whether the regime’s military or intelligence forces have the inclination or ability to launch such attacks isn’t clear.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

The country continues to operate in a near-total internet blackout initiated for reasons unknown at the start of hostilities by the United States and Israel on Feb. 28, monitoring firm Netblocks reported early Friday.

Government officials, industry bodies and experts continue to urge preparedness and vigilance (see: Iranian Cyber Proxies Active But Not Nation-State Hackers).

As on the ground in military operations, as in cyberspace, as well: The full extent of adversarial activity is not clear. Threat intel produced by Broadcom-owned firms warned Thursday that the Iranian nation-state hacking group commonly tracked as MuddyWater continues to be active even after the U.S. and Israeli bombing campaign began. “A U.S. bank, software company and airport, and non-governmental organizations in both the U.S. and Canada, have experienced suspicious activity on their networks in recent days and weeks,” said Symantec and Carbon Black.

But a researcher at threat intelligence firm Ctrl-Alt-Intel told Information Security Media Group on Tuesday that they infiltrated infrastructure that appears to be operated by MuddyWater, and found that users stopped using it shortly before the war’s onset.

Tehran and its proxies pose an unpredictable and “hybrid threat” to Western officials and organizations, comprising the potential for real-world attacks or destruction and cyberattacks potentially targeting everything from industrial control systems to sensitive corporate data, to senior executives, said Paul Abbate, a senior managing director in FTI Consulting’s national security group.

Combating that “requires 24/7 focus, literally all the time, to be in the best position to stop potentially bad things from happening – whether it’s in the physical world or the cyber world – to employees, to company reputation, to facilities, to your networks, systems and data,” Abbate told Information Security Media Group. He served as the FBI’s deputy director from 2021 until 2025.

The threat of distributed-denial-of-service attacks, intrusions, ransomware or destructive online attacks launched by Tehran or aligned threat actors is elevated, and organizations with sub-standard cybersecurity defenses are among those most at risk, experts warn (see: Iran Conflict Elevates Cyber Risk for Healthcare).

“Iranian hackers have in the past successfully compromised critical components of essential services because utilities misconfigured systems, did not change default passwords or failed to install software patches to fix known vulnerabilities,” says a Wednesday research note from the Washington-based Foundation for Defense of Democracies.

Where “bad actors” are concerned, “history tells us that whether it’s real-world terrorist attacks or cyberattacks, they’re going to find those vulnerabilities, and they’re going to take the easiest route possible to get there,” Abbate said.

Iran’s use of cyberspace to augment drone and missile attacks against military bases in neighboring countries appears to be limited, perhaps comprised only of helping to collect battlefield intelligence. Earlier this week, Check Point Research reported signs that Iranian hackers have been accessing IP cameras to facilitate targeting as well as ongoing “battle damage assessment” (see: US Says Cyber Operations Underpinned Assault on Iran).

Hacktivists and proxy groups have engaged in aggressive online signaling, announcing who they plan or claim to have disrupted, defaced or hit with a hack-and-leak attacks.

A “massive cyber campaign” badged as “#OpIsrael” has intensified, “involving pro-Russian and pro-Iranian actors, has targeted Israeli industrial control systems and government portals across Kuwait, Jordan and Bahrain,” reported threat intelligence firm Flashpoint on Thursday. Groups involved include Fatemiyoun Electronic Team, Cyber Islamic Resistance (Team 313), the pro-Russian NoName057(16), as well as Handala Group.

Handala draws its name from a cartoon Palestinian boy and emerged in 2023 with pro-Palestinian messaging. But it appears to be a “faketivist” group run by a threat actor linked to Iran’s Ministry of Intelligence, specializing in deniable operations, reported threat intelligence service FalconFeeds.

“Rather than chasing zero-days, the actor excels at psychological impact: high-visibility breaches, theatrical claims and timed leaks that turn stolen data into strategic messaging,” it said. How many such operations are being run from outside Iran isn’t clear.

The hacktivist takeaway so far is of noise trumping veracity. “To date, most of the claims of successful hacks are likely false or overblown,” the Foundation for Defense of Democracies said.