How US Cyber Ops May Have Assisted the Midnight Hammer Strike

The United States likely combined a series of cyber operations with conventional force tactics to successfully carry out its “Midnight Hammer” strike on three Iranian nuclear sites, as cyber defense and national security analysts say military powers rely more on digital efforts to support physical attacks.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Joint Chiefs Chairman Gen. Dan “Razin” Caine detailed a “highly classified operation” Sunday at the Pentagon, saying the strike involved support from U.S. Cyber Command and multiple other combat commands, including U.S. Strategic Command, U.S. Space Command and the Space Force. The military used deception tactics such as decoy jets and relied on minimal communications to inflict what Caine called “extremely severe damage and destruction” on three Iranian nuclear sites.

“Throughout the mission, we maintained the element of surprise,” he said.

Major military powers often pair major military operations such as Midnight Hammer with cyber operations such as malware, wiperware and distributed denial-of-service attacks to disrupt enemy communications and infrastructure – particularly in the moments surrounding kinetic strikes, analysts tell Information Security Media Group. Russia used similar tactics in Ukraine, including a hack on satellite provider ViaSat to blind defenses hours before its invasion.

The Department of Defense has steadily ramped up its integration of cyber capabilities into joint operations planning in recent years, increasingly embedding cyber mission forces within combatant commands alongside traditional kinetic units. Experts said that continued integration helped the U.S. strike the three nuclear targets seemingly undetected in one of the longest missions for B-2 bombers in history.

“Cyber operations generally take place pre-emptively or alongside a kinetic military strike to maximize surprise and reduce the possibility of an immediate retaliation,” Taylar Rajic, associate fellow at the Center for Strategic and International Studies’ strategic technologies program, told ISMG. “Offensive cyber capabilities can work as a strong signal of deterrence and show the range of capabilities beyond kinetic operations that an actor possesses.”

U.S. Cyber Command and the Defense Department did not respond to multiple requests for comment about the role cyber units played in Midnight Hammer, and it remains unclear what specific actions they took as part of the operation. But by embedding cyber teams across combatant commands, Rajic said the Pentagon helped ensure “that cyber options are available to commanders in the same way that air or artillery support is.”

A former Defense cybersecurity official who spoke to ISMG on condition of anonymity said U.S. Cyber Command may have helped ensure aircraft involved in the mission across various DOD commands operated securely, with communications protected and emergency failsafes in place. The source also said Cyber Command likely monitored and possibly disrupted Iranian air defense systems, though they noted they do not have direct knowledge of Midnight Hammer’s specific operations.

Security experts have reported significant increases in online attacks tied to the Israel-Iran conflict shortly after Israel began striking military and nuclear targets in Iran on June 13 (see: Israel-Iran War: Hacktivist Groups’ Claimed Activity Surges). But those cyberattacks don’t always result in major setbacks for U.S. and Israeli forces, cyber defenses and critical infrastructure.

Tom Pace, CEO of NetRise and former head of cyber for the Department of Energy, said CISOs for major technology firms, software providers and other critical sectors are stepping up defenses in anticipation of possible Iranian cyber retaliation by locking down access, confirming backup integrity and tracking threat patterns linked to Iranian groups like APT33 and APT34. He said ongoing coordination with information sharing and analysis centers and federal agencies is critical to keep up with fast-evolving threats.

“Iran is going to be targeting low-hanging fruit vulnerabilities that they know they can exploit,” Pace said, pointing to outdated SOHO routers and infrastructure as likely targets for building moderate-scale botnets. He added that while these targets may hold little strategic value, “Iran needs to have a response that provides the illusion that they are a competent actor on the world stage.”