Iranian Cyber Proxies Active But Not Nation-State Hackers

Iranian cyber proxies are girding for revenge while nation-state hackers in Tehran have gone quiet, whether to shelter from an onslaught of missile attacks or because the Middle Eastern country remains disconnected from the global internet on the third day of a U.S. and Israeli bombing campaign.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

Telemetry shows Iran went dark roughly at the moment the United States and Israel initiated war against Tehran – whether due to a cyberattack or as a preemptive internet blackout, as the Iranian government has done as recently as earlier this year during large-scale street protests.

As of Monday morning, cybersecurity firm CrowdStrike reported seeing no major state-sponsored cyber operations originating from Iran, although numerous pro-Tehran groups are posturing online.

“At this stage, much of the activity being publicized appears to be claim-driven rather than evidence-backed,” said Adam Meyers, CrowdStrike’s head of counter adversary operations.

“Counter to what some cyber vendors are saying, there’s been a dramatic drop in Iranian cyber operations,” tweeted Cloudflare CEO Matthew Prince on Sunday afternoon. “They may pick back up, but right now there’s a noticeable lull.”

For sheer physical effect, little can top a Tomahawk cruise missile or a round from High Mobility Artillery Rocket System, two weapons the United States is reportedly deploying against Iran. “We cannot ignore the human and physical elements of cyberwarfare,” said Kathryn Raines, a senior threat intelligence analyst at Flashpoint during a morning media call. “The people who normally run these keyboards, they’re taking shelter from air strikes,” she said. It’s also possible they simply can’t go online, due to the national connectivity blackout.

Amazon Web Services on Sunday attributed a power outage affecting one of its data centers in the United Arab Emirates to debris leading to “sparks and fire” causing power being shut off by the fire department.

Early Monday, “a localized power issue” disrupted another facility, in Bahrain. AWS said the disruption of two data centers in the same region lead to numerous service disruptions across the Middle East.

Now is not the moment for Western cyber defenders to be lulled into quiescence, experts warned. Pro-Iranian hackers cultivated by Iran in its historical Middle Eastern spheres of influence are showing signs of activity. “Iranian state and Iran-linked cyber actors almost certainly currently maintain at least some capability to conduct cyber activity,” the U.K. National Cyber Security Center warned Monday. Any organization with “offices or supply chains” in the Middle East will be at heighted risk from cyberattacks, it said.

So far, Iranian cyber proxies appear to be acting autonomously without direction from Tehran, banding together to form a “Cyber Islamic Resistance.” They’ve claimed “interference across targets in the Middle East, the United States and parts of Asia,” said Meyers. Hackers associated with an Islamic Revolutionary Guard Corps-aligned threat actor tracked by CrowdStrike as “Hydro Kitten” have said they intend to disrupt the financial sector.

The group claims to have hacked into a Jordanian wheat storage and processing firm through a phishing email, asserting it altered temperature controls and a weighing system and also disabled a solar power plant, Flashpoint reported. It also claims to have penetrated more than 130 remote control systems made by an Israeli firm.

Fake videos and conspiracy theories tied to the conflict, circulating on social media, have begun to surge.

“War escalation leads to more disinformation and propaganda, I’m seeing a lot of fake breach data being thrown around,” said Alon Gal, CTO of threat intelligence firm Hudson Rock in a post to LinkedIn.

Iran has been on the receiving end of hacking and psychological operations. Wired reported Saturday that a popular prayer-timing app called BadeSaba Calendar was hacked to display messages urging Iranian military personnel to surrender their weapons with the promise of amnesty. Iranian TV also appears to have been to hacked to broadcast speeches from U.S. President Donald Trump and Israeli Prime Minister Benjamin Netanyahu.

Jake Williams, a former offensive hacker for the U.S. National Security Agency, said in a post to X that whatever’s publicly visible, including disruptions of Iranian media sites, is likely a conscious move by U.S. or Israeli intelligence to deliver easily verified hits, at least for public consumption.

“You’ll notice they’re targeting civilian infrastructure, not government networks with intelligence collection value,” he said. If U.S. intelligence has infiltrated government networks, it will want to stay stealthy, to maximize its long-term ability to collect intelligence and not burn any zero-day exploits or unknown tactics being employed, he said.

How long the U.S.-led campaign might continue remains unclear. U.S. Secretary of Defense Pete Hegseth in a Monday press conference said the conflict “is not Iraq, this is not endless.”

Israel on Monday said its air campaigns have expanded beyond Iran to also target Hezbollah-aligned forces in Lebanon. Britain has deployed its military in a defensive capability, and Britain, France and Germany are weighing more direct involvement in the U.S.-led military offensive.

Hours after the British government announced that U.S. forces would be using its airbase in Cyprus as part of the campaign, the base was hit Sunday night by a suspected Iranian drone attack. Officials said families are being evacuated from the base.

On Monday, the U.S. military said three American fighter jets were accidentally downed by Kuwaiti forces using an American-built Patriot surface-to-air missile launcher. Military experts said the fog of war remains acute in the region, with Iran-launched missiles able to hit targets in neighboring countries in as little as 45 seconds.