Israeli Strikes Raise Fears of Cyberattacks and Retaliation

Missile strikes exchanged between Israel and Iran over the last 24 hours – initiated by Tel Aviv in a Thursday night attack – underscore a history of tensions between the two Middle East countries that’s played out in the physical and cyber worlds.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Israeli officials called Thursday’s assault on Iranian nuclear and military targets a “preemptive attack” meant to cripple nuclear infrastructure and missile capabilities, killing top commanders including Maj. Gen. Hossein Salami and Gholam Ali Rashid. The operation, which triggered Iran to fire a barrage of missiles at Israel by Friday, sparked fears of broader conflict and renewed cyberattacks on par with recent high-profile campaigns that in part targeted U.S. critical infrastructure sectors (see: Iranian Hackers Using Brute Force on Critical Infrastructure).

“Iranian cyber activity has not been as extensive outside of the Middle East but could shift in light of the military actions,” said John Hultquist, chief analyst at Google’s Threat Intelligence Group. Iranian cyber espionage campaigns already target U.S. government and political entities but future operations could shift toward critical infrastructure and even private individuals.

“Iran has the ability to carry out cyber espionage and disruptive cyberattack as well as information operations like hack-and-leak campaigns,” Hultquist said.

In October 2024, the Cybersecurity and Infrastructure Security Agency, FBI, National Security Agency and cyber counterparts in Canada and Australia published an alert highlighting escalating threats from Iranian state-sponsored hackers. The warning detailed how Iranian groups had infiltrated sectors such as healthcare, energy, government, IT and engineering using brute-force attacks and credential theft to enable broader system access.

Iran may respond to the Israeli missile barrage with disruptive cyberattacks targeting U.S. entities, similar to a campaign over a decade ago that overwhelmed American banks with large-scale distributed denial-of-service attacks. Such tactics could resurface as a form of retaliation amid rising tensions, said Jason Healey, senior research scholar at Columbia University’s School for International and Public Affairs specializing in cyber risk and conflict.

“There is now a land war in Europe and another major conflict in the Middle East,” Healey told Information Security Media Group. Certain nation states “may decide to let loose their cyber forces, consequences be damned.”

National security analysts said that while cyberwarfare threats may rise, missile strikes and physical attacks still remain the most effective and immediate means of harming an adversary. “Cyber operations against military targets have their time and place,” said Annie Fixler, senior fellow and director of the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation.

Cyberattacks can disable warning systems ahead of kinetic strikes, disrupt or delay an adversary’s response and create temporary effects that physical attacks cannot. But “physical attacks have a known impact that cyber operations cannot always guarantee.”

Not every cyberattack need have a military target or be coordinated with live fires. Foes may think that disruption to an adversary’s critical infrastructure could chip away at popular support, even if past attempts to punish civilians through conventional military force in the hope of sparking an uprising have failed. Cyber attacks’ low cost and asymmetry – small nations such as Iran can take on much larger countries such as the United States – may still make cyberattacks irresistible. Pro-regime hackers could additionally act independently, without direct orders from Tehran.

On Friday, the cybersecurity firm Radware issued an alert about heightened cyberthreats amid the ongoing Israel-Iran conflict. The alert warned that “Iran is currently more likely than ever to retaliate through cyberattacks” due to its significantly reduced ability to respond through conventional military operations following the loss of senior leadership and damaged missile capabilities.

The alert noted how cyber hostilities between Israel and Iran began date back at least to the 2010 discovery of Stuxnet, landmark malware that disrupted Iran’s uranium-enrichment centrifuges by targeting Siemens control systems. In the years since, Iran has expanded its cyber capabilities, launching increasingly aggressive campaigns – most recently by groups such as APT35 and CyberAv3ngers targeting Israeli infrastructure, including water systems, hospitals and transit networks.