US Says Cyber Operations Underpinned Assault on Iran

As the U.S. and Israeli-led war with Iran enters its fifth day, military operations on both sides appear to remain largely focused on kinetic strikes, with some cyber operational support.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

Cyber operations did underpin the first part of the joint strike by the United States and Israel against Iran on Saturday.

“Across every domain, land, air, sea, cyber, the U.S. Joint Force delivered synchronized and layered effects designed to disrupt, degrade, deny and destroy Iran’s ability to conduct and sustain combat operations,” Gen. Dan Caine, the chairman of the U.S. Joint Chiefs of Staff, told reporters at a press conference at the Pentagon in Virginia on Wednesday.

Before the H-hour – military-speak for the hour major combat begins – the U.S. Department of Defense’s Cyber Command and Space Command began disrupting Iran’s defenses and communication.

The U.S. military said its campaign, dubbed Operation Epic Fury, began early Saturday U.S. time, and 9:45 a.m. local Tehran time, with more than 100 aircraft being launched, including fighters, bombers and support aircraft, following “a trigger event” conducted by Israel, with the support of the U.S. intelligence community.

“The first movers were U.S. Cybercom and U.S. Spacecom, layering non-kinetic effects, disrupting and degrading and blinding Iran’s ability to see, communicate and respond,” Caine said.

The trigger event appears to have been an air strike that killed Iran’s supreme leader, Ayatollah Ali Khamenei. Multiple other high-level figures, including Iranian defense minister Amir Nasirzadeh and Islamic Revolutionary Guard Corps commander Mohammed Pakpour, were also targeted and killed (see: Western Cybersecurity Experts Brace for Iranian Reprisal).

The conflict now largely features kinetic attacks, mostly from missiles and unmanned aerial vehicles, rather than cyberattacks. But cyber operations have already been seen supporting those efforts to identify and later kill targets.

“Nearly all the traffic cameras in Tehran had been hacked for years, their images encrypted and transmitted to servers in Tel Aviv and southern Israel,” the Financial Times first reported Tuesday, citing anonymous sources.

Israel used a technique called “social network analysis to parse billions of data points” to help identify individuals it wanted to target, including in the current campaign, it reported.

In the case of Khamenei, The New York Times, citing anonymous sources, said the U.S. Central Intelligence Agency identified that Khamenei would be present at a Saturday morning meeting, and shared this information with Israel.

“So it’s probably a combination of human intelligence on the ground, potentially through Israeli assets, as well as signals intelligence and the ability of the United States to use over-the-horizon and – in this case – local assets to target pretty much anywhere on the planet that it wants to hit,” analyst Rosemary Kelanic told Canadian public broadcaster CBC.

Sabotage Campaign

Iran has responded to the aerial bombardment by launching a flurry of missile and drone attacks at U.S. and U.K. military bases in the region, as well as the countries in which they’re located, plus a number of civilian locations, including airports.

Intelligence experts said Iran, lacking military superiority, appears to be focused on sabotage, including targeting civilian locations such as hotels and airports, in part to try and weaken its neighbors’ resolve to continue supporting the war.

Amazon said drone strikes disrupted three of its data centers in the United Arab Emirates and Bahrain. Amazon Web Services has advised local customers to move their workloads to an AWS region located outside the Middle East.

Iran has declared the Strait of Hormuz a no-go zone, with the Islamic Revolutionary Guard Corps claiming to have hit more than 10 oil tankers, and Iran-aligned hacktivists spoofing GPS in the region, Flashpoint reported.

Despite its kinetic reprisals, major Iranian-launched cyber operations have yet to emerge. Some pro-Tehran and pro-Russian hacktivist groups have launched major distributed-denial-of-service attacks, as well as issued unverified claims tied to hack-and-leak operations.

“The hacktivist activity that is occurring right now is being driven almost entirely by proxy groups located outside of Iran,” said Kathryn Raines, a senior threat intelligence analyst at Flashpoint, during a Monday briefing (see: Iranian Cyber Proxies Active But Not Nation-State Hackers).

“Iran has now been offline for 100 hours. Metrics show internet connectivity flatlining at 1% of ordinary levels as the regional conflict escalates,” said internet monitoring firm NetBlocks in a Wednesday morning post to social network Mastodon.

“The regime-imposed blackout is the second this year and follows the shutdown in January when thousands were killed,” it said (see: Fresh Cyberespionage Operation Tied to Iranian Surveillance).

Unlike military or intelligence hackers in Iran who may have been forced to shelter or otherwise unable to join the fray, “these external operators are likely considerably less affected by the bombings and the internet blackouts,” Flashpoint’s Raines said.

“Because they’re operating more autonomously without Tehran’s oversight,” she said, “one thing that we are anticipating is that their targeting will be vastly more unpredictable.”

Iran Tied to Camera Hacks

Researchers have seen some signs of Tehran-aligned hackers using cyber to support kinetic strikes. Checkpoint said in a Wednesday report that Iranian threat actors recently appeared to increase their targeting of IP cameras being built by two different manufacturers in locations being targeted by Iranian-launched drones and missiles.

Since Saturday, this camera-focused hacking, attributed to “several Iran-nexus threat actors,” again intensified against devices located in Israel, Bahrain, Kuwait, Qatar, the United Arab Emirates and Cyprus, and on Sunday extended to Lebanon, they said. This followed a similar rise in such targeting of these devices in Israel and Qatar on Jan. 14 and 15, when Iran temporarily closed its airspace in anticipation of U.S.-led military action.

Checkpoint assessed that “Iran, as part of its doctrine, leverages camera compromise for operational support and ongoing battle damage assessment for missile operations, potentially in some cases prior to missile launches.” They said this camera hacking may in some cases facilitate targeting and so precede kinetic attacks.

“We observed similar targeting patterns during the 12-day war between Israel and Iran in June 2025, likely to support battle damage assessment and/or targeting correction,” they said.

The firm has urged all users of the targeted IP camera devices to ensure they’re not internet-connected, are fully patched and monitored, protected using strong credentials and isolated on a network segment with its own dedicated virtual local area network.