Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime
US and Israel May Have Launched ‘Largest Cyberattack in History’ Against Tehran
Organizations across the West and allied nations should prepare for Iranian cyberattacks in the wake of Israeli and U.S. ongoing strikes, threat intelligence firms warned as the first signs of the Iranian cyber counteroffensive became clear on Sunday.
See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime
“This is not a theoretical scenario – Iran-backed groups are confirmed escalating operations,” security operations center software maker Anomali warned in a Saturday brief, Iranian threat actors tracked as MuddyWater, APT42 and APT33 units were “activated and retooling before the kinetic trigger.” The company expressed concern over apparent silence from Iran’s APT34, writing that “Iran’s most prolific espionage group has been undetected for the entire 7-day cycle during the most significant crisis in Iranian history. This likely indicates covert pre-positioning, not inactivity.”
Analysts at the threat intelligence firm Flashpoint on Sunday reported that the Iran-linked Handala Group was already targeting Israeli industrial control systems and claimed disruption of manufacturing and energy distribution in the country. Handala, which earlier in the week claimed on social media to have stolen data held by Israel’s Clalit healthcare network, also claimed responsibility for a cyberattack on Jordanian fuel station infrastructure.
“Any firms operating in the energy, water, or manufacturing sectors in the Middle East must isolate industrial control systems from the public internet immediately to mitigate Handala-style disruptions,” Flashpoint said.
Flashpoint also reported that the “Cyber Islamic Resistance” coalition is launching denial-of-service and data-wiping attacks against U.S. and Israeli military logistics providers, while the “Fatimiyoun Electronic Team” is trying to deploy wiper malware against Western financial and energy firms.
The strikes on Iran, labeled “Operation Roaring Lion” by Israel and “Operation Epic Fury” by the United States, began early Saturday. Iran retaliated against neighbors that are U.S. allies and host its military facilities, launching missiles at Saudi Arabia, Kuwait, Qatar, the United Arab Emirates, Bahrain and Jordan, as well as Israel itself (see:US and Israel Launch ‘Major Combat Operations’ Against Iran).
“The inclusion of Gulf states such as the UAE, Qatar, and Bahrain in the potential crossfire underscores that this is not a localized exchange, but a high-risk regional security environment,” said Austin Warnick, Flashpoint’s director of national security intelligence, in an emailed statement.
“Beyond the kinetic strikes themselves, the broader risk lies in the second-order effects – retaliatory cyber operations, attacks on critical infrastructure, and prolonged disruption to air and maritime corridors that underpin global commerce,” Warnick added.
The cybersecurity firm SentinelOne on Saturday observed that Iran has “historically incorporated cyber operations into periods of regional escalation.” Organizations in Israel, the U.S. and allied nations should brace, particularly if they are in the government, critical infrastructure, defense, financial services, academic and media sectors, it advised.
“Given the rapid escalation of geopolitical tensions, we assess that Iranian state-aligned cyber activity is likely to intensify in the near-term based on a long track record of leveraging cyber operations for asymmetric retaliation, coercive signaling, and strategic messaging,” SentinelOne said. “Prior campaigns, including destructive wiper malware, infrastructure disruption, and influence operations masquerading as ‘hacktivism,’ demonstrate both capability and intent to operate in the cyber domain alongside kinetic action.”
The Islamic Republic now clearly confronts an existential threat, with U.S. President Donald Trump explicitly calling for the regime’s fall. Iran’s supreme leader, Ayatollah Ali Khamenei, was an early victim of the Israeli-American strikes, as were other high-level figures including Iranian defense minister Amir Nasirzadeh and Islamic Revolutionary Guard Corps commander Mohammed Pakpour. Khamenei’s assassination in particular has sparked outrage across much of the Islamic world, with ten people reportedly dying in protests near the U.S. consulate in Karachi, Pakistan.
Concerns about retaliation in cyberspace come after what may have been the “largest cyberattack in history,” which is how the Jerusalem Post characterized a plunge into digital darkness that accompanied missile strikes. Internet observatory NetBlocks observed a sudden decline in Iranian internet connectivity in a timeline coinciding with the onset of missile attacks.
The Post quoted “Western intelligence sources” to report that Israel attacked communications structure to hamper the Iranian military’s ability to coordinate and strike back – although it is unclear whether the internet outage is the result of a cyberattack. The Iranian regime has previously cut internet access across the country in response to national security crises.
It also remains to be seen how much capacity Iran still has to launch cyberattacks against Western targets, if its communications infrastructure has been taken down from the outside.
Anomali said the internet outage was unlikely to prevent retaliation as “pre-positioned implants, foreign-based operators, and proxy groups operate independently of Iranian domestic infrastructure.” The threat intelligence firm argued that the Iranian regime now had only cyber options left, following the apparent destruction of its conventional military options.
If Iran’s hackers are able to attempt attacks on American infrastructure, it will come at a time of turmoil for the U.S. Cybersecurity and Infrastructure Security Agency, which has become heavily understaffed due to the temporary defunding of its parent agency, the Department of Homeland Security. The day before the U.S. struck Iran, CISA announced multiple leadership changes, with acting director Madhu Gottumukkala being replaced by cybersecurity chief Nick Anderson (see: CISA Leadership Shakeup Amid DHS Shutdown).
Iran’s hackers may not be quite as notorious as their Russian and Chinese counterparts, but they certainly have had success targeting Western organizations.
Microsoft reported in 2024 that the IRGC-aligned group it tracks as Peach Sandstorm – also known as APT33 – deployed a custom multistage backdoor against energy and communications targets in the U.S. and the UAE. Check Point Research said last September that another Iranian APT group, which it calls Nimbus Manticore, had recently targeted aerospace, defense and telecommunications organizations in Western Europe with spear-phishing campaigns that enabled tracking and controlled access of victims.