Loading story…
A fake U.S. Cyber Command memo circulated widely in military chats and social media, falsely claiming that apps including Uber, Snapchat, and Talabat were “compromised” and exposing servicemembers’ locations; the Department of Defense confirmed the memo was not authentic, and Uber and Snapchat said they had no indications of compromise. The incident was described as part of a broader surge of misinformation/disinformation spreading rapidly after the start of U.S. and Israeli strikes on Iran, underscoring how quickly deceptive messaging can reach operational communities during active conflict.
Separately, the UK’s National Cyber Security Centre (NCSC) warned British organizations of a heightened risk of Iranian cyberattacks amid the same regional tensions, emphasizing that Iran and Iran-linked actors likely retain capability to conduct cyber activity even with reported domestic internet disruption, and advising preparedness for DDoS, phishing, and ICS-targeting scenarios—particularly for organizations with Middle East presence or supply-chain exposure. A reported DDoS attack that disrupted Russia’s internet regulator (Roskomnadzor) and Defense Ministry websites is a distinct event (unattributed, described as multi-vector and sourced from globally distributed botnets) and does not directly substantiate the Iran-focused warning or the fake-memo campaign beyond illustrating concurrent geopolitical cyber activity.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Reporting cited security firms observing Iran-linked hackers beginning DDoS and reconnaissance activity as the regional crisis unfolded. These observations suggested the potential for further cyber escalation tied to the conflict.
Alongside its warning, the NCSC told organizations to strengthen monitoring, review internet-facing exposure and access controls, and follow guidance on DDoS, phishing, industrial control systems, and severe cyber scenarios. Critical infrastructure operators were also advised to review preparedness and consider enrolling in the NCSC Early Warning service.
The UK National Cyber Security Centre issued an advisory warning that the escalating Middle East conflict could increase cyber risks from Iranian state or Iran-linked actors. It said there was no major immediate change in direct threat to the UK, but warned the situation could shift quickly and that organizations with Middle East ties faced elevated indirect risk.
A Department of Defense official confirmed the circulating memo was not authentic, and U.S. Cyber Command said it had issued no such warning. Uber and Snapchat also said they had no indication their apps had been compromised.
A fraudulent memo falsely claiming to be from U.S. Cyber Command circulated online, in servicemember chats, social media groups, and some non-public Defense Department channels. The message alleged Uber, Snapchat, and Talabat were compromised and exposing servicemembers' locations, creating confusion despite skepticism from some recipients.
Following the start of U.S. and Israeli attacks on Iran, social media saw a broader increase in misinformation and deceptive messaging related to the conflict. This became the backdrop for later false cyber-related warnings circulating in military communities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcenextgov.com
Open sourcebleepingcomputer.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US and Israeli military action against Iran under **“Operation Epic Fury”** has been accompanied by heightened cyber activity and public acknowledgment of offensive cyber operations. Reporting indicated a surge of pro-Iranian activity including **DDoS attacks**, attempted compromises, and targeting of **critical infrastructure**, with researchers warning that Iranian state-linked actors tied to the **IRGC** and **MOIS**, as well as aligned hacktivists, are likely to sustain retaliatory operations aimed at economic, reputational, and potentially physical disruption. Separately, reporting alleged Israeli intelligence conducted long-running surveillance by compromising **Tehran traffic cameras**, exfiltrating encrypted video and telemetry to servers outside Iran to build “pattern of life” intelligence on senior leadership movements. The Pentagon also elevated the visibility of cyber as a warfighting domain, with the Chairman of the Joint Chiefs describing coordinated **space and cyber** effects used to “disrupt, degrade, and blind” Iranian communications and sensor networks, though without operational detail. In parallel but unrelated to the Iran conflict, Russia’s internet regulator **Roskomnadzor** and the Russian Defense Ministry reported a “complex multi-vector” **DDoS** incident that temporarily disrupted multiple government sites, with traffic attributed to botnets and servers across several countries and continued user-reported instability after initial containment.
Jun 29, 2026
Escalating conflict involving **Iran** has renewed attention on the cyber dimension of regional warfare, with warnings that attacks can extend beyond conventional military targets to government networks, critical infrastructure, transportation, and financial systems. One analysis highlights Iran’s long-standing investment in asymmetric cyber operations through state actors, proxies, and aligned hacktivists, citing activity during the 2025 conflict that included reconnaissance, phishing, defacements, data theft, data dumps, and malware delivery against perceived adversaries. A separate briefing describes alleged kinetic strikes on data centers supporting an AWS region in the Middle East, causing outages that affected consumer applications, payment services, banks, and enterprise SaaS providers in the UAE and Bahrain, while exposing how data sovereignty requirements can block rapid workload migration during a crisis. By contrast, commentary on a U.S. executive order targeting cyber-enabled fraud and transnational criminal organizations addresses organized cybercrime policy rather than the Iran-related conflict and should be treated as a different topic.
Jun 29, 2026
The UK’s **National Cyber Security Centre (NCSC)** urged British organizations to review and strengthen defenses amid rapidly evolving Middle East conflict dynamics, warning that while there was “likely no current significant change” in the *direct* cyber threat from **Iran** to the UK, the assessment could change quickly. The NCSC highlighted a **heightened risk of indirect cyber threat** for organizations with assets or supply chains in the region, noting Iran’s state and state-aligned actors maintain cyber capabilities and recommending practical hardening steps to reduce compromise risk. In the UAE, authorities warned of **opportunistic social-engineering campaigns** exploiting public anxiety after Iranian missile attacks, with scammers impersonating a fictitious “Dubai Crisis Management” entity to harvest **UAE Pass** and **Emirates ID** details that could enable **SIM-swap** attacks and subsequent mobile-banking account takeover. Separate reporting on the missile strikes described the UAE’s layered air-defense architecture (including **THAAD** and **Patriot**) that intercepted incoming ballistic missiles; while not a cyber incident, it provides operational context for the crisis environment in which cyber-enabled fraud and heightened cyber-risk advisories are emerging.
Jun 29, 2026