Loading story…
U.S. officials said U.S. Cyber Command conducted cyber operations that disrupted Iranian communications and sensor networks ahead of joint U.S.-Israel military strikes on Iran, with the stated effect of degrading Iran’s ability to assess, coordinate, and respond to the kinetic campaign. The Pentagon also warned that the U.S. and Israel were preparing for retaliatory Iranian cyberattacks, indicating an elevated risk environment for regional critical infrastructure and organizations with Middle East exposure.
Separate reporting described the broader conflict and weapons employed during the strikes and subsequent Iranian retaliation, but did not add technical detail on the cyber operations beyond the context of the campaign. A different SC Media brief covered the FBI’s Operation Winter SHIELD and calls for faster intelligence sharing to counter Chinese cyber threats; that item is not part of the Iran-focused Cyber Command activity described above.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Following the military and cyber operations, U.S. and Israeli officials were reported to be preparing for possible Iranian cyber retaliation. The expectation of follow-on cyber activity reflected the broader escalation of the conflict.
Bellingcat highlighted repeated false identifications of munitions remnants on social media, including drop tanks mislabeled as missiles and interceptor debris miscast as Iranian weapons. It also noted a pre-1974 U.S.-made MIM-23B HAWK component was falsely claimed to be an ATACMS remnant.
As the conflict continued, reports surfaced that unexploded Tomahawk warheads had been found in Iraq and Syria. Bellingcat cited these findings while tracking munitions and strike remnants across the region.
Bellingcat reported the first known combat use of the U.S. LUCAS one-way attack drone during the conflict. The system was described as a Shahed-like platform identified through open-source imagery.
In the first two days after the strikes, Iran reportedly launched hundreds of missiles and drones at Israel and multiple Gulf states. Bellingcat also documented Shahed drone impacts and missile booster debris falling in neighboring countries as the conflict widened.
The strikes were reported to have killed Iranian Supreme Leader Ayatollah Ali Khamenei along with other senior Iranian officials. Both references treat his reported death as a major consequence of the initial U.S.-Israeli attack.
The United States and Israel reportedly carried out major strikes across Iran, with Bellingcat citing more than 2,000 Israeli bombs dropped in the first 30 hours and over 1,000 U.S. targets struck in the first 24 hours. Open-source imagery reviewed by Bellingcat indicated use of weapons including Tomahawk missiles, JDAM-equipped bombs, AGM-154C JSOW, Precision Strike Missile, SPICE-guided bombs, and RAMPAGE missiles.
Ahead of joint U.S.-Israel military action, U.S. Cyber Command conducted operations that disrupted Iranian communications and sensor networks, according to Gen. Dan Caine. He said the activity hindered Iran's ability to assess, coordinate, or respond to the coming strikes.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebellingcat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US and Israeli military action against Iran under **“Operation Epic Fury”** has been accompanied by heightened cyber activity and public acknowledgment of offensive cyber operations. Reporting indicated a surge of pro-Iranian activity including **DDoS attacks**, attempted compromises, and targeting of **critical infrastructure**, with researchers warning that Iranian state-linked actors tied to the **IRGC** and **MOIS**, as well as aligned hacktivists, are likely to sustain retaliatory operations aimed at economic, reputational, and potentially physical disruption. Separately, reporting alleged Israeli intelligence conducted long-running surveillance by compromising **Tehran traffic cameras**, exfiltrating encrypted video and telemetry to servers outside Iran to build “pattern of life” intelligence on senior leadership movements. The Pentagon also elevated the visibility of cyber as a warfighting domain, with the Chairman of the Joint Chiefs describing coordinated **space and cyber** effects used to “disrupt, degrade, and blind” Iranian communications and sensor networks, though without operational detail. In parallel but unrelated to the Iran conflict, Russia’s internet regulator **Roskomnadzor** and the Russian Defense Ministry reported a “complex multi-vector” **DDoS** incident that temporarily disrupted multiple government sites, with traffic attributed to botnets and servers across several countries and continued user-reported instability after initial containment.
Jun 29, 2026
Reporting described a major escalation in **cyber warfare tied to US and Israeli military operations against Iran**, with claims of widespread disruption inside Iran alongside information operations. One account said Iran experienced a near-total digital blackout (connectivity dropping to ~4% of normal), outages affecting government services and communications, and media/PSYOPS-style intrusions (e.g., defacements/injections on pro-regime sites, hijacked messaging via a widely installed prayer app, and interference with broadcast feeds). The same narrative framed the activity as part of a coordinated campaign (described as *Operation Roaring Lion* / *Epic Fury*) and positioned it as a continuation of long-running US–Israel vs. Iran cyber escalation. Threat intelligence and security firms warned that **Iran-linked actors were already mobilizing for reprisal activity** against Israel and potentially Western/allied targets. Cited reporting said Anomali assessed multiple Iranian groups (including **MuddyWater**, **APT42**, and **APT33**) as “activated and retooling,” while noting an unusual lack of visibility into **APT34** that it interpreted as possible covert pre-positioning rather than inactivity. Flashpoint was cited as observing Iran-linked **Handala Group** activity targeting Israeli **industrial control systems (ICS)** and claiming disruption to manufacturing/energy distribution, alongside claims of data theft affecting an Israeli healthcare organization; the overall guidance was to expect heightened Iranian cyber operations in the wake of kinetic strikes.
Jun 29, 2026
Military strikes by the United States and Israel against Iranian targets on **February 28, 2026** were followed within hours by a sharp escalation in cyber activity across the Middle East. Reporting describes widespread **DDoS attacks, website compromises, defacements, and breach claims**, with more than 150 hacktivist incidents reportedly claimed in the first two days of the crisis. Iranian connectivity was heavily disrupted, including outages affecting **IRNA**, while **Tasnim News** was reportedly compromised and displayed anti-regime messaging. The most affected sectors were identified as **government, aerospace and defense, and technology**, and regional states including **Israel, Kuwait, Jordan, Bahrain, Qatar, and the UAE** saw elevated cyber pressure. The surge also expanded beyond immediate regional targets, with security reporting warning that the conflict was driving attacks against global commercial sectors such as **travel, hospitality, and energy**. One cited example was a **March 11** claim by **Handala**, a hacktivist group alleged to have ties to Iranian intelligence, that it had conducted a large-scale **data-wiping attack** against medical technology company **Stryker**, allegedly destroying several terabytes of data. Additional reporting noted unconfirmed concerns that Iranian-linked actors could target the physical and digital infrastructure of major U.S. technology firms. The activity reflects a broader pattern of **geopolitically motivated cyber operations** acting as a force multiplier alongside kinetic conflict, rather than a standalone marketing or advisory narrative.
Jun 30, 2026