Loading story…
As the U.S.-Israel-Iran conflict escalated, open-source intelligence (OSINT) dashboards and workflows gained visibility as a way to track fast-moving kinetic and cyber developments in near real time. Reporting highlighted World Monitor, an open-source “global threat map” built by Anghami CEO Elie Habib, which went viral as missiles began flying and audiences sought a way to connect disparate events beyond traditional news aggregation.
Separately, a SOCRadar post promoted a practical OSINT workflow for monitoring the conflict’s online signals—citing indicators such as Iran’s internet connectivity collapsing to ~4% of normal levels and a surge of hacktivist Telegram cyberattack claims shortly after initial strikes—while pointing readers to tools including World Monitor and a vendor-run “Iran-Israel cyber conflict” dashboard. A third item was a general OSINT link roundup (webinars, podcasts, and articles) and did not provide substantive, event-specific cybersecurity reporting beyond pointing to assorted OSINT content.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Bellingcat published the Iran Conflict Damage Proxy Map, an updated open-source tool using Sentinel-1 SAR data and a pixel-wise statistical method to flag likely strike damage amid imagery restrictions and internet blackouts. Applying the tool, it identified apparent damage at multiple Iranian military sites as well as possible strike damage at Al Udeid Air Base in Qatar and Fujairah Port in the UAE, while stressing the findings require corroboration.
On 2026-03-06, the White House reportedly published a video on X promoting the U.S. strike on Iran under Operation Epic Fury. The article presents it as an example of the conflict being packaged for public consumption with action-movie and video-game aesthetics.
SOCRadar published a practical guide on 2026-03-05 describing how to monitor the U.S.-Israel-Iran war with OSINT tools and emphasizing that cyber operations are a core part of the conflict. It recommended correlating geospatial, aviation, social, and cyber intelligence sources and using analyst-vetted dashboards to filter unverified claims.
WIRED reported that Anghami CEO Elie Habib built the open-source World Monitor dashboard in his spare time and that it went viral as users employed it to track regional conflict and broader geopolitical events in real time. The platform aggregates more than 100 data streams into a geolocated WebGL globe showing indicators such as aircraft, ships, internet outages, and fire detections.
By 2026-03-04, the OSINT guide says some active hacktivist groups had shifted their stated ambitions from website DDoS activity toward claims of operational technology and industrial control system access. The guide stresses that such claims require independent technical verification.
According to the referenced OSINT guide, the U.S.-Israel-Iran conflict phase it tracks began on 2026-02-28 with "Operation Epic Fury." The start reportedly coincided with regional airspace restrictions, a major drop in Iran's internet connectivity, and a surge of Telegram-based hacktivist claims.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
projectosint.substack.com
Open sourcebellingcat.com
Open sourceelmundo.es
Open sourcesocradar.io
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran-nexus cyber activity intensified alongside regional military escalation, with multiple reporting streams describing both opportunistic and targeted operations. Check Point Research observed a coordinated campaign to compromise internet-connected **IP cameras** across Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus, with spikes in exploitation attempts aligning to geopolitical events; activity was traced to infrastructure linked to Iran-nexus actors using commercial VPN exit nodes (e.g., *Mullvad*, *ProtonVPN*, *Surfshark*, *NordVPN*) and VPS infrastructure to mask origin, and the most targeted vendors were **Hikvision** and **Dahua**. Separately, Symantec reported **Seedworm** (*MuddyWater/Temp Zagros/Static Kitten*) activity on multiple U.S. and Canadian organizations beginning in February 2026, including a U.S. bank, airport, non-profit, and the Israeli operations of a U.S. software supplier to defense/aerospace; Symantec identified a previously unknown backdoor dubbed **Dindoor** (leveraging the *Deno* runtime) and a Python backdoor **Fakeset**, with malware signed using certificates issued to “**Amy Cherne**” (and in some cases “**Donald Gay**”), and noted attempted data exfiltration using **Rclone** to a *Wasabi* cloud storage bucket. Additional coverage indicates broader pro-Iranian cyber activity but is less specific to the above intrusions. ASEC’s weekly “Ransom & Dark Web Issues” roundup flags **pro-Iranian/pro-Islamist hacktivist** attacks against Middle Eastern and pro-Western targets, but provides limited technical detail in the excerpt. A podcast episode describing “Iran’s 12 days of cyber war” and global OT targeting (including *Unitronics* PLCs) is largely commentary and retrospective framing rather than a discrete, verifiable incident report, and two other items in the set (a Russia-linked **APT28** phishing/malware campaign in Ukraine and a China-nexus **UAT-9244** telecom intrusion set in South America) describe unrelated threat activity outside the Iran-focused escalation.
Jul 22, 2026
Regional conflict following **U.S.–Israeli strikes on Iran** has been accompanied by heightened cyber and electronic-warfare activity affecting both military operations and civilian infrastructure. U.S. officials publicly acknowledged that **U.S. Cyber Command**, alongside space capabilities, conducted “non-kinetic” operations to **disrupt Iranian communications and sensor networks** in support of *Operation Epic Fury*, describing effects intended to degrade Iran’s ability to coordinate and respond; reporting also noted follow-on hack-and-leak style activity against Iranian-facing online properties (e.g., news sites and an app) and warned of potential retaliatory cyber activity by Iranian-aligned actors. In parallel, maritime intelligence reporting described a sharp increase in **GPS/AIS disruption (jamming/spoofing)** impacting shipping around the Strait of Hormuz, with vessels appearing in false locations and maritime authorities warning of elevated risk to navigation and safety. Iran’s domestic crypto ecosystem also showed signs of stress consistent with conflict conditions and connectivity constraints: observers reported **internet outages**, exchanges moving into risk-containment modes (e.g., batching/suspending withdrawals), and temporary restrictions on the **USDT–toman** trading pair under central bank direction—collectively reducing liquidity and market activity rather than clearly indicating capital flight. Separate reporting on Pakistan’s TV broadcast hijacks and a DDoS incident affecting Russian government sites appear unrelated to the Iran conflict-driven activity described above.
Jun 29, 2026
Cyber activity surged immediately following joint **U.S.–Israel strikes on Iran** (described as *Operation Epic Fury*), with reporting indicating a fast-moving “cyber swarm” of hacktivists and aligned collectives conducting disruption, influence messaging, and broad cyber claim activity within hours of the kinetic events. A day-by-day Telegram-focused timeline described early **DDoS campaigns against Israeli government sites** expanding into a wider coalition of **pro-Iranian, pro-Palestinian, and Russian-aligned** groups targeting additional regions and sectors, including Gulf states, Europe, and the U.S., with increasing attention on **critical infrastructure**; examples cited include claims of DDoS disruption against Israeli commercial, defense-adjacent, and energy-related entities (e.g., an oil company and an advanced defense firm), sometimes accompanied by third-party availability “verification” links. U.S. state and local governments were separately warned by **MS-ISAC** to expect heightened “low-level” activity—particularly **DDoS**—in the wake of the Iran-related escalation, and were urged to harden internet-facing and cloud services (e.g., remediation of critical/cloud infrastructure, use of firewalls/CDNs, and reducing exposed employee/organizational data). In parallel, a critical-infrastructure-focused interview tied to an upcoming OT security summit reiterated that energy, water, pipeline, and ICS environments face persistent probing by state adversaries and that “low-cost entry” cyber operations can be used to test and disrupt mission-critical systems; while not specific to the Iran conflict, it reinforces the broader risk context for OT operators amid heightened geopolitical tensions.
Jun 29, 2026