Loading story…
Iranian officials and affiliated voices signaled a sharper turn toward cyber retaliation during the U.S.-Israeli conflict, with the Islamic Revolutionary Guard Corps threatening major U.S. technology companies including Apple, Google, and Meta if more Iranian leaders were killed. North Carolina and other U.S. defenders were urged to stay on heightened alert as state officials cited increased nation-state activity and MS-ISAC warned that Iran is more likely to conduct disruptive or destructive operations such as wiper attacks, website defacements, and DDoS activity than conventional ransomware. Reporting tied the threat environment to a claimed Handala wiper attack on medical device maker Stryker and to broader concern that election-related websites and other civilian targets could face low-level disruption.
Multiple assessments said Iran’s immediate cyber response appeared limited because military strikes, leadership losses, and internet disruptions had temporarily degraded its operations, but argued that the conflict is likely to push Tehran to invest more heavily in cyber capabilities over time. Analysts described cyber operations as a cheap, resilient, and globally deployable tool that can survive bombing and compensate if Iran’s other means of projecting power are weakened. The debate unfolded alongside criticism that Washington’s cyber strategy is too offense-heavy and institutionally underpowered, with gaps in leadership, pressure on U.S. Cyber Command, and reduced civilian cyber capacity leaving U.S. networks and critical infrastructure more exposed as Iranian retaliation risks grow.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
A Risky Bulletin podcast episode published on April 7 discussed how Iran’s cyber forces had been used during the ongoing war. Its show notes referenced reporting about a plan to kill Ali Khamenei and claims that 50 companies were wiped.
Iran's Revolutionary Guards publicly threatened retaliatory action against major U.S. technology companies including Apple, Google, and Meta if additional Iranian leaders were killed. The statement warned that relevant units could be destroyed beginning at 8:00 pm Tehran time on Wednesday, April 1.
Risky Biz reported that the European Union sanctioned Iranian contractor Emennet Pasargad and others for cyberattacks.
A Risky Bulletin podcast episode published on March 19 argued that a successful U.S. war outcome against Iran could leave the country relying more heavily on cyber capabilities because they are resilient, cheap, and fast to employ.
Risky Biz reported a claimed Handala wiper attack targeting medical device maker Stryker as part of the cyber activity discussed around the conflict with Iran.
Risky Biz reported that Iran’s immediate cyber retaliation against U.S. and Israeli strikes had been limited, likely because military action, leadership losses, and internet disruptions had temporarily degraded Iranian cyber operations.
A March 17 Risky Bulletin podcast episode examined how bombing Iran could change Iranian hacker incentives and push the state to rely more heavily on cyber operations if other means of projecting power were degraded.
North Carolina’s technology department issued a public warning about heightened cyber risk, citing recent intelligence indicating increased activity by nation-state actors. State officials said the security operations center was on high alert and urged governments, businesses, and residents to strengthen defenses.
A Council on Foreign Relations article says the Trump administration had newly released a cyber strategy and criticizes it as too brief, overly offense-focused, and misaligned with major threats such as China and Iran.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
koreatimes.co.kr
Open sourcerisky.biz
Open sourcenews.risky.biz
Open sourcerisky.biz
Open sourcestatescoop.com
Open sourcecfr.org
Open sourcerisky.biz
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coordinated U.S. and Israeli strikes on Iranian targets have raised expectations of **Iranian state-aligned cyber retaliation** against U.S., Israeli, and allied interests. Reporting and vendor intelligence assessments warn that Iran has historically paired kinetic escalation with cyber operations ranging from *low-level disruption* (website defacements and DDoS) to *higher-impact activity* (ransomware-style disruption, hack-and-leak operations, espionage, and destructive/wiper malware), with likely targeting pressure on government, critical infrastructure, defense, financial services, academia, and media. The situation is described as fast-moving, with no definitive public attribution yet tying major new cyber campaigns directly to the latest strikes. Separately, multiple reports highlight **unrelated** security issues: GreyNoise observed large-scale reconnaissance and SSL VPN enumeration against **SonicWall SonicOS** devices via commercial proxy infrastructure—activity consistent with precursor targeting that often precedes credential attacks and ransomware intrusions. CISA also issued updated technical details on **RESURGE**, a stealthy implant used in zero-day exploitation of **Ivanti Connect Secure** via `CVE-2025-0282`, including passive C2 behavior and TLS-fingerprint-based authentication/evasion; Mandiant linked the exploitation to China-nexus activity (UNC5221). Other items in the set include a generic IoT security pitfalls article, a weekly security roundup, and a conference write-up, none of which materially advance the Iran-retaliation storyline.
Jun 29, 2026
Military strikes by the United States and Israel against Iranian targets on **February 28, 2026** were followed within hours by a sharp escalation in cyber activity across the Middle East. Reporting describes widespread **DDoS attacks, website compromises, defacements, and breach claims**, with more than 150 hacktivist incidents reportedly claimed in the first two days of the crisis. Iranian connectivity was heavily disrupted, including outages affecting **IRNA**, while **Tasnim News** was reportedly compromised and displayed anti-regime messaging. The most affected sectors were identified as **government, aerospace and defense, and technology**, and regional states including **Israel, Kuwait, Jordan, Bahrain, Qatar, and the UAE** saw elevated cyber pressure. The surge also expanded beyond immediate regional targets, with security reporting warning that the conflict was driving attacks against global commercial sectors such as **travel, hospitality, and energy**. One cited example was a **March 11** claim by **Handala**, a hacktivist group alleged to have ties to Iranian intelligence, that it had conducted a large-scale **data-wiping attack** against medical technology company **Stryker**, allegedly destroying several terabytes of data. Additional reporting noted unconfirmed concerns that Iranian-linked actors could target the physical and digital infrastructure of major U.S. technology firms. The activity reflects a broader pattern of **geopolitically motivated cyber operations** acting as a force multiplier alongside kinetic conflict, rather than a standalone marketing or advisory narrative.
Jun 30, 2026
US and Israeli military action against Iran under **“Operation Epic Fury”** has been accompanied by heightened cyber activity and public acknowledgment of offensive cyber operations. Reporting indicated a surge of pro-Iranian activity including **DDoS attacks**, attempted compromises, and targeting of **critical infrastructure**, with researchers warning that Iranian state-linked actors tied to the **IRGC** and **MOIS**, as well as aligned hacktivists, are likely to sustain retaliatory operations aimed at economic, reputational, and potentially physical disruption. Separately, reporting alleged Israeli intelligence conducted long-running surveillance by compromising **Tehran traffic cameras**, exfiltrating encrypted video and telemetry to servers outside Iran to build “pattern of life” intelligence on senior leadership movements. The Pentagon also elevated the visibility of cyber as a warfighting domain, with the Chairman of the Joint Chiefs describing coordinated **space and cyber** effects used to “disrupt, degrade, and blind” Iranian communications and sensor networks, though without operational detail. In parallel but unrelated to the Iran conflict, Russia’s internet regulator **Roskomnadzor** and the Russian Defense Ministry reported a “complex multi-vector” **DDoS** incident that temporarily disrupted multiple government sites, with traffic attributed to botnets and servers across several countries and continued user-reported instability after initial containment.
Jun 29, 2026