Loading story…
U.S. agencies warned that Iran could target critical infrastructure operators as researchers and policy analysts described a cyber ecosystem that blends state-directed activity with nominally independent hacktivist groups. CSIS said Tehran uses this structure to support espionage, sabotage, influence operations, and plausible deniability, citing the CyberAv3ngers intrusions into U.S. water and wastewater systems as a prominent example after U.S. authorities tied the activity to officials in the Islamic Revolutionary Guard Corps Cyber-Electronic Command. The same reporting linked Iranian state organs, including the IRGC and MOIS, to affiliated groups such as APT33, APT35, APT34/OilRig, and MuddyWater.
The threat picture expanded as pro-Russia actors joined Iran-linked operations under #OpIsrael, with attacks reportedly including DDoS, claimed breaches, leaked CCTV footage, SQL injection, and data leaks against Israeli government, education, and municipal targets. Researchers said dozens of Russia-aligned and Iran-nexus actors appeared to be participating, while Radware separately reported retaliatory hacktivist DDoS activity tied to the regional conflict. U.S. officials and sector groups have monitored for spillover risk, warning that even if many operations are opportunistic or low sophistication, smaller U.S. infrastructure operators could still face disruptive, high-visibility attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Published reporting on 2026-06-29 cited Israel National Cyber Directorate director-general Yossi Karadi as saying Israel recorded about 4,800 hostile cyber incidents in June 2026, up from roughly 1,600 in June 2025 during Israeli operations against Iran. He said the activity targeted critical infrastructure, central organizations, SMBs, and the public, and that while critical infrastructure attacks were prevented, some easier-to-breach organizations had systems wiped.
On 2026-05-27, Israel National Cyber Directorate director-general Yossi Karadi said Iranian state-aligned hackers had become more organized and collaborative during and after the recent war, and were using AI to improve large-scale deceptive text-message campaigns. He said Iranian cyber operations continued against Israeli, American, and regional targets even as the level of physical conflict changed.
A federal advisory reported that Iran-linked hackers recently disrupted multiple U.S. oil and gas and water facilities by targeting internet-facing programmable logic controllers, forcing some operators to switch to manual operations and causing financial losses. Investigators also said the attackers in some cases attempted to deploy destructive malware, including wipers, raising concerns about potential physical and safety risks.
On 2026-03-03, reporting said U.S. officials and organizations such as Health-ISAC were monitoring for possible spillover threats from the Iran-linked and pro-Russia-aligned campaign activity. Analysts warned that smaller U.S. critical infrastructure operators could face limited but high-visibility attacks.
By 2026-03-03, researchers said pro-Russia threat actors and Iran-linked groups had formed a loose coalition under the #OpIsrael campaign following U.S. and Israeli bombing on Iran. Reported activity included DDoS attacks, claimed breaches, leaked CCTV footage, SQL injection, and data leaks against Israeli targets.
Reporting published on 2026-04-23 said Iran-linked actors carried out a wiper attack against Stryker in March 2026 as part of increasingly destructive operations. The incident was cited alongside broader researcher observations that Iran-nexus groups were refining attacks against critical infrastructure and related targets.
In March 2026, the pro-Iran group Ababil of Minab claimed responsibility for intruding into the Los Angeles County Metropolitan Transportation Authority. LA Metro said it detected unauthorized activity and shut down access to parts of its network, though bus and rail operations were not affected and the group’s claims remained unverified.
By 2026, U.S. Treasury attribution linked CyberAv3ngers to six officials from the Islamic Revolutionary Guard Corps Cyber-Electronic Command. This shifted the narrative from nominal hacktivism toward direct Iranian state involvement.
On 2025-06-30, CISA, the FBI, DC3, and NSA issued a joint statement warning about potential targeted cyber activity by Iran against U.S. critical infrastructure. The statement marked an official U.S. government response to the threat environment.
During the June 2025 Israel-Iran conflict, analysis of Telegram activity reportedly showed coordinated mobilization among more than 178 hacktivist and proxy groups aligned with Iranian military developments. The activity suggested a broader ecosystem of aligned cyber actors rather than isolated independent groups.
In 2023, the CyberAv3ngers group conducted intrusions affecting U.S. water and wastewater systems. The activity was initially presented as pro-Palestinian hacktivism and highlighted the risk to industrial control and operational technology environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
25 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcemalware.news
Open sourcenextgov.com
Open sourcetheguardian.com
Open sourcecisa.gov
Open sourcensa.gov
Open sourcecisa.gov
Open sourcepolitico.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cyber activity surged immediately following joint **U.S.–Israel strikes on Iran** (described as *Operation Epic Fury*), with reporting indicating a fast-moving “cyber swarm” of hacktivists and aligned collectives conducting disruption, influence messaging, and broad cyber claim activity within hours of the kinetic events. A day-by-day Telegram-focused timeline described early **DDoS campaigns against Israeli government sites** expanding into a wider coalition of **pro-Iranian, pro-Palestinian, and Russian-aligned** groups targeting additional regions and sectors, including Gulf states, Europe, and the U.S., with increasing attention on **critical infrastructure**; examples cited include claims of DDoS disruption against Israeli commercial, defense-adjacent, and energy-related entities (e.g., an oil company and an advanced defense firm), sometimes accompanied by third-party availability “verification” links. U.S. state and local governments were separately warned by **MS-ISAC** to expect heightened “low-level” activity—particularly **DDoS**—in the wake of the Iran-related escalation, and were urged to harden internet-facing and cloud services (e.g., remediation of critical/cloud infrastructure, use of firewalls/CDNs, and reducing exposed employee/organizational data). In parallel, a critical-infrastructure-focused interview tied to an upcoming OT security summit reiterated that energy, water, pipeline, and ICS environments face persistent probing by state adversaries and that “low-cost entry” cyber operations can be used to test and disrupt mission-critical systems; while not specific to the Iran conflict, it reinforces the broader risk context for OT operators amid heightened geopolitical tensions.
Jun 29, 2026
Following recent U.S.-Israeli kinetic strikes on Iranian targets, reporting indicates a spike in cyber activity tied to the **#OpIsrael** campaign, including collaboration between Iran-linked operators and pro-Russia hacktivist groups targeting organizations in the U.S., Israel, and the broader region. Activity cited includes **DDoS** operations attributed to Iran’s **Cyber Islamic Resistance** working alongside **NoName057(16)** against an Israeli defense contractor and municipal entities, plus additional claimed intrusions against Israeli organizations and a wider set of targets (including a Pennsylvania town and various educational entities abroad) associated with groups such as **FAD Team**. FortiGuard Labs assesses that, despite heightened concern about state-directed retaliation, there is **limited evidence so far of a large-scale, coordinated Iranian cyber response** directly tied to the strikes. Instead, observed activity is characterized as a surge of *loosely affiliated hacktivism* and “geopolitical noise,” including defacements, opportunistic intrusion attempts, broadcast/media disruptions, internet connectivity issues inside Iran, and increased Telegram-based claims of attacks across the region; FortiGuard notes there is **no confirmed evidence** at this time of destructive Iranian **wiper** campaigns or large-scale retaliatory critical infrastructure attacks, while warning the risk could escalate based on historical patterns.
Jun 29, 2026
Iran-linked threat actors tied to **MOIS** and **IRGC-IO** attempted a series of disruptive cyberattacks during the broader Iran conflict, including efforts to compromise internet-exposed programmable logic controllers in U.S. water systems, deploy a wiper against a U.S. healthcare company, and breach the email server of Albania’s parliament. The operations were presented by Iranian actors as strikes on critical infrastructure and public institutions across the United States, Israel, and Gulf states. Reporting assessing the campaign says the attacks caused limited real-world damage and suggests Iran’s offensive cyber capacity may have been weakened by U.S. and Israeli cyber and kinetic pressure. The assessment concludes that while Iranian activity remains a resilience concern for operators of critical services, **Russia** still represents the more significant hybrid-warfare cyber threat to Europe, particularly if the war in Ukraine further deteriorates.
Jul 15, 2026