Loading story…
A new threat assessment warns that the Iran war is likely to increase physical security risks in the United States over the next year, driven mainly by second-order political and social effects that mobilize homegrown violent extremists, domestic violent extremists, and lower-capability Iran-nexus actors. The report says Islamic State supporters are the most likely perpetrators of mass-casualty attacks, while anti-government, anti-authority, anarchist, and neo-Nazi accelerationist extremists are expected to continue targeted violence, sabotage, and plotting against officials, facilities, and critical infrastructure.
The assessment says Iran is more likely to inspire or guide attacks in the US than to conduct sophisticated, centrally directed operations, noting that recent US-linked plots tied to Tehran have been aspirational, low-sophistication, and often dependent on financially motivated proxies. Likely targets include US and Israeli government or military-linked entities, Jewish communities, immigration enforcement, critical infrastructure, and high-profile public officials, while emerging tactics include greater experimentation with IEDs, 3D-printed weapons, UAV-borne explosives, and generative AI-assisted attack planning.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
A memorandum of understanding established a ceasefire between the United States and Iran. The assessment says that despite this ceasefire, Iran-linked actors are still likely to continue trying to guide physical threat activity on US soil.
In June, a self-described domestic violent extremist was arrested for allegedly carrying out arson attacks on electric infrastructure. The article says the suspect was reportedly motivated in part by the conflict with Iran.
The FBI reported in June that it disrupted an alleged violent extremist plot targeting a UFC event at the White House. The alleged plan involved several attackers and the use of explosive drones in a coordinated attack.
In April 2026, a commander of Kataib Hezbollah and its external operations persona Islamic Movement of the Companions of the Right allegedly tried to recruit an FBI undercover officer to attack several synagogues in the United States for $10,000 in cryptocurrency.
The report states that assassinations and attempted assassinations of US government officials and other high-profile public figures by anti-government and anti-authority violent extremists have increased since July 2025.
The assessment says mass-casualty attacks and attack plots by Islamic State supporters in the United States have substantially increased since July 2025. It cites this rise as a key driver of the current homegrown violent extremist threat environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
waterisac.org
Open sourcemalware.news
Open sourcerecordedfuture.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US financial services and critical infrastructure operators have moved to heightened vigilance amid escalating **Iran–US conflict**, with industry groups and analysts warning that geopolitical shocks often correlate with increased cyber activity. Reuters reporting cited by *teiss* says US intelligence assesses **Iran-aligned hacktivists** could conduct **low-level attacks** against US networks—particularly **DDoS**—and that banks are increasing monitoring and resilience measures given the sector’s role in payments, clearing/settlement, and market infrastructure. Separate threat research argues the conflict environment increases the likelihood of **ICS/OT-focused** activity, emphasizing that US critical infrastructure presents an attractive retaliation surface due to civilian impact and a large internet-exposed OT footprint. CloudSEK highlights rapid activation of numerous hacktivist groups after late-February 2026 strikes and points to prior public reporting on long-dwell intrusions and campaigns affecting ICS devices; a SecuritySenses episode similarly describes state-linked hacktivist activity targeting OT (including **Unitronics PLCs**) and broader spillover effects beyond the region. Other items in the set—an ISC/SANS guest diary on opportunistic scanning and a Dark Reading piece on higher attack volumes in Latin America—do not describe the Iran-related escalation and are not directly part of this specific event narrative.
Jun 29, 2026
Security experts warned that the escalating **U.S./Israel conflict with Iran** could spill into increased cyber activity by Iranian sympathizers, proxies, and hacktivist groups, with **healthcare** highlighted as a particularly exposed target due to its operational sensitivity and historically weaker security posture. Expected activity includes **DDoS**, **ransomware**, **wiper/destructive malware**, and **data theft**, with the risk extending beyond Iran’s own connectivity because many hacktivist operations rely on globally distributed infrastructure. A separate critical-infrastructure-focused advisory tied the heightened risk to the outbreak of open conflict and referenced *Operation Lion’s Roar* strikes on Iranian military and nuclear sites, warning that **Iranian state-affiliated APTs** may increase **espionage and disruptive attacks** against foreign networks and **industrial control systems (ICS/OT)** as part of a broader hybrid campaign. The guidance emphasized that defenders should plan for both opportunistic and state-directed activity affecting civilian infrastructure (e.g., energy and transportation) and prioritize resilience measures appropriate for critical infrastructure environments.
Jun 29, 2026
Arctic Wolf reported that **Operation Epic Fury**—a U.S. campaign coordinated with Israel against Iran involving air, missile, naval, and **cyber** strikes on Iranian military and nuclear targets—has increased the likelihood of retaliatory and spillover cyber activity affecting organizations beyond the immediate conflict zone. The advisory warned that organizations in **North America, the Middle East, the Schengen Area, and the Indo-Pacific** should expect elevated risk, particularly in sectors historically targeted by Iranian threat groups: **energy, defense, transportation, healthcare, and government**. It also highlighted potential **collateral impacts** via interconnected systems and third-party dependencies, including possible internet-service disruption and **supply-chain** compromise. The same reporting emphasized that Iranian-linked operations have historically included **destructive wiper malware**, **DDoS**, and targeted intrusions—especially against energy and utility environments—and may at times be indiscriminate, impacting countries not directly involved (including prior activity affecting U.S. water/wastewater and industrial control environments). Other items in the set were largely **leadership/career commentary, awards, and general risk-management or workforce pieces** and did not provide additional substantiated details on Operation Epic Fury or specific, attributable cyber incidents tied to the escalation.
Jun 29, 2026