Loading story…
Acting Secretary of the Navy Hung Cao warned that adversaries are conducting a coordinated, multi-domain campaign against the Department of the Navy, targeting service members, civilian personnel, and military installations. The warning says the threat environment has intensified since Operation Epic Fury against Iran and now includes cyber harassment, doxing, suspicious social media activity, phishing and impersonation, drone surveillance, ground-level surveillance, and probing of installation security measures.
Navy officials said the incidents are not isolated, but part of a deliberate effort to gather intelligence, test defenses, disrupt operations, and intimidate personnel. The notice also said hostile activity appears to be escalating from online targeting and surveillance toward direct action, including attempted attacks on access control points and coordinated testing of security responses, and urged personnel and families to tighten social media privacy, limit exposed personal information, and report suspicious cyber or physical activity to NCIS, base security, force protection offices, the Marine Corps Eagle Eyes program, or local law enforcement.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Former Secretary of the Navy John Phelan issued an earlier administrative message in April recommending improved cyber hygiene amid Operation Epic Fury. Hung Cao's later warning said the threat environment had evolved beyond that earlier guidance.
Acting Secretary of the Navy Hung Cao issued an administrative message warning that adversaries are conducting a coordinated, multi-domain campaign against Department of the Navy service members, civilians, and installations. The warning said the activity includes cyber harassment, doxing, drone surveillance, ground surveillance, physical attacks, and probing of security measures, and urged personnel to strengthen privacy and report suspicious activity.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcedefensescoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Arctic Wolf reported that **Operation Epic Fury**—a U.S. campaign coordinated with Israel against Iran involving air, missile, naval, and **cyber** strikes on Iranian military and nuclear targets—has increased the likelihood of retaliatory and spillover cyber activity affecting organizations beyond the immediate conflict zone. The advisory warned that organizations in **North America, the Middle East, the Schengen Area, and the Indo-Pacific** should expect elevated risk, particularly in sectors historically targeted by Iranian threat groups: **energy, defense, transportation, healthcare, and government**. It also highlighted potential **collateral impacts** via interconnected systems and third-party dependencies, including possible internet-service disruption and **supply-chain** compromise. The same reporting emphasized that Iranian-linked operations have historically included **destructive wiper malware**, **DDoS**, and targeted intrusions—especially against energy and utility environments—and may at times be indiscriminate, impacting countries not directly involved (including prior activity affecting U.S. water/wastewater and industrial control environments). Other items in the set were largely **leadership/career commentary, awards, and general risk-management or workforce pieces** and did not provide additional substantiated details on Operation Epic Fury or specific, attributable cyber incidents tied to the escalation.
Jun 29, 2026
US and Israeli military action against Iran under **“Operation Epic Fury”** has been accompanied by heightened cyber activity and public acknowledgment of offensive cyber operations. Reporting indicated a surge of pro-Iranian activity including **DDoS attacks**, attempted compromises, and targeting of **critical infrastructure**, with researchers warning that Iranian state-linked actors tied to the **IRGC** and **MOIS**, as well as aligned hacktivists, are likely to sustain retaliatory operations aimed at economic, reputational, and potentially physical disruption. Separately, reporting alleged Israeli intelligence conducted long-running surveillance by compromising **Tehran traffic cameras**, exfiltrating encrypted video and telemetry to servers outside Iran to build “pattern of life” intelligence on senior leadership movements. The Pentagon also elevated the visibility of cyber as a warfighting domain, with the Chairman of the Joint Chiefs describing coordinated **space and cyber** effects used to “disrupt, degrade, and blind” Iranian communications and sensor networks, though without operational detail. In parallel but unrelated to the Iran conflict, Russia’s internet regulator **Roskomnadzor** and the Russian Defense Ministry reported a “complex multi-vector” **DDoS** incident that temporarily disrupted multiple government sites, with traffic attributed to botnets and servers across several countries and continued user-reported instability after initial containment.
Jun 29, 2026
A joint advisory from the FBI, U.S. Cyber Command Cyber National Mission Force, the U.S. Department of the Treasury, and the UK National Cyber Security Centre says cyber actors working on behalf of Iran’s Islamic Revolutionary Guard Corps are conducting social-engineering and phishing campaigns against personal and business accounts. The activity has targeted people connected to Iranian and Middle Eastern affairs, including current and former senior government officials, think tank personnel, journalists, activists, lobbyists, and more recently individuals associated with U.S. political campaigns. The operators reportedly impersonate trusted contacts, journalists, relatives, or email providers, build rapport over time, and then direct victims to credential-harvesting pages that also capture multi-factor authentication codes. The advisory says successful compromises can lead to suspicious logins, unauthorized email forwarding rules, connections from unknown devices or applications, message theft and deletion, and attempts to pivot into additional accounts. Authorities urged organizations to strengthen phishing awareness, deploy anti-spoofing protections, disable external auto-forwarding where possible, monitor mailbox-rule changes, enable alerts for anomalous logins, and adopt phishing-resistant MFA, including hardware-backed authentication methods. The references provided did not supply usable details tying the second document to this activity, so the reported event is defined by the joint warning on IRGC-linked account targeting.
Jun 29, 2026