By Carl Windsor \u2014 Fortinet CISO<\/p>\n\n\n\n
The Israel\u2013Iran war has evolved beyond kinetic warfare into a complex cyber conflict. Both nations and their proxy or hacktivist groups are targeting critical sectors\u2014finance, healthcare, telecoms, infrastructure, and public trust.<\/p>\n\n\n\n
Even before the conflict escalated physically, FortiRecon detected increased chatter on the dark web, signaling cyberattack preparations. Within hours of the conflict’s start, coordinated attacks from affiliated hacktivist groups via Telegram and darknet forums surged.<\/p>\n\n\n\n
Before open conflict, cyber activity from Iranian-associated APT groups grew steadily. The situation intensified after U.S. airstrikes on June 22, 2025, targeting three Iranian nuclear facilities during Operation Midnight Hammer.<\/p>\n\n\n\n
As hostilities mounted, cyber retaliation followed. FortiGuard identified groups executing website defacements and DDoS attacks. Pro-Israel actors included Anonymous Italia, BlackWolves, and Team-Network-Nine. Pro-Iranian groups featured MadCap, Z-BL4CX-H4T, Cyber Islamic Resistance, and others.<\/p>\n\n\n\n
The anti-Iranian group Predatory Sparrow claimed an attack on Nobitex, Iran\u2019s major crypto exchange, wiping $90 million in assets. CyberAv3ngers and MuddyWater also targeted Israel\u2019s water and energy systems. In October 2024, CyberAv3ngers hacked ten Israeli water treatment stations via misconfigured Unitronics devices.
The pro-Palestinian ransomware group Handala attacked Israeli companies, including Delek Group and AeroDreams, shifting from wiper malware to data leaks. In their message to Delkol:<\/p>\n\n\n\n
\u201cYour fuel systems are exposed\u2026 Over two terabytes of classified data are no longer in your hands\u2026\u201d
Iran\u2019s infrastructure has faced sabotage since the Stuxnet worm, with recurring threats of escalated consequences. The new focus on data leaks suggests a shift to psychological and financial damage.<\/p>\n\n\n\n
Iranian APTs like MuddyWater, APT33, and OilRig continue to target global sectors, especially in the Middle East and Europe. Their tactics involve spear-phishing emails with malicious PDFs, HTML files, and spoofed companies. In some cases, they use deepfakes to improve credibility.<\/p>\n\n\n\n
U.S. and European firms\u2014especially those linked to Israel\u2014are increasingly collateral targets. On June 22, 2025, \u201cCyber Fattah\u201d leaked data from past Saudi Games events. The Iran-linked 313 Team took TruthSocial offline in a DDoS attack.<\/p>\n\n\n\n
Even before the war, Iranian actors had infiltrated critical infrastructure in at least one Middle Eastern country. The trend points toward wider geopolitical impact, beyond initial zones of hostility.
Multiple cybersecurity groups, including IT-ISAC and Food and Ag-ISAC, have issued warnings to U.S. entities, citing risks of retaliatory attacks, destructive malware, and supply chain compromise.<\/p>\n\n\n\n
Disinformation remains a powerful tactic\u2014used from Roman times to Nazi propaganda. Today, cyber operations are interwoven with digital deception: fake missile alerts, leaked personal data, and AI-generated visuals. Some fakes are crude, such as doctored images of a supposedly downed U.S. B-2 bomber, which lacked crash details or realism.<\/p>\n\n\n\n
Movies like Enemy of the State exaggerate surveillance, but reality is closer than expected. Iran and Hamas exploit unsecured home cameras using unchanged default passwords. These allow hostile actors to spy on civilian environments.<\/p>\n\n\n\n
Control of information is central to modern warfare. In mid-June, Iran imposed a 97% internet blackout following strikes. VPN usage spiked by 95% as citizens sought access to global information.
Blackouts are also used during protests, not just wars. Platforms like NetBlocks track these state-enforced outages.<\/p>\n\n\n\n
By Carl Windsor \u2014 Fortinet CISO The Israel\u2013Iran war has evolved beyond kinetic warfare into a complex cyber conflict. Both nations and their proxy or hacktivist groups are targeting critical sectors\u2014finance, healthcare, telecoms, infrastructure, and public trust. Even before the conflict escalated physically, FortiRecon detected increased chatter on the dark web, signaling cyberattack preparations. Within […]<\/p>\n","protected":false},"author":2,"featured_media":56498,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":439,"_extra_hide_author_box":"1","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-56497","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n