Iranian Cyber ​​Front: Increased activity by hacktivists

Following the joint US and Israeli military attacks on Iran, cybersecurity analysts are closely monitoring the threat landscape, noting increased activity from hacktivists, while state-sponsored Iranian actors remain relatively inactive.

The conflict began on February 28, 2026, with coordinated airstrikes on military bases, missile production facilities, and nuclear facilities, which resulted in the deaths of Supreme Leader Ayatollah Ali Khamenei and other senior officials. Iran's response included missile and drone strikes on U.S. military installations in the Persian Gulf and attacks on Israel, causing limited damage and casualties.

See also: SloppyLemming targets critical infrastructure in Pakistan and Bangladesh

Strategic role of cyber businesses

In addition to the physical attacks, the US and Israel have carried out coordinated cyber operations targeting Iranian systems, disrupting state media outlets such as IRNA, communications networks IRGC, government digital services, and key infrastructure in the energy and aviation sectors. Pro-Western hackers have also compromised a prayer app to broadcast messages suggesting foreign interference. Pentagon Gen. Dan Kane said the coordinated space activities and cyber operations have limited Iran's ability to monitor and coordinate its responses.

Iranian attacks and activist activity

Despite pro-Iranian attacks observed by cybersecurity firms, state-sponsored hackers have remained inactive, likely due to limited internet connectivity and blackouts. CrowdStrike reported an increase in attacks by hacktivists, such as website defacements and DDoS attacks, with the Hydro Kitten targeting financial institutions. Adam Meyers noted that the activity is often based on allegations rather than evidence and is a common response to geopolitical escalation.

Global attacks by pro-Iranian groups

Flashpoint reported that pro-Iranian and pro-Russian groups, such as NoName057(16), Cyber ​​Islamic Resistance, and FAD Team, launched DDoS, SQL injection, and system breach against Israeli and international organizations. Some attacks included targeting Arab states allied with the United States, such as Bahrain and Qatar, with DDoS attacks on oil companies and media outlets.

See also: Hackers use CyberStrikeAI for AI-powered attacks

The observation of security companies

Cisco Talos, Sophos and Palo Alto Networks also saw an increase in activity from hacktivists but not from state-backed groups, highlighting that most alleged breaches of critical infrastructure remain unconfirmed. Analysts say attention should be focused on groups exploiting the war to expand infections and social engineering attacks.

Risks to international security

Check Point points to the reactivation of old cyber actors from Iran, while Hudson Rock considers many data breaches to be hoaxes. Despite the exaggerations, the fact that state actors can conduct sophisticated intrusions alongside physical military operations underscores the seriousness of the threat.

See also: Vietnam announces national cybersecurity firewall plan

Recommendations for organizations and companies

The UK’s National Cyber ​​Security Centre (NCSC) is urging organisations to review their cyber risk posture and implement robust defences, even as the threat from Iran to the UK appears limited. Constant vigilance, increased network monitoring and staff awareness of social engineering tools are now critical measures in times of geopolitical tension.

This case clearly shows how physical military actions and cyber operations combine, creating a multi-layered threat front that requires coordinated and continuous preparation by international organizations and private technology players.