The Middle East has entered a critical turning point as tensions between Iran, the United States, and Israel have escalated into a complex hybrid conflict that combines traditional military operations with cyberwarfare and information warfare. The offensive, identified as Operation Epic Fury by the United States and Operation Lion’s Roar by Israel, demonstrates how modern warfare can no longer be understood through conventional lenses alone.
See also: Iranian Cyber Front: Increased activity by hacktivists
Unlike previous conflicts, this campaign combined kinetic attacks, cyberattacks, psychological operations, and information manipulation into a single, synchronized effort. Cyber capabilities were leveraged as an equal field alongside air and missile attacks, revealing a new level of strategic integration that is reshaping the dynamics of regional warfare.
Independent monitoring by Cyble Research and Information Laboratories (CRIL) has highlighted how these combined operations have exposed both the strengths and weaknesses of the actors involved. In preparation for the offensive, the United States has mobilized its largest deployment to the Middle East since the 2003 invasion of Iraq, placing aircraft carriers, fighter squadrons, and information assets close to Iran’s borders.
Parallel diplomatic initiatives in Geneva offered a fleeting window of opportunity, as Tehran agreed to halt nuclear enrichment under IAEA supervision. However, mutual distrust, strategic imperatives, and long-standing hostilities rendered these measures ineffective, creating conditions ripe for Operation Epic Fury and Operation Lion’s Roar.
The defining feature of the campaign was the integration of cyber operations with mobile attacks. Iran’s domestic internet infrastructure was reportedly reduced to 1-4% functionality, as state media, government agencies, and military communications came under sustained digital attack. Popular services, mobile apps, and religious platforms were compromised, while government websites displayed altered content intended to undermine Tehran’s official narratives.
See also: US-Israel and Iran exchange cyberattacks
Pre-existing cyber actors, such as MuddyWater, APT42 (Charming Kitten), Prince of Persia/Infy, UNC6446 , and CRESCENTHARVEST, fueled the conflict through phishing, data theft, and server exploitation. At the same time, psychological operations expanded into Israel, delivering threatening messages about fuel shortages and national ID numbers. Iran’s response combined missile and drone attacks targeting Israel, Gulf Cooperation Council (GCC) states, and U.S. military bases, causing casualties and damage to infrastructure, including Dubai International Airport and an AWS cloud data center.
Hacktivist groups have grown in parallel, with over 70 organizations conducting DDoS attacks, website defacements, and credential theft campaigns in multiple countries. Malicious payloads, such as the RedAlert APK that mimics Israel’s missile alert app, have featured techniques typically associated with state-sponsored operations. Groups such as NoName057(16) and Russian Legion have opportunistically aligned themselves with Iranian interests, while cybercriminals have exploited the chaos to launch ransomware and social engineering campaigns, demonstrating the convergence of ideological and economic motives in modern hybrid warfare.
The ongoing operations highlight several key lessons for the region and global observers: cyber operations now operate on a par with mobile operations; hacktivist networks can act as force multipliers across borders; and opportunistic cybercrime thrives in environments of geopolitical uncertainty.
See also: Apple temporarily closed in the United Arab Emirates
Analysts emphasize the need for constant vigilance, from credential monitoring and DDoS mitigation to proactive defense against emerging malware campaigns. Operation Epic Fury and Operation Lion’s Roar underscore that the current conflict in the Middle East extends far beyond conventional warfare. Even as Iran’s networks remain degraded, pre-existing cyber capabilities and hacktivist activity could maintain prolonged disruption, signaling a persistent and contemporary threat landscape that will influence regional and global security assessments for months to come.
