As Israeli and Iranian forces engaged in a conventional military exchange on June 13, 2025, the conflict has rapidly escalated into a far more complex and multi-faceted conflict that is increasingly involving a slew of coordinated cyberattacks against a broad variety of targets, all of which have been initiated in response to this conventional military exchange.
In response to Israeli airstrikes targeting Iranian nuclear and military installations, followed by Iranian retaliatory missile barrages, the outbreak began in a matter of days and has quickly spread beyond the country's borders. Both nations have long maintained a hostile and active presence in cyberspace.
There has been a growing tension between Israel and Iran since kinetic fighting began in the region. Both countries are internationally known for their advanced cyber capability. In the days since the start of the kinetic fighting, several digital actors have emerged, from state-affiliated hackers to nationalist hacktivists to disinformation networks to opportunistic cybercriminals. They have all contributed to the rapidly developing threat environment that is unfolding.
This report provides an overview of the cyber dimension of the conflict, highlighting key incidents, emerging malware campaigns, and the strategic implications of this growing cyberspace. A response to the increasing geopolitical tensions arising from the Israel-Iran conflict and the United States' military involvement in that conflict has been issued by the Department of Homeland Security (DHS).
A new bulletin from the National Terrorism Advisory System (NTAS) was issued on Sunday by the Department of Homeland Security (DHS).
Cyberattacks are more likely to occur across critical infrastructure sectors across the United States, and this alert emphasises the heightened threat. Particularly, it focuses on hospitals, industrial networks, and public utilities.
An advisory states that Iranian hacktivist groups and state-sponsored cyber actors have been using malware to gain unauthorized access to a wide range of digital assets, including firewalls, Internet of Things (IoT) devices, and operational technology platforms, as a result of the use of malware by those groups.
Iranian authorities issued a bulletin after they publicly condemned U.S. airstrikes conducted over the weekend and said they would retaliate against American interests.
According to US cybersecurity officials, the growing anti-Israel sentiment, coupled with the adversarial posture of Iran towards the United States, could fuel a surge in cyberattacks on domestic networks shortly.
Not only are sophisticated nation-state actors expected to carry out these attacks, but also loosely affiliated hacktivist cells fueled by ideological motivations are expected to carry out these attacks.
According to the Department of Homeland Security, such actors tend to use vulnerabilities in poorly secured systems to launch disruptive operations that could compromise critical services by attacking internet-connected devices.
Throughout the advisory, cyber threats have increasingly aligned with geopolitical flashpoints, and it serves both as a warning and a call for heightened vigilance for public and private organisations.
Recent threat intelligence assessments have indicated that a large proportion of the cyber operations observed during the ongoing digital conflict were carried out by pro-Iranian hacktivists, with over 90 per cent of them attributed to Iranian hacktivist groups.
The majority of these groups are currently targeting the digital infrastructure of Israelis, deploying a variety of disruptive tactics that are aimed at crippling systems, compromising sensitive data and sowing fear among the public. However, Iran has not remained untouched. Several cyberattacks have taken place against the Islamic Republic, which demonstrates the reciprocal nature of the cyber warfare that is currently taking place in the region, as well as the volatility that it has experienced.
During this period of digital escalation, the focus has been extended far beyond just the two main adversaries. As a result, neighbouring nations such as Egypt, Jordan, the United Arab Emirates, Pakistan, and Saudi Arabia have also reported cyberattacks affecting sectors ranging from telecommunications to finance, and as a result, spillover effects have been reported.
A wide range of attack vectors have been used by regional hacktivist operations, including distributed denial-of-service (DDoS) attacks, website defacements, network intrusions, and data breaches, among others. In particular, there has been a shift towards more sophisticated operations, involving ransomware, destructive wiper malware, and banking trojans. This indicates that objectives are increasingly being viewed from an economic and strategic perspective.
Having observed the intensification of digital attacks, Iranian authorities have apparently begun implementing internet restrictions as a response to these attacks, perhaps intended to halt Israeli cyber incursions as well as prevent critical internal systems from being exposed to external threats. As a result, cyber policy and national security strategy are becoming increasingly entwined in the broader geopolitical confrontation as a whole.
The escalation of cyber warfare has led to the emergence of new and increasingly targeted malware campaigns, which reveal the ever-evolving sophistication and geopolitical motivations of those attempting to engage in these campaigns. A new executable, dubbed “encryption.exe,” has been identified by researchers on June 16, believed to be a ransomware or wiper malware, a file previously unknown.
A malicious file known as this has been attributed to a new threat actor known as Anon-g Fox.
In addition, this malware has a special feature: it checks the victim's computer for both Israeli Standard Time (IST) and Hebrew language settings. If this condition is not met, the malware will cease its operations, displaying an error message that reads, "This program can only run in Israel." [sic] In light of this explicit targeting mechanism, it may be clear that there is a deliberate geopolitical motive here, probably related to the broader cyber confrontation between Israel and Iran.
As part of their work, researchers at Cyble Research and Intelligence Labs also discovered a second campaign employing IRATA, a sophisticated Android banking malware actively targeting users within Iran. In some cases, malicious software can appear as legitimate government-sponsored applications, for example, the Islamic Republic of Iran Judicial System and the Ministry of Economic Affairs and Finance, as platforms for disseminating malware.
IRATA is a malicious software program designed to attack over 50 financial and cryptocurrency-related applications. Android's Accessibility Services are exploited to identify specific banking applications, extract sensitive information about the account, harvest card credentials, and steal financial information.
The IRATA software not only has the capability of stealing data, but it also has advanced surveillance capabilities, such as remote device control, SMS and contact harvesting, hiding icons, capturing screenshots, and observing installed applications in real time.
By utilising these features, the malware can carry out highly targeted fraud operations, causing significant financial damage to the targeted users as a result.
These two malware incidents, together with the others, illustrate a pattern of cyber threats that are increasingly targeted and politically charged, exploiting national conflict narratives and digital vulnerabilities in order to disrupt strategic operations and exploit financial opportunities.
A cyber operation has become an integral part of modern warfare as it shapes public perception and destabilises adversaries from within, thereby influencing public perception and destabilising adversaries.
A cyberattack is a common occurrence during traditional military conflicts in which critical systems are disrupted, but also psychological distress is instilled in civilian populations through the use of cyberattacks.
Cyberattacks that cause significant damage to national infrastructure are usually reserved for the strategic phase before large-scale military operations. However, smaller-scale incursions and disinformation campaigns often appear in advance, causing confusion and fear in the process.
The analogy is drawn from Russia's invasion of Ukraine in 2022, which was preceded by cyber operations that were used to prepare for kinetic attacks.
Security experts have reported that Iran's current cyber strategy appears to follow a similar pattern to the one described above. As a consequence of this, Iran has opted to deploy disinformation campaigns and relatively limited cyberattacks rather than unleash large-scale disruptive attacks.
It has been suggested by experts that the intent is not necessarily to cause immediate physical damage, but to cause psychological unease, undermine trust in digital infrastructure, and maintain strategic ambiguity as well.
Although Israel is well known for its advanced cyber capabilities, its cyber capabilities present a substantial counterforce in this regard.
Even though Israel has a long-standing reputation for conducting advanced cyber operations, including the Stuxnet campaign, which crippled Iran's nuclear program, the nation is considered to be among the world's most advanced cyber powers. In recent history, one of the most effective cyber espionage operations has been carried out by the elite military cyber intelligence division Unit 8200.
A pro-Israeli hacking group has claimed responsibility for a significant attack that occurred earlier today against Iran’s Bank Sepah, reflecting the current state of cyber engagement.
As a result of the attack, the bank's service outages have been severe, and the bank's data has been irreversibly destroyed, an accusation which, if verified, indicates a significant escalation in financial cyber warfare.
According to cybersecurity researchers, as happened with previous geopolitical flashpoints like the Hamas attacks of October 7, they expect a surge of activity as ideologically driven hackers attempt to use the conflict for political messages, influence building, or disruption, just as there has been in the past.
Today's digitally integrated battlespaces emphasise the crucial intersection between cyber operations, psychological warfare, and geopolitical strategy.
It is becoming increasingly evident that as the Israel-Iran conflict intensifies both physically and digitally, the cyber dimension has developed, posing urgent challenges not only for the nations directly involved in the conflict but also for a broader global community in general.
Considering the interconnected nature of cyberspace, regional hostilities can have wide-ranging impacts on multinational corporations, cross-border infrastructure, and even individual consumers through ripple effects.
Creating resilience in this volatile environment requires more than just reactive security measures; it also requires proactive intelligence gathering, continuous threat monitoring, and robust international cooperation.
It is imperative for organisations operating in sensitive sectors - especially those in the finance and healthcare industries, energy sector and government sector - to prioritise cybersecurity, implement zero-trust architectures, and be on the lookout for rapidly changing threat patterns that are driven by geopolitical issues.
Additionally, as cyber warfare becomes an increasingly normalised extension of military strategy, governments and private companies should both invest in digital diplomacy and cyber crisis response frameworks in order to prevent the long-term consequences of cyber warfare. The current crisis has served as a stark reminder that a modern war is one in which the digital front is not just a complement to the battles, but is at the centre of them.
