Executive Summary
The U.S. and Israeli military campaign against Iran (Operation Epic Fury / Operation Roaring Lion) has triggered a significant cyber retaliation campaign. While sophisticated state-sponsored attacks are currently limited due to Iran's degraded internet connectivity, pro-Iranian hacktivist groups are actively targeting U.S. critical infrastructure, local governments, and private companies.
Bottom line: If your organization has any connection to defense, energy, water, healthcare, or government contracts, your risk profile just increased.
The Situation
On February 28, 2026, the U.S. and Israel launched coordinated strikes on Iranian leadership compounds, IRGC facilities, and nuclear infrastructure. Within hours, Iran's cyber ecosystem activated in response.
Two categories of threat:
| Threat Type | Current Status | Risk Level |
|---|---|---|
| State-sponsored APTs (MuddyWater, Cotton Sandstorm) | Degraded — Iran at 1-4% internet connectivity | Medium (for now) |
| Pro-Iranian hacktivists (Handala Hack, APT Iran, Cyber Islamic Resistance) | Active and coordinated | HIGH |
The "Electronic Operations Room" — a coordination hub for Iranian-aligned hacktivist groups — was established on February 28, 2026. An estimated 60+ hacktivist groups are currently active, including pro-Russian groups joining the campaign.
Who's Being Targeted
High-Risk Sectors
- Water utilities — Iran-linked actors previously exploited Unitronics PLCs in U.S. water systems (2023-2024)
- Energy & utilities — Multiple major energy companies identified as highest risk
- Healthcare — Dozens of health organizations flagged; Handala Hack claimed targeting Israeli healthcare pre-war
- Local government — Municipal systems lack enterprise-grade security; easy targets
- Defense contractors — Any company with DoD/federal contracts
Geographic Risk
- Companies with operations in Israel, Jordan, or Gulf states
- Organizations hosting or supporting U.S. military operations
- Firms with publicly visible U.S./Israel partnerships
CyberCube Assessment
12% of large U.S. firms (revenue >$1B) are at highest risk from Iran-linked attacks across seven critical infrastructure categories.
What We're Seeing
Active Attack Types
| Attack Vector | Description | Impact |
|---|---|---|
| DDoS | Coordinated denial-of-service attacks on websites and services | Service disruption |
| Hack-and-leak | Data exfiltration followed by public release | Reputational damage, regulatory exposure |
| Data wipers | Destructive malware that destroys data | Operational shutdown |
| Phishing campaigns | Malicious apps and credential harvesting | Initial access for deeper attacks |
| ICS/OT targeting | Attacks on industrial control systems | Physical infrastructure damage |
Notable Incidents (First Two Weeks)
- Jordan critical infrastructure — APT Iran claimed sabotage of fuel systems
- Israeli energy company — Handala Hack claimed compromise
- Israeli payment infrastructure — Cyber Islamic Resistance claimed breach
- Drone defense systems — Hacktivist groups claimed compromise
- Malicious RedAlert app — Phishing campaign delivering mobile surveillance malware
Defensive Priorities
Immediate Actions (This Week)
Patch Unitronics and ICS systems
- CISA previously warned about CVE-2023-6448 exploitation
- Ensure all PLCs are updated and network-segmented
Enable MFA everywhere
- Especially remote access, VPN, and admin accounts
- Phishing campaigns are active
Review firewall rules
- Block traffic from Iranian IP ranges (with business justification)
- Implement geo-blocking on non-essential services
Monitor for DDoS indicators
- Ensure DDoS mitigation is active
- Have incident response playbook ready
Brief your team
- Security awareness: phishing is the primary vector
- Incident reporting: what to do if something looks wrong
Short-Term Actions (This Month)
Conduct vulnerability scan
- Focus on internet-facing assets
- Prioritize CVEs known to be exploited by Iranian actors
Review backup integrity
- Wipers are in play; backups are your recovery path
- Test restore procedures
Check cyber insurance policy
- War exclusion clauses may limit coverage
- Understand what's covered and what's not
Update incident response plan
- Include nation-state/hacktivist scenarios
- Ensure contact info for FBI, CISA, and legal counsel is current
Known Iranian Threat Actors
| Actor | Type | Primary Tactics |
|---|---|---|
| MuddyWater | State-sponsored (MOIS) | Espionage, pre-positioning on U.S. networks |
| Cotton Sandstorm | State-sponsored (IRGC) | Destructive attacks, data wipers |
| Handala Hack | Hacktivist (MOIS-linked) | Hack-and-leak, data exfiltration |
| APT Iran | Hacktivist collective | Critical infrastructure sabotage |
| Cyber Islamic Resistance | Hacktivist umbrella | Coordinated DDoS, defacement |
| Dark Storm Team | Pro-Iranian/Palestinian | DDoS, ransomware |
The Insurance Problem
Moody's Ratings and Fitch have both warned that cyber insurance policies may invoke war exclusion clauses to deny claims if attacks are attributed to the Iran conflict.
What this means: The cost of an Iran-linked attack could fall directly on your balance sheet.
Action: Review your policy language now. Understand your coverage limits and exclusions before you need to file a claim.
VISO Group Recommendations
For Mid-Market Companies
Assume you're a target — You don't need to be a defense contractor. If you're in the U.S. and have anything of value, you're on someone's list.
Focus on the basics — Iranian hacktivists aren't using zero-days. They're exploiting unpatched systems, weak credentials, and poor network segmentation.
Test your defenses — Run a vulnerability scan. Know what's exposed before they do.
Have a plan — Incident response isn't something you figure out during an incident.
How ThreatScope Helps
Our platform continuously validates your external attack surface — the same vectors Iranian actors are probing right now.
- Discover what's exposed on your perimeter
- Validate which vulnerabilities are actually exploitable
- Prioritize based on real-world attacker techniques
- Monitor for changes as the threat landscape evolves
Resources
- CISA Shields Up — cisa.gov/shields-up
- FBI IC3 — Report incidents at ic3.gov
- CyberCube Threat Analysis — cybcube.com
- Unit 42 Threat Brief — unit42.paloaltonetworks.com
About This Brief
This executive brief is part of VISO Group's ongoing threat intelligence for mid-market security leaders. We translate complex threat landscapes into actionable guidance — because you don't have time to read 50-page reports.
Questions? Contact jeremy@viso.group
Last updated: March 2026