Iran Cyber Front: Hacktivist Activity Rises, but State-Sponsored Attacks Stay Low

"Coordinated space and cyber operations effectively disrupted communications and sensor networks across the area of responsibility, leaving the adversary without the ability to see, coordinate, or respond effectively. The cyberattacks severely disrupted Iranian systems, targeting state media outlets like IRNA, IRGC communications and command networks, government digital services, and key infrastructure in the energy and aviation sectors."

"The conflict began on February 28, 2026, with US and Israeli airstrikes hitting targets throughout Iran, including military bases, missile production sites, nuclear-related facilities, and senior leadership positions. The attacks, conducted as part of Operation Epic Fury (US) and Operation Roaring Lion (Israel), resulted in the deaths of Supreme Leader Ayatollah Ali Khamenei and other high-ranking figures."

"Security firms report that while hacktivist attacks have spiked, Iranian state-sponsored actors remain notably quiet. The cyber operations conducted by the US and Israel alongside kinetic attacks appeared highly targeted and they reportedly had a significant impact on Iranian capabilities."

Following US-Israeli military strikes against Iran in February 2026, cybersecurity analysts observe a notable asymmetry in cyber responses. While hacktivist attacks have increased significantly, Iranian state-sponsored actors have remained surprisingly inactive. The coordinated operations, termed Operation Epic Fury and Operation Roaring Lion, combined kinetic strikes with targeted cyberattacks. These cyber operations disrupted state media outlets, IRGC communications networks, government digital services, and critical infrastructure in energy and aviation sectors. US military leadership confirmed that coordinated space and cyber operations effectively disabled Iranian communications and sensor networks, severely hampering their ability to coordinate responses. Pro-Western hackers also compromised a prayer application to broadcast messages indicating external involvement.

Read at SecurityWeek