Iran-Linked Hackers Escalate Cyber Operations Against US Targets

The kinetic conflict between the U.S.-Israeli coalition and Iran hasn't just been fought with missiles and airstrikes. In the two weeks since Operation Epic Fury began on February 28, 2026, a parallel war has erupted across digital networks — one that is now reaching directly into American hospitals, banks, airports, and critical infrastructure with growing intensity and sophistication.

The Spark: From Bombs to Bytes

When U.S. and Israeli forces launched their joint offensive against Iran — dubbed Operation Epic Fury by the Pentagon and Operation Roaring Lion by Israel — the opening salvos were devastating. Nearly 900 strikes hit Iranian military targets within the first 12 hours, and senior Iranian leadership, including Supreme Leader Khamenei, the Defense Minister, and the IRGC commander, were reported killed [1][2].

But alongside the kinetic barrage, a coordinated cyber offensive drove Iranian internet connectivity down to just 4% of normal levels. Government websites went dark, state media outlet IRNA was taken offline, and IRGC-linked Tasnim News Agency was hacked [1].

The response was swift. Within hours, Iran initiated what intelligence analysts describe as a "multi-vector retaliatory campaign" that has extended well beyond the physical battlefield [2]. A newly established "Electronic Operations Room," formed the same day strikes began, began coordinating dozens of pro-Iranian hacktivist groups in a wave of digital attacks spanning multiple continents [3][4].

The Stryker Attack: A Shot Across the Bow

The most significant cyber incident to hit a U.S. company so far came on March 11, when a devastating attack crippled the global networks of Stryker Corporation, one of the world's largest medical device manufacturers. The Iran-linked hacking group Handala claimed responsibility, saying the attack was retaliation for the strike on a school in the southern Iranian city of Minab that killed more than 170 people, most of them schoolgirls [5][6].

The attack was both brazen and technically sophisticated. Initial reports indicate that hackers gained access to Stryker's Microsoft Intune account — a cloud-based device management platform — and used it to wipe employee devices back to factory settings [6]. The group claimed 200,000 systems were affected and 50 terabytes of data were extracted, forcing the company to shut down offices across 79 countries [5][7].

Threat intelligence service FalconFeeds assessed that Handala appears to be a "faketivist" group — a state-linked operation using the cover of independent hacktivism — with documented ties to Iran's Ministry of Intelligence [6][7]. The attack marked the first major successful cyberattack against a U.S. corporation since the war began, sending shockwaves through the American business community.

The Hacktivist Army: Iran's Distributed Cyber Force

The Stryker attack did not emerge in isolation. Since February 28, dozens of pro-Iranian hacktivist groups have launched claimed cyberattacks across the Middle East, Europe, and the United States, targeting critical infrastructure, government systems, and commercial enterprises [3][4].

The coordination is striking. Groups operating under the Electronic Operations Room umbrella include Handala, 313 Team, Keymous, and others — many of which are considered "state-adjacent" given the IRGC's extensive network across the region [1][3].

313 Team launched what researchers describe as the most coordinated single-group assault of the conflict, targeting 26 Kuwaiti government domains including defense, health, and civil infrastructure. The group also claimed a one-hour shutdown of Romania's National Tax Agency in retaliation for Romania allowing U.S. forces to use its bases [3].

Keymous claimed to have stolen over 300,000 records from Israel's Ministry of Education, and its offshoot Keymous Plus swept six Arab countries with more than 50 verified DDoS claims targeting government ministries across Syria, Jordan, Qatar, Bahrain, Kuwait, and the UAE [3].

These groups have run DDoS campaigns, data leak operations, website defacements, and claimed attacks against Israeli payment systems and airport online services [4].

Source: GDELT Project

Data as of Mar 13, 2026CSV

APT Groups: The Deeper Threat

While hacktivist operations grab headlines, cybersecurity researchers are far more alarmed by the activity of Iran's advanced persistent threat (APT) groups — state-sponsored hackers with deeper capabilities and more dangerous intentions.

MuddyWater, a group affiliated with Iran's Ministry of Intelligence and Security (MOIS), was detected inside the networks of a U.S. bank, a U.S. airport, a nonprofit organization, and a software company with operations in Israel [8][9]. The campaign, which researchers believe began in early February, deployed a previously unknown backdoor dubbed Dindoor that leverages the Deno JavaScript runtime to execute commands while blending into legitimate software processes [8].

A separate Python-based backdoor called Fakeset was also found on the airport and nonprofit networks, signed by certificates previously linked to MuddyWater malware families [8].

Seedworm, another MOIS-affiliated group, launched spear phishing campaigns using compromised mailboxes to distribute a custom backdoor known as Phoenix to more than 100 government entities and international organizations [10]. Symantec researchers reported Seedworm had infiltrated U.S. infrastructure and defense supply chain networks [10].

APT35 (also known as Charming Kitten or Mint Sandstorm) sustained a continuous campaign of cyber espionage from late 2024 through the end of 2025, using AI-enhanced targeted spear-phishing and the exploitation of known vulnerabilities [10].

The Canadian Centre for Cyber Security warned that Iran "will very likely use its cyber program to respond to the joint U.S. and Israel combat operations" and that compromises or attempted intrusions targeting U.S. and allied interests had been detected since early February 2026 [11].

Critical Infrastructure in the Crosshairs

The sectors most at risk paint a troubling picture. Iranian state actors and their proxies have historically targeted — and continue to target — water treatment facilities, energy infrastructure, healthcare systems, financial services, and defense contractors [12][13].

The IRGC-affiliated group CyberAv3ngers developed IOControl malware specifically designed to target operational technology (OT) and Internet of Things (IoT) infrastructure in U.S. and Israeli water utilities and fuel management systems [12]. The vulnerability of these systems is acute: many local water plants and healthcare facilities lack the budgets and expertise to install the latest patches or implement robust cybersecurity measures [13].

U.S. intelligence agencies issued a flurry of private warnings in recent days to American companies and government agencies, urging the hardening of potential targets. Authorities expressed particular concern about energy infrastructure, government systems, and the financial services sector [14][15].

A joint fact sheet from CISA, the FBI, the Department of Defense Cyber Crime Center (DC3), and the NSA warned that Iranian cyber actors "may target vulnerable US networks and entities of interest," specifically calling out the Defense Industrial Base, healthcare, energy, and information technology sectors [12].

Source: GDELT Project

Data as of Mar 13, 2026CSV

A Weakened Defense at the Worst Possible Moment

Perhaps the most alarming dimension of this escalating cyber conflict is the state of America's own cyber defenses. The Cybersecurity and Infrastructure Security Agency (CISA) — the lead federal agency responsible for protecting the nation's digital infrastructure — is operating under severe constraints at precisely the moment it is needed most.

CISA has lost approximately one-third of its employees since early 2025, with staffing reduced to roughly 38% of capacity [16][17]. The Trump administration's proposed budget for fiscal year 2026 sought to cut $495 million and nearly 30% of positions at the agency [17]. Key programs have been eliminated or severely reduced, including the counter-ransomware initiative and efforts to promote secure software development [16].

The agency's website indicated it was last updated on February 17 due to a "lapse in federal funding," and CISA announced it would cancel cybersecurity assessments, trainings, and engagements [16][18]. House Appropriations Committee Chairman Tom Cole warned that CISA's personnel were already "stretched thin" and that a shutdown would hinder the country's ability to protect critical infrastructure and hospitals [18].

"The lead U.S. cyber agency is stretched thin as Iran hacking threat escalates," CNBC reported in early March, capturing the dangerous convergence of rising threats and diminishing defensive capacity [16].

Iran's Maturing Cyber Arsenal

The current offensive reflects a decade of investment in cyber capabilities by Tehran. Iran's cyber program has evolved from rudimentary DDoS attacks against U.S. banks in the early 2010s to sophisticated operations capable of targeting industrial control systems, deploying novel malware, conducting election interference, and leveraging AI for social engineering [4][19].

Trellix's 2026 assessment of Iranian cyber capability documented this trajectory, noting that Iranian groups now employ wiper attacks, custom backdoors, supply chain compromises, and coordinated hacktivist operations as part of a layered offensive strategy [19]. The use of ransomware tactics — including data encryption and extortion — has increasingly been adopted not for financial gain but for destructive and psychological impact [20].

Palo Alto Networks' Unit 42 reported that the current escalation represents a significant inflection point, with Iranian cyber operations becoming more closely integrated with kinetic military objectives than in any previous conflict [4]. The attacks are no longer mere nuisances; they represent a genuine threat to national security infrastructure.

The Road Ahead

The convergence of an active military conflict, an organized and motivated adversary, vulnerable critical infrastructure, and a weakened defensive posture creates what cybersecurity experts describe as a uniquely dangerous moment for American cyber resilience.

CISA, the FBI, DC3, and the NSA continue to coordinate with government, industry, and international partners to share actionable intelligence [12]. Private cybersecurity firms including CrowdStrike, Palo Alto Networks, Rapid7, and Arctic Wolf have issued their own advisories and threat briefings urging organizations to patch known vulnerabilities, enhance monitoring, and prepare incident response plans [4][21][22].

The Center for Strategic and International Studies (CSIS) posed the central question directly: "How will cyber warfare shape the U.S.-Israel conflict with Iran?" [23]. The answer is unfolding in real time across the networks of American hospitals, banks, defense contractors, and water treatment plants — and the outcome will depend not just on the sophistication of Iran's attacks, but on whether the United States can mount an adequate defense with the resources it has left.