IRGC Media Identifies US Tech Facilities as Potential Targets

On March 1, 2026, Iranian drones struck three Amazon Web Services data centers across the United Arab Emirates and Bahrain, marking what experts believe was the first deliberate military attack on a hyperscale cloud provider in history [1]. Within days, the IRGC-affiliated Tasnim news agency published a detailed list of U.S. tech companies' regional offices and infrastructure—naming Google, Microsoft, Palantir, IBM, Nvidia, and Oracle—and declared them "Iran's new targets" [2]. A spokesperson for the IRGC-owned Khatam al-Anbiya Headquarters warned civilians to stay at least one kilometer away from these facilities [3].

The message was unmistakable: in the age of cloud computing and AI-driven warfare, data centers are no longer anonymous commercial properties. They are strategic military targets.

The First Cloud Battlefield

The drone strikes on AWS facilities came just two days after the United States and Israel launched Operation Epic Fury—a coordinated military campaign that began on February 28 with strikes targeting Iran's military command, missile infrastructure, and senior leadership, including Supreme Leader Ali Khamenei [4]. Iran's retaliation was swift and multi-domain, encompassing missile volleys, drone swarms, maritime disruption in the Strait of Hormuz, and—in a historic first—kinetic attacks on civilian cloud infrastructure.

The damage was significant. "These strikes have caused structural damage, disrupted power delivery to our infrastructure, and in some cases required fire suppression activities that resulted in additional water damage," AWS said in an update on its status dashboard [1]. Banking systems, payment processors, delivery applications, and enterprise software across the Gulf region went dark. Amazon told customers it expected recovery to be "prolonged given the nature of the physical damage" [5].

Iran's state media outlet Fars News Agency explicitly claimed credit for the Bahrain strike, stating it was launched "to identify the role of these centers in supporting the enemy's military and intelligence activities" [6]. The justification was not random—multiple news organizations have reported that the U.S. military used AI models running on AWS infrastructure for intelligence assessments, target identification, and battle simulations during the Iran strikes [7].

Project Nimbus: The Contract That Made Tech a Target

The IRGC's targeting of U.S. tech firms did not emerge in a vacuum. At the center of the controversy is Project Nimbus, a $1.2 billion cloud computing contract between the Israeli government and Google and Amazon, signed in 2021. Under the contract, Google Cloud Platform and Amazon Web Services provide Israeli government agencies—including its military and intelligence apparatus—with cloud computing, artificial intelligence, and machine learning services [8].

The contract's terms are notable: Google and Amazon are contractually prohibited from denying service to any entity of the Israeli government, including its military, even if such use breaches their standard terms of service [9]. According to reporting by The Guardian, the agreements also contained mechanisms for the companies to secretly alert Israel if a foreign country requested access to Project Nimbus data.

Internal documents obtained by The Intercept revealed that Google knew before signing the deal that it could not control what Israel and its military would do with the technology [10]. The contract provoked fierce internal dissent: in 2024, dozens of Google employees staged sit-ins at the company's New York and Sunnyvale headquarters. A Google Cloud software engineer was fired after shouting "I refuse to build technology that empowers genocide" at a company event. In total, approximately 50 employees were terminated in connection with Project Nimbus protests [8].

For Iran, Project Nimbus and similar arrangements provided the pretext to reframe commercial tech infrastructure as legitimate military targets. "As the scope of the regional war expands to infrastructure war, the scope of Iran's legitimate targets expands," the Tasnim news agency stated [2].

The Expanding Target List

On March 11, the IRGC escalated its rhetoric further. A Khatam al-Anbiya spokesperson declared that "the enemy left our hands open to targeting economic centres and banks belonging to the United States and the Zionist regime in the region" [3]. The warning extended the threat beyond tech infrastructure to encompass the financial sector, putting at risk international banking hubs in Dubai, Riyadh, and Bahrain.

The IRGC's published target list is notable for its specificity. It names not just companies but individual office locations and data center sites across Israeli cities and Gulf states [2]. The list includes:

• Amazon Web Services — already struck in the UAE and Bahrain
• Google Cloud — with significant regional infrastructure tied to Project Nimbus
• Microsoft Azure — operating data centers across the Gulf
• Oracle — with cloud regions in the UAE and Saudi Arabia
• Nvidia — whose GPU infrastructure underpins AI computing in the region
• Palantir — which provides data analytics to intelligence agencies
• IBM — with enterprise and government services across the Middle East

The warning to civilians to maintain a one-kilometer buffer zone around these facilities mirrors language used in conventional military operations before strikes on fixed targets—a deliberate signal of intent [3].

Source: FRED / U.S. Energy Information Administration

Data as of Mar 4, 2026CSV

The Great Migration: Tech Companies Scramble

The response from Silicon Valley has been immediate and dramatic. Nvidia and Amazon temporarily closed their Dubai offices, while dozens of Google employees were stranded in the city after a sales conference as commercial flights were suspended across the region [11]. The U.S. State Department worked to secure military aircraft and charter flights to evacuate American nationals.

More consequentially for the global digital economy, AWS and Microsoft Azure began migrating mission-critical workloads from data centers in the UAE, Bahrain, and Oman to facilities in India and Singapore [12]. AWS evacuated staff and restricted physical access to its damaged Gulf sites. The moves represent a strategic retreat of American cloud infrastructure from the Middle East—a region where tech giants had invested billions in anticipation of serving the Gulf states' ambitious AI and digital transformation agendas.

The disruption extends beyond the data centers themselves. Rest of World reported that the conflict has effectively closed the only two submarine cable routes carrying data in and out of the Gulf region, creating what analysts described as a "digital siege" [13]. For Gulf nations that had positioned themselves as emerging tech hubs, the implications are severe.

A New Doctrine of Hybrid Warfare

Military analysts say Iran's targeting of tech infrastructure represents a doctrinal shift in how state actors conceptualize warfare. Ibrahim Jalal, a Middle East policy analyst, characterized the move as one that "moves beyond the oil playbook into tech infrastructure," noting that AWS, Google, Microsoft, Oracle, Nvidia, and Stargate assets now face "extreme risks" [14].

The shift is symmetrical. U.S. Cyber Command was designated the "first mover" in Operation Epic Fury, with cyber operations beginning before any kinetic weapons were deployed [15]. In the first 48 hours, U.S. and allied forces struck more than 1,250 targets across Iran, while Israel conducted what has been described as the largest cyberattack in history, collapsing Iran's internet connectivity to 1–4 percent of normal levels through multi-layered attacks on BGP routing, DNS infrastructure, and SCADA/ICS systems [16].

The cyber offensive compromised the BadeSaba Calendar prayer app—with more than five million downloads—to send defection messages to Iranian military personnel, hijacked Iran's state news agency IRNA, and severed IRGC command-and-control communications during the critical opening hours [15].

Iran, despite operating under near-total internet blackout, activated approximately 60 hacktivist groups—including pro-Russian collectives—outside its borders. Palo Alto Networks' Unit 42 confirmed active SMS and phishing campaigns delivering malicious mobile malware, alongside widespread DDoS attacks, website defacements, data exfiltration, and early-stage wiper deployments targeting U.S. and Israeli entities [16].

The Legal Gray Zone

The targeting of data centers raises urgent questions under international humanitarian law. Under the laws of armed conflict, legitimate military targets are "those objects which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction offers a definite military advantage" [17].

Data centers that host both civilian services—banking, healthcare, communications—and military applications like AI-driven intelligence analysis exist in a legal gray zone. The dual-use nature of cloud infrastructure means that the same servers processing a consumer's food delivery order may simultaneously be running battlefield simulations for a military client. The principle of proportionality requires that any military advantage from striking such a target be weighed against the expected civilian harm, but in practice, the interconnected nature of cloud computing makes such calculations extraordinarily difficult [18].

The IRGC has framed its targeting as a response to U.S. and Israeli cyber operations against Iran's own civilian infrastructure, including the near-total collapse of internet access affecting 90 million Iranians [4]. "Communications shutdowns isolate ordinary people, preventing them from understanding or documenting what is happening in their own country," the Office of the United Nations High Commissioner for Human Rights noted [19].

Source: GDELT Project

Data as of Mar 11, 2026CSV

Economic Fallout

The conflict's economic reverberations have been immediate and severe. Crude oil prices surged past $100 per barrel as the war disrupted an estimated 20 percent of global oil and natural gas supply through Iranian attacks on shipping in the Strait of Hormuz and strikes on regional energy infrastructure [20]. U.S. crude oil hit a high of $119.50 per barrel, with the national average gasoline price topping $3.50 per gallon—a 21 percent increase from a month earlier [21].

But the disruption to cloud infrastructure introduces a novel economic vector. The Gulf region's data centers serve as critical nodes for financial services, logistics, e-commerce, and government operations across the Middle East, South Asia, and East Africa. The migration of workloads to India and Singapore introduces latency, increases costs, and undermines years of investment by Gulf states seeking to position themselves as digital economy hubs [13].

For the tech companies themselves, the conflict exposes a fundamental tension: the same global footprint that enables them to serve customers worldwide also creates an attack surface that state adversaries can exploit. The billions invested in Gulf data centers—justified by proximity to customers and favorable energy costs—now represent concentrated risk.

What Comes Next

The IRGC's public identification of tech facilities as targets represents more than a tactical escalation in the current conflict. It establishes a precedent that future state and non-state actors may follow—one in which the physical infrastructure of the internet and cloud computing is treated as fair game in armed conflicts.

For the tech industry, the implications are profound. Companies that have spent years building out global infrastructure to reduce latency and improve service must now weigh those benefits against the risk that their data centers become collateral—or deliberate targets—in geopolitical confrontations they neither control nor can easily exit due to binding government contracts.

The attacks have already prompted calls from cybersecurity experts and international legal scholars for new frameworks governing the protection of digital infrastructure in armed conflict [18]. The existing Geneva Conventions and their Additional Protocols were drafted in an era when computing power was housed in government facilities, not commercial server farms serving billions of users. The gap between the law and the reality of modern warfare has never been more apparent.

As one security analyst told Fortune, the drone strikes on Amazon's data centers are "a harbinger of new tactics in future conflicts" and "almost certainly won't be the last" [7]. In a world where the cloud underpins everything from banking to battlefield AI, the old distinction between civilian and military infrastructure has never been more dangerously blurred.