U.S. companies brace for Israel-Iran cyber spillover
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Shoshana Gordon/Axios
As Israel and Iran exchange airstrikes, cybersecurity experts are warning that a quieter, but still destructive, digital conflict is unfolding behind the scenes.
- And U.S. companies could soon find themselves in the blast radius.
Why it matters: Iran and Israel are home to some of the world's most skilled hackers. Escalating tensions between the two could spill over into cyberspace, potentially disrupting critical infrastructure, commercial networks and global supply chains.
Driving the news: U.S. cybersecurity organizations are urging businesses to remain on high alert for possible Iranian cyberattacks on domestic infrastructure.
- The Food and Ag-ISAC and the IT-ISAC published a joint statement Friday urging companies to proactively bolster their defenses, noting a history of Iranian state-sponsored hackers and hacktivism targeting U.S. critical infrastructure during previous conflicts.
- Radware, a U.S.-based cybersecurity firm, estimated there's been a 700% increase in Iranian cyberattacks against Israeli targets since Israel launched its initial missile strike on Tehran on June 12.
Threat level: The scale and nature of potential Iranian cyberattacks on American organizations will likely depend on how the U.S. responds to the broader military conflict.
- As of now, the Trump administration has told allies it will not intervene unless Iran directly targets Americans.
- But if that decision changes, Iran could redirect cyber resources toward state-sponsored ransomware campaigns or wiper malware attacks on U.S. infrastructure, Austin Warnick, director of national security intelligence at Flashpoint, told Axios.
Zoom in: Gil Messing, chief of staff at Israel-based Check Point Software Technologies, told Axios that he's observed several disinformation campaigns appearing to originate from Iranian-linked actors in the days following the strikes.
- One such campaign involved a text message sent to thousands of Israelis warning that fuel supplies would be halted at gas stations for 24 hours.
- Another message falsely warned of a possible terrorist attack at a regional shelter, urging recipients to avoid the area — an apparent attempt to sow panic during missile attacks.
- Both messages were crafted to appear as if they came from Israel's Home Front Command, but they were fake, Messing said.
- He added that he's also seen lower-level cyber activity potentially linked to Iran, including DDoS attacks and phishing campaigns.
What they're saying: "Their main objective is intimidation, fake news, [and] disinformation, much more than anything else," Messing told Axios.
- He added that much of the current Iranian cyber activity is "lower profile" — in part because Tehran appears to be focusing the bulk of its resources on physical warfare right now.
The big picture: During traditional military conflicts, cyberattacks are often deployed to incite fear and confusion among civilians. More destructive operations — such as infrastructure attacks — tend to emerge only in the lead-up to major strikes or invasions, as seen before Russia's 2022 invasion of Ukraine.
- Messing said that's why Iran appears to be focusing on disinformation and smaller-scale attacks so far. The goal currently is to incite fear.
Reality check: Israel also poses a formidable cyber threat in this conflict. However, its digital offensives are expected to remain focused on Iranian targets, Warnick said.
- A pro-Israel hacking group claimed responsibility for a cyberattack this morning on Iran's Bank Sepah, causing widespread outages. The group also claims it "destroyed" all of the bank's data.
- Israel has a long history of sophisticated cyber operations, most notably the Stuxnet attack that targeted Iran's nuclear program.
- Its intelligence units, particularly Unit 8200, are also known for advanced cyber espionage capabilities.
What to watch: As with the aftermath of the Oct. 7 Hamas attacks, cybersecurity experts anticipate an uptick in activity from politically motivated hackers seeking to amplify their influence during the conflict.
