Hackers join U.S. and Israel's fight with Iran

Driving the news: A Wednesday cyberattack allegedly linked to Iran‑aligned hackers disrupted operations at Stryker, a major U.S. medical technology company, The Wall Street Journal reported.

• Stryker confirmed in a statement that it is "experiencing a global network disruption to our Microsoft environment," but that it hasn't seen any signs of "ransomware or malware" and now believes the incident is "contained."
• Microsoft declined to comment.
• The same group claimed on X that it hacked U.S.-based payments firm Verifone. The company said it found no evidence of a breach and no service disruption.

Here's what to know about the state of cyberwarfare tactics:

Israel says it's targeting cyber infrastructure

Catch up quick: Israel last week carried out a "wide-scale strike" targeting a collection of military sites in Tehran that allegedly housed the headquarters of the Iranian Islamic Revolutionary Guard Corps, the IDF said on X.

• The IDF claims that the headquarters of the IRGC's "cyber and electronic headquarters" and its "Intelligence Directorate" were among the military outposts hit in the strike.

Yes, but: Iran has been under a near-total internet blackout since the first U.S. and Israeli strikes began, limiting the flow of information coming out of Iran, Politico noted last week.

Cyberattacks from Iran

By the numbers: Iran-aligned hackers and self-described "hacktivist" groups have increased activity against entities in the Middle East, the U.S. and parts of Asia following the Feb. 28 airstrikes, according to CrowdStrike.

• Hydro Kitten, a group that operates on behalf of the Islamic Revolutionary Guard Corps, has indicated plans to target the financial sector, Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, said in a statement earlier this month.

Researchers from cybersecurity company Palo Alto Networks' Unit 42 reported that dozens of pro-Iran hacktivist groups say they have launched several cyberattacks since Feb. 28, mostly targeting critical infrastructure.

• These groups have claimed responsibility for attacks against Israeli payment systems, the shutdown of Kuwaiti government websites, and incidents affecting online services at airports.

Pro-Russian political hackers, called NoName057(16), teamed up with Iranian hacktivists on March 2 to target Israeli defense and municipal organizations, including defense contractor Elbit Systems, according to researchers at Flashpoint.

• The same Russian hacktivists also claimed they broke into an Israeli water management system and other industrial control systems, but researchers could not verify the claim.

How it works: Iran "lacks symmetric conventional response options against the United States and Israel," which is why the regime "has historically relied on cyber operations and a dispersed array of proxy actors as its instruments of response," the Center for Strategic & International Studies notes.

Cyberattacks from U.S., Israel

Zoom in: Israel hacked a popular Iranian prayer app to send notifications to potentially millions of phones last month, urging the country's military personnel to defect from the regime, The Wall Street Journal reported.

• Iranian state media had also reported that news sites, including state news agency IRNA, were hijacked to display articles about the cyberattacks and discredit the regime.

The Israeli military had access to "nearly all" of the traffic cameras in Tehran, the Financial Times reported.

• In partnership with the CIA, Israel used the cameras to target the air strike that killed Ayatollah Ali Khamenei, Iran's supreme leader.
• "Israel used, or very likely used, very cutting-edge kind of data processing or big data fusion techniques that from a kind of layman or citizen perspective you would call AI," Omer Benjakob, a cybersecurity reporter for the Israeli newspaper Haaretz, told NPR.

Zoom out: Israel is likely much further along than the U.S. is in developing its own AI systems for military use, Benjakob said.

The intrigue: Gen. Dan Caine, chair of the Joint Chiefs, said the U.S. Cyber Command and Space Command were among the "first movers" during the initial strike against Iran last month.

Flashback: In February 2024, the chief technology officer of U.S. Central Command, gave the first public confirmation that the U.S. military was using AI to support strikes.

• Central Command's CTO told Bloomberg that the military had used AI to help narrow down targets for more than 85 strikes in Syria and Iraq that month, as well as to identify rocket launchers in Yemen and surface vessels in the Red Sea.

Citizen Lab, a digital rights group, said in October that evidence suggests Israel is "linked" to an "AI-enabled" disinformation campaign to instigate Iranian unrest.

Iran's previous cyber attacks

Last year, an Iranian national pleaded guilty to participating in a ransomware scheme that targeted several U.S. cities and organizations.

• During the 2024 election cycle, Iranian actors hacked Trump's presidential campaign via spear-phishing.
• In 2022, Iranian state-sponsored hackers used file-encrypting ransomware and wiper malware against the Albanian government, knocking websites and services offline.