Crisis in Iran: Are We Entering a New Chapter in a 20-Year Ongoing Cyber Conflict?

Summary

The February 28, 2026, geopolitical developments have increased the risk of potential Iranian cyber retaliation against Western interests. While no new Iranian-attributed cyber activity has been confirmed at this time, the potential for delayed threat escalation remains.

This blog post provides context on the situation and outlines the historically observed modus operandi of known Iranian cyber threat actors, including the tactics, techniques, and operational patterns they have leveraged in past retaliatory campaigns. Understanding this baseline tradecraft is critical to assessing risk in the current environment.

Howler Cell is actively monitoring the situation and maintaining elevated defensive readiness across client environments.

Current Situational Awareness 

No new confirmed threat activity

• There are currently no newly identified Iranian cyber campaigns tied to the February 28 operation.

• No confirmed Iranian-attributed attacks have emerged in direct response.

Known infrastructure, not new IOCs

• Recently circulated IP addresses associated with Iranian operations are not newly identified infrastructure.

• These indicators are consistent with previously documented Iranian activity.

• Cyderes was already blocking and monitoring these IOCs prior to this event and continues to do so.
  

Proactive intelligence monitoring

• Howler Cell is actively hunting for any new indicators of compromise or emerging tactics and techniques.

• Monitoring spans the full attack lifecycle, from initial access through potential data destruction or ransomware activity.

• Any credible new intelligence will trigger direct advisories and proactive threat hunting engagement.
  

Elevated MDR vigilance

• Cyderes MDR services are operating at heightened vigilance in response to the increased geopolitical risk.

• Detection coverage across known Iranian tradecraft has been validated and reinforced.

• Clients should expect continued monitoring, rapid intelligence updates, and proactive defense measures.

Why Historical Context Matters

Iranian cyber retaliation has historically followed recognizable patterns, often leveraging established infrastructure, trusted access, destructive tooling, or proxy actors. While retaliation is not always immediate, it has consistently reflected strategic messaging objectives aligned with geopolitical events. The sections that follow examine previously observed Iranian threat actor behaviors to help security leaders better understand what to watch for in the days and weeks, and months ahead.

Increasing Uncertainty Due to Regime Upheaval

On February 28, 2026, the United States of America and the State of Israel executed a coordinated joint military operation codenamed Epic Fury in order “to dismantle the Iranian regime’s security apparatus, prioritizing locations that posed an imminent threat. Targets included Islamic Revolutionary Guard Corps (IRGC) command and control facilities, Iranian air defense capabilities, missile and drone launch sites, and military airfields” [1]. During this operation, the death of Iran’s Supreme Leader, Ayatollah Ali-Khamenei. The death of Iran’s Supreme Leader, Ayatollah Ali Khamenei was confirmed to be a product of this operation both by the Iranian, American, and Israeli government officials.

The Islamic Republic of Iran has spent the better part of two decades cultivating and deploying cyber capabilities as a core instrument of national power. Iranian threat groups gained their notoriety due to their growing amount of offensive cybersecurity operations post-Stuxnet. Iran switched for a purely defensive cyber-strategy to one that also included offensive operations intending to project force, acquire academic research produced in countries with embargos on the country, exact retribution, and exert asymmetric pressure on targets with stronger military forces.

Outside of cyberspace, the death of Ayatollah Ali-Khamenei represents arguably the most politically disruptive event since the Iranian revolution in 1979 wherein Khamenei was installed [2]. According to Washington, the remaining members of the fractured IRGC now are interested in negation following the death of Khamenei [3]. Meanwhile, Telegram channels allegedly unofficially affiliated with IRGC are claiming that The Public Relations of IRGC department has issued a statement via Iranian Official media stating, “The criminal and terrorist act of the [United States and Israel] is a violation of the obvious religious, moral, legal and customary standards; therefore, the Iranian nation will [seek to inflict] decisive and regretful punishment of the murderers of [Ayatollah Ali-Khamenei]” [4].

This uncertainty leaves organizations and institutes wondering, “what potential cybersecurity blowback should we be prepared for, if any?”.

A Brief History of Iran’s Offensive Cybersecurity Operations

Broadly speaking, we can break Iranian cybersecurity operations into the following macrosegments:

Awakening and Retaliation: 2005 – 2018

During this period, Iran transitioned from a cyber victim to a capable offensive actor, with campaigns driven largely by retaliation and regional competition. By the mid-2010s, Iran's cyber forces had grown from reactive hacktivism and crude wipers into a mature, multi-tiered intelligence and offensive apparatus. Groups developed custom tooling, leveraged cloud infrastructure, and began conducting operations that paralleled the sophistication of Russian and Chinese APTs.
 

Global Repression of Political Dissidents: 2019 - 2022

Between 2019-2022, a string of events in quick succession converged to force Iran to strategically pivot their cyber operations inward.

2019

OilRig (APT34) Toolset Leaked: An anonymous actor publicly dumped APT34's full hacking toolkit, command-and-control infrastructure, and even internal training videos on Telegram [12]. This catastrophically burned a decade of tooling investment and forced Iran to rebuild, ultimately creating a natural pause in large-scale external operations.

Nationwide Fuel Protests: Iran's government shut down the internet entirely for nearly a week to suppress protests following sudden fuel price increases [13]. The regime recognized that diaspora networks, journalists, and opposition media were organizing dissent at unprecedented scale using digital tools.

2020

Killing of Qassem Suleimani: Following the U.S. drone strike, Iran's cyber apparatus was placed on high retaliatory alert, but the expected large external cyber operation never materialized at scale. Instead, intelligence suggests Iran's IRGC turned significant resources inward toward monitoring individuals who might exploit the instability [14]. During this window, Charming Kitten (APT35) began its well-documented pivot toward journalists and dissidents, launching a media impersonation campaign in 2019–2020 that targeted Iranian opposition journalists, academics, and government critics by posing as reporters from the Wall Street Journal, CNN, and Deutsche Welle to harvest credentials.

2022

The 2022 Mahsa Amini protests were particularly significant. Direct correlation was documented between surges in domestic and diaspora targeting by Iranian state cyber actors and periods of internal political protest [15]. When Iranians took to the streets globally, Iranian APTs followed them into their inboxes. Iranian sponsored-state threat actors are chiefly tasked with internal security as its primary mission. As the regime faced its most serious domestic legitimacy challenges since 1979, it pulled its most sophisticated operators toward transnational repression rather than geopolitical sabotage [16].

External Response to the War in Palestine: 2023 - Present 

Iran retooled and re-strategized after the war in Palestine began. Iran maintained their internal and external suppression and retaliation to dissidents within the global Iranian diaspora. The 2022–2023 period onward also saw Iran dramatically expand its hacktivist proxy ecosystem. By June 22, 2025, 120 hacktivist groups were reportedly active in response to the war [17], which allowed it to maintain deniable external pressure while state APTs focused on higher-value human intelligence collection against dissidents and strategic espionage. Critically, Iranian cyber-operations did not abandon the inward-facing posture. Instead, they operate on both tracks simultaneously with distinct groups assigned to each track.

MITRE ATT&CK Technique Profile: Iranian APT TTPs

Significant TTPs used by Iranian-based threat actors include but are not limited to:

Initial Access 

Persistence 

Lateral Movement 

Collection & Exfiltration 

Impact

References 

[1] USCENTCOM, “U.S. Forces Launch Operation Epic Fury,” U.S. Central Command. Accessed: Mar. 01, 2026. [Online]. Available: https://www.centcom.mil/MEDIA/PRESS-RELEASES/Press-Release-View/Article/4418396/us-forces-launch-operation-epic-fury/

[2] Wikipedia, “Iranian Revolution,” Wikipedia. Wikipedia, Mar. 01, 2026. Accessed: Mar. 01, 2026. [Online]. Available: https://en.wikipedia.org/w/index.php?title=Iranian_Revolution&oldid=1341143280

[3] J. Bowden, “Trump says Iran wants to negotiate after assassination of supreme leader,” The Independent. Accessed: Mar. 01, 2026. [Online]. Available: https://www.independent.co.uk/news/world/americas/us-politics/trump-iran-negotiations-khamenei-death-b2929782.html

[4] Army News | Speahnews.ir, “سپاه نیوز | sepahnews.ir,” Telegram. Accessed: Mar. 01, 2026. [Online]. Available: https://t.me/s/sepahnewsir403?before=10513

[5] RadioFreeEurope/Radio Liberty, “Twitter Attacker Claims Iran Link,” Radio Free Europe/Radio Liberty, Dec. 19, 2009. Accessed: Mar. 02, 2026. [Online]. Available: https://www.rferl.org/a/Twitter_Hacked__Attacker_Claims_Iran_Link/1908075.html

[6] Reuters, “China’s Baidu website defaced by Twitter hackers,” Reuters, Jan. 12, 2010. Accessed: Mar. 02, 2026. [Online]. Available: https://www.reuters.com/article/business/media-telecom/chinas-baidu-website-defaced-by-twitter-hackers-idUSTOE60B05U/

[7] R. Falcone, “Shamoon 2: Return of the Disttrack Wiper,” Unit 42. Accessed: Mar. 02, 2026. [Online]. Available: https://unit42.paloaltonetworks.com/unit42-shamoon-2-return-disttrack-wiper/

[8] R. Falcone, “Shamoon 3 Targets Oil and Gas Organization,” Unit 42. Accessed: Mar. 02, 2026. [Online]. Available: https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/

[9] Cylance, “Wayback Machine.” Accessed: Mar. 02, 2026. [Online]. Available: https://web.archive.org/web/20150108041942/http://www.cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

[10] B. Elgin and M. Riley, “Iranian Hackers Hit Sheldon Adelson’s Sands Casino in Las Vegas - Businessweek,” archive.org. Accessed: Mar. 02, 2026. [Online]. Available: https://web.archive.org/web/20150101020028/https://www.businessweek.com/articles/2014-12-11/iranian-hackers-hit-sheldon-adelsons-sands-casino-in-las-vegas#p2

[11] J. O’Leary, J. Kimble, K. Vanderlee, and N. Fraser, “APT33 Targets Aerospace & Energy Sectors | Spear Phishing,” Google Cloud Blog. Accessed: Mar. 02, 2026. [Online]. Available: https://cloud.google.com/blog/topics/threat-intelligence/apt33-insights-into-iranian-cyber-espionage

[12] H. C. Yuceel, “Inside the Shadows: Understanding Active Iranian APT Groups,” Picus Security. Accessed: Mar. 02, 2026. [Online]. Available: https://www.picussecurity.com/resource/blog/understanding-active-iranian-apt-groups

[13] BBC, “Iran protests: At least 12 killed at unrest over petrol price rise.” Accessed: Mar. 02, 2026. [Online]. Available: https://www.bbc.com/news/world-middle-east-50459971

[14] Insikt Group, “Iranian Cyber Response to Death of IRGC Head Would Likely Use Reported TTPs and Previous Access,” Recorded Future. Accessed: Mar. 02, 2026. [Online]. Available: https://www.recordedfuture.com/research/iranian-cyber-response

[15] The Citizen Lab, “Iran,” The Citizen Lab. Accessed: Mar. 02, 2026. [Online]. Available: https://citizenlab.ca/research/iran/

[16] Insikt Group, “Despite Infighting and Volatility Iran Maintains Aggressive Cyber Operations Structure,” CTA-IR-2020-0409, Apr. 2020. Accessed: Mar. 02, 2026. [Online]. Available: https://assets.recordedfuture.com/insikt-report-pdfs/2020/cta-2020-0409.pdf

[17] Unit 42, “Threat Brief: Escalation of Cyber Risk Related to Iran (Updated June 30),” Unit 42. Accessed: Mar. 02, 2026. [Online]. Available: https://unit42.paloaltonetworks.com/iranian-cyberattacks-2025/

[18] MITRE Corporation, “Exploit Public-Facing Application, Technique T1190 - Enterprise | MITRE ATT&CK®.” Accessed: Mar. 02, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1190/

[19] MITRE Corporation, “Phishing, Technique T1566 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Mar. 02, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1566/

[20] MITRE Corporation, “Drive-by Compromise, Technique T1189 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Mar. 02, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1189/

[21] MITRE Corporation, “Scheduled Task/Job: Scheduled Task, Sub-technique T1053.005 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Jun. 09, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1053/005/

[22] MITRE Corporation, “Server Software Component: Transport Agent, Sub-technique T1505.002 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Aug. 25, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1505/002/

[23] MITRE Corporation, “Modify Registry, Technique T1112 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: May 27, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1112/

[24] MITRE Corporation, “Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Jun. 12, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1547/001/

[25] MITRE Corporation, “Remote Services: Remote Desktop Protocol, Sub-technique T1021.001 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Sep. 30, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1021/001/

[26] MITRE Corporation, “Remote Services: SMB/Windows Admin Shares, Sub-technique T1021.002 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: May 15, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1021/002/

[27] MITRE Corporation, “Exploitation of Remote Services, Technique T1210 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Mar. 02, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1210/

[28] MITRE Corporation, “Data from Local System, Technique T1005 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: May 27, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1005/

[29] MITRE Corporation, “Email Collection, Technique T1114 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Mar. 02, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1114/

[30] MITRE Corporation, “Exfiltration Over C2 Channel, Technique T1041 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Mar. 02, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1041/

[31] MITRE Corporation, “Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Sub-technique T1048.003 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Mar. 02, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1048/003/

[32] MITRE Corporation, “Data Destruction, Technique T1485 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Mar. 02, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1485/

[33] MITRE Corporation, “Defacement, Technique T1491 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Mar. 02, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1491/

[34] MITRE Corporation, “Disk Wipe, Technique T1561 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Mar. 02, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1561/

[35] MITRE Corporation, “Data Encrypted for Impact, Technique T1486 - Enterprise | MITRE ATT&CK®,” MITRE ATT&CK®. Accessed: Mar. 02, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1486/