This year, the Islamic Republic set a new benchmark for its cyber strategy, which extends far beyond the battlefield to include influence operations and intelligence gathering

Iranian cyberattacks on Israel have surged in the wake of the October 7 onslaught by the Iran-backed terror group Hamas, and as the Israel-Hamas war continues to rage, cybersecurity analysts warn these digital incursions will continue regardless of any ceasefire or de-escalation in the Gaza Strip.

Meanwhile, with Israel-Hamas negotiations stalled, Tehran’s hackers, backed by the regime, are further honing their capabilities in what experts say could become a forever war in cyberspace.

Despite efforts to tamp down the flames of war, experts said any calming of hostilities will not stop digital conflict between the two nations.

Iran is upping its cyberwarfare tactics, and is likely to only increase them further regardless of a potential Israel-Hamas ceasefire.
Iranian cyberattacks on Israel have surged in the wake of the October 7 onslaught by the Iran-backed terror group Hamas, and as the Israel-Hamas war continues to rage, cybersecurity analysts warn these digital incursions will continue regardless of any ceasefire or de-escalation in the Gaza Strip.

Meanwhile, with Israel-Hamas negotiations stalled, Tehran’s hackers, backed by the regime, are further honing their capabilities in what experts say could become a forever war in cyberspace.

Despite efforts to tamp down the flames of war, any calming of hostilities will not stop digital conflict between the two nations.

“I don’t think [Iran] is going to be happy with Israel, even in the case of a ceasefire or some sort of improvement in conditions” in Gaza, said Ben Read, who heads cyberespionage analysis at Mandiant, a Google-owned cybersecurity firm.

Iran’s cyber capabilities have become a key element of its broader strategy to defend national interests, deter Western intelligence, and engage in espionage, said John Fokker, who leads threat intelligence at cybersecurity company Trellix. Under the auspices of a branch of the armed forces and a government ministry, Iran has steadily expanded its offensive cyber programs, he said.

Since the Hamas-led October 7 massacre took 1,200 lives in Israel and saw 251 people kidnapped to the Gaza Strip, Iranian operatives and cybercrime groups aligned with the Khamenei regime have escalated their cyberattacks on Israeli government and private sector infrastructure. In retaliation, suspected Israeli-aligned hackers have launched their own cyber offensives, targeting Iranian critical infrastructure, including gas stations.

Iran’s cyberwarfare capabilities have long been in development. In 2012, its “Shamoon” virus crippled 30,000 computers at Saudi Aramco in one of Iran’s most notorious attacks. More recently, in 2020, its hackers targeted Gilead Sciences to steal COVID vaccine research. In 2019, the regime’s cyber operatives carried out a wave of attacks on American cities and airports, highlighting the regime’s ability to disrupt critical infrastructure, Fokker noted.

“These incidents reflect the rapid advancement of Iran’s cyber capabilities, making it a significant threat,” Fokker said.

Now, amid the Gaza conflict, Iranian hackers have targeted Israeli assets more aggressively. In November, the Iran-linked “Cyber Av3ngers” hacking group claimed responsibility for breaching industrial water treatment equipment in America. Tehran is in the global public eye again for cyberwarfare after the US intelligence community said its hackers targeted the Donald Trump and Kamala Harris presidential campaigns.

James Shires, a technology and global affairs expert who co-directs the European Cyber Conflict Research Initiative, said much of Tehran’s work has been centered on influence operations. Iran’s state-sponsored actors have been amplifying propaganda, spreading disinformation and manipulating social media narratives as part of their broader cyber strategy, Shires said.

The war itself has hinged heavily on perception and reputation, Shires said, stressing the importance of online perception battles in modern conflicts.

It’s a two-sided game, though. Israel ran its own secret influence campaign targeting US lawmakers, according to a June report from The New York Times that cited officials involved in the effort and documents tied to the operation.

“Anything that can change that perception is massively valuable for both sides.”

Iranian spin doctors have also embraced artificial intelligence tools to spread disinformation. One AI-driven covert campaign produced fake news websites aimed at influencing American voters, though, according to OpenAI, the effort failed to gain significant engagement.

A ceasefire or any reduction in fighting between Israel and Hamas wouldn’t slow the tempo of Iran’s cyber buildup, Shires said, underscoring the ongoing threat that Iran poses in cyberspace. But he stressed that if a positive diplomatic outcome isn’t reached soon, then a miscalculated cyberattack from either side could skyrocket tensions even further.