Since the U.S.–Iran war began on February 28, 2026, Iranian government cyber units, Iran-affiliated threat groups, and so-called hacktivists have increased their malicious activities against U.S. organizations, critical infrastructure, government officials, defense-related companies, and of course, individuals considered hostile to Tehran.
Imagine that!
The attacks have included destructive malware, data theft, industrial control system intrusions, water system disruptions, espionage, telecom tracking, and… (a partridge in a pear tree?).
Well, no pear trees, but definitely psychological attacks, like doxxing Israelis, Iranian dissidents, journalists by revealing detailed and sometimes embarrassing information about them. Also death threats, bounties, SMS mass messaging, and doing their best to create fear around their success (and therefore America’s imminent downfall).
In other words, Iran has not created one giant cyber superweapon. Far from it.
It has merely discovered that the United States has a very large number of systems connected to the Internet that are, shall we dare say, openly vulnerable.
And like any good cyber adversary, it has been mightily messing with them.
What Have They Been Doing?
Listing all the attacks and summary details would fill volumes of not so interesting reading.
So, here are some highlights:
Handala, Doxxing, and Cyber-Enabled Intimidation
One of the clearest officially attributed Iranian operations involves Handala Hack, tied to Iran’s Ministry of Intelligence and Security (MOIS). The group published stolen personal information on dissidents, journalists, Israeli personnel, and others viewed as enemies of Tehran. It also issued threats, exposed home addresses, and used stolen data to intimidate targets and amplify fear.
This wasn’t just hacking for information. It was hacking designed to make a credible threat follow you home.
Stryker Cyberattack
In March, medical technology company Stryker suffered a major cyberattack that disrupted its Microsoft environment and affected manufacturing, shipping, and order processing.
Handala claimed responsibility, and the Justice Department later linked infrastructure used by the group to Iran’s MOIS.
This attack was a lot more than displaying a banner saying, “You’ve been hacked.” A global medical technology company had core business operations disrupted.
Way different league.
Los Angeles Metro Breach
Los Angeles Metro suffered a cyber intrusion involving substantial data theft and disruption to some technology services. Israeli researchers attributed the attack to an Iranian group called Ababil of Minab, reporting that hundreds of gigabytes of data were stolen. Metro confirmed the breach but did not independently confirm Iranian responsibility.
Somebody definitely got in. Researchers say Iran. Absolute attribution remains less certain.
Malware Delivered Through Telegram
The FBI disclosed MOIS-linked malware operations using Telegram as command-and-control infrastructure. Victims were tricked into running malicious software disguised as legitimate applications. Once installed, it could steal files, capture screenshots, and provide attackers remote access.
Targets included dissidents, journalists, opposition groups, and others of intelligence interest to Tehran. Telegram, apparently, isn’t simply for group chats anymore.
FBI Director’s Personal Email Compromised
How embarrassing… Iran-linked hackers claimed to have compromised FBI Director Kash Patel’s personal email, publishing private photographs and hundreds of messages. The FBI said government information was not compromised because the account was personal. But, that doesn’t make it harmless.
Personal email can expose relationships, routines, contacts, and communications useful for intelligence, coercion, or embarrassment. Foreign intelligence services definitely don’t lose interest because you logged out of your work account.
Attacks on Industrial Control Systems
This is where the story gets considerably more serious.
U.S. agencies warned that Iran-affiliated attackers were targeting Internet-facing Programmable Logic Controllers, Human-Machine Interfaces, and SCADA systems supporting water, wastewater, energy, government, and facility operations.
Attackers manipulated project files, displays, and control environments, with federal agencies reporting operational disruption and financial losses.
Early warnings focused on Rockwell Automation/Allen Bradley equipment. Later guidance expanded to Schneider Electric, Siemens, and other industrial systems.
Which raises an uncomfortable question:
Why were systems controlling physical infrastructure reachable from the public Internet?
Excellent question.
Water Systems Targeted
Most of the control technology attacks have been to water utilities. In July, more than 30 community water systems in Minnesota were hit by coordinated cyberattacks, with similar incidents reported elsewhere; as many as 50 additional water utilities in 11 other states. Attackers changed passwords, altered network configurations, locked out operators, and in some cases disrupted operations.
Iran-linked actors were suspected, and groups previously associated with Iran claimed parts of the broader campaign. But not every incident has been formally attributed by the U.S. government. Politics is involved here, along with social engineering that promotes or diminishes the fear factor.
The good news is, thus far, the damage done hasn’t been severe. No water utility has stopped operations in providing service.
Gas Station Tank Gauges
U.S. officials also investigated attacks on Internet-connected Automatic Tank Gauge systems used at gas stations. Iranian involvement was suspected, while some affected systems were reportedly exposed with weak or nonexistent authentication.
Sophisticated cyberweapon? Not exactly. Industrial equipment sitting on the Internet without adequate security? Unfortunately, yes.
Tracking U.S. Personnel Through Cellular Networks
Coming in as rather more sophisticated… Iranian intelligence reportedly exploited weaknesses in global cellular signaling systems, including SS7, together with commercial location data, to help locate U.S. military personnel and contractors in the Middle East.
This is strategically significant because cyber intelligence can support physical targeting.
Usually we worry about attackers just stealing data. Here, the data may help tell someone exactly where to aim.
Defense and Critical-Infrastructure Espionage
Iranian operators have also targeted aerospace, defense manufacturing, telecommunications, satellite, government, and military-related organizations. Espionage may be less dramatic than knocking systems offline, but it can be far more valuable.
Destroying a server gets attention. Quietly reading a defense contractor’s engineering files may get results.
What Has Changed?
Iran has conducted cyber operations against the United States for years. What appears to have changed during this war is the connection between cyber operations and military objectives. Which includes:
- Gathering intelligence.
- Disrupting infrastructure.
- Locating personnel.
- Supporting physical targeting.
- Conducting psychological operations.
- Establishing access for future use.
That last category is particularly important. Not every intrusion is intended to cause immediate damage. Sometimes the objective is simply to get inside and wait. Cybersecurity professionals call that pre-positioning.
Executives may prefer another term: a problem you haven’t discovered yet.
The Bottom Line
is not cyber Armageddon. Iran has not demonstrated anywhere close to the ability to switch off the United States. But it doesn’t need to.
Smaller manufacturers, municipal utilities, healthcare suppliers, transportation systems, telecommunications providers, and defense subcontractors all provide useful targets.
Iran’s strategy appears increasingly practical: attack softer systems, gather intelligence, create disruption, support military objectives, and exploit whatever organizations have failed to secure.
The scary part is not that Iran has one giant red button. The scary part is that America has thousands of smaller ones. And quite a few of them still use the default password.
References
- U.S. Department of Justice — Iranian Cyber-Enabled Psychological Operations / Handala
https://www.justice.gov/opa/pr/justice-department-disrupts-iranian-cyber-enabled-psychological-operations - FBI — 2026 Cyber Alerts
https://www.fbi.gov/investigate/cyber/alerts/2026 - FBI — Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across U.S. Critical Infrastructure
https://www.fbi.gov/investigate/cyber/alerts/2026/iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure-update - Reuters — Stryker Says Cyberattack on Its Network Contained
https://www.reuters.com/technology/stryker-says-cyberattack-its-network-contained-2026-03-17/ - Reuters — U.S. Agency Asks Companies to Secure Microsoft Tool After Stryker Cyberattack
https://www.reuters.com/business/us-agency-asks-companies-secure-microsoft-tool-after-stryker-cyberattack-2026-03-19/ - Reuters — Iran-Linked Hackers Claim Breach of FBI Director’s Personal Email
https://www.reuters.com/world/us/iran-linked-hackers-claim-breach-of-fbi-directors-personal-email-doj-official-2026-03-27/ - Reuters — Iranian Hackers Responsible for Los Angeles Transit System Breach, Researchers Say
https://www.reuters.com/legal/litigation/iranian-hackers-responsible-los-angeles-transit-system-breach-israeli-2026-05-26/ - Reuters — Coordinated Cyberattack Hits More Than 30 Minnesota Water Systems
https://www.reuters.com/legal/litigation/minnesota-it-officials-disclose-coordinated-cyberattack-more-than-30-local-water-2026-07-28/ - CSIS — How Tehran’s Use of Cyber Operations in the U.S.-Iran Conflict Has Evolved
https://www.csis.org/analysis/how-tehrans-use-cyber-operations-us-iran-conflict-has-evolved - CSIS — Mapping Iranian Cyberattacks on U.S. Water Systems
https://www.csis.org/analysis/mapping-iranian-cyberattacks-us-water-systems - CSIS — Iranian Cyber Threat to U.S. Critical Infrastructure
https://www.csis.org/analysis/iranian-cyber-threat-us-critical-infrastructure - Censys — Iran-Linked Operators Suspected in Automatic Tank Gauge Breaches
https://censys.com/blog/iran-linked-operators-suspected-in-atg-breaches/ - Financial Times — U.S. Military Smartphones Targeted Through Roaming and Advertising Technology
https://www.ft.com/content/44351c74-03c8-45ab-823b-5805c0daca5f