Iran's Cyber Warfare Tactics Escalate Amid Conflict

Hacking, disinformation, and AI-powered attacks target critical infrastructure and sow chaos

Mar. 29, 2026 at 4:57am

Got story updates? Submit your updates here. ›

As tensions between Iran and its adversaries escalate, the digital battlefield has become a key front in the conflict. Iran-linked hacking groups are launching a barrage of cyberattacks targeting U.S. and Israeli companies, hospitals, data centers, and other critical infrastructure, often using sophisticated tactics like spyware and deepfake disinformation. While the attacks may not cause major damage, they are designed to undermine confidence, sow chaos, and compensate for Iran's military disadvantages.

Why it matters

The integration of cyber warfare tactics into modern conflicts highlights how digital threats have become an integral part of modern warfare. The attacks on hospitals, data centers, and other vital infrastructure show how hackers can leverage technology to inflict harm without direct physical confrontation. This trend raises concerns about the vulnerability of essential services and the potential for escalating digital conflicts to have real-world consequences.

The details

Iran-linked hacking groups have launched nearly 5,800 cyberattacks so far, targeting U.S., Israeli, and other regional companies and organizations. While many of the attacks are relatively low-impact, they can still cause significant disruption by exploiting outdated security measures. The hackers have also used sophisticated tactics, such as sending malicious links to Israelis fleeing missile strikes, to gain access to devices and data. Additionally, Iran has turned to AI-powered disinformation campaigns to spread false narratives and undermine trust in authorities.

  • The recent spyware attack on Israelis fleeing missile strikes occurred in real-time, representing a novel combination of digital and physical attacks.
  • In recent years, Iran-linked groups have infiltrated the email system of former President Donald Trump's campaign, targeted U.S. water plants, and tried to breach networks used by the military and defense contractors.

The players

Check Point Research

A cybersecurity firm with offices in Israel and the U.S. that has investigated the recent spyware attack on Israelis.

DigiCert

A Utah-based security firm that has tracked nearly 5,800 cyberattacks mounted by nearly 50 different groups tied to Iran.

Handala

A pro-Iranian hacking group that claimed responsibility for infiltrating an account of FBI Director Kash Patel.

Halcyon

A cybersecurity research firm that recently published findings on a cyberattack targeting a healthcare company, which they believe was motivated by destruction and chaos rather than profit.

Tulsi Gabbard

The Director of National Intelligence, who recently told Congress that AI will increasingly shape cyber operations for both attackers and defenders.

Got photos? Submit your photos here. ›

What they’re saying

“This was sent to people while they were running to shelters to defend themselves. The fact it's synced and at the same minute … is a first.”

— Gil Messing, Chief of Staff, Check Point Research

“There are a lot more attacks happening that aren't being reported.”

— Michael Smith, Field Chief Technology Officer, DigiCert

“As this conflict continues, we should expect that targeting [of the medical sector] to intensify.”

— Cynthia Kaiser, Senior Vice President, Halcyon

“AI will increasingly shape cyber operations with both cyber operators and defenders using these tools to improve their speed and effectiveness.”

— Tulsi Gabbard, Director of National Intelligence

What’s next

Authorities in the U.S. and Israel are working to strengthen cybersecurity measures and counter disinformation campaigns as the digital conflict with Iran continues to escalate. The State Department has also opened a new Bureau of Emerging Threats to focus on the risks posed by new technologies like AI and hacking.

The takeaway

The integration of cyber warfare tactics into the Iran conflict underscores how digital threats have become a central component of modern warfare. As Iran seeks to compensate for its military disadvantages, the use of hacking, disinformation, and AI-powered attacks against critical infrastructure highlights the growing vulnerability of essential services and the potential for digital conflicts to have real-world consequences.