What does the Iran war tell us about the relationship between cyber and kinetic conflict?

Do cyber operations scale with kinetic conflict? After a conflict begins, we tend to assume they do. The many wipers deployed amidst the Russian invasion of Ukraine in 2022 and Iran’s destructive and hack-and-leak operations against Israeli targets in 2023-24 during the Gaza war suggest as much. The headlines after the 28 February 2026 strikes that killed Supreme Leader Ali Khamenei and began the most recent US-Israel-Iran war warned of imminent retaliation from Iran through cyberattacks.

A parallel flood of low-quality threat analysis, much of it AI-generated, has covered so-called Iranian war-related cyber activity, but misattributed operations, recycled historical incidents, or fabricated claims as evidence of escalation. This has misrepresented the threat picture and created noise, making it harder to find the signal and establish an accurate assessment of the landscape.

Despite widespread expectations of retaliation, Iranian cyber activity following the February strikes was consistent with Iran’s established peacetime playbook – focused on foreign intelligence collection for espionage purposes – rather than the predicted coordinated retaliatory wave, challenging assumptions about how cyber operations function in wartime.

A quieter war

Where disruption did occur after 28 February, it followed a familiar pattern. For example, on 11 March, Handala – an Iranian Ministry of Intelligence and Security (MOIS)-affiliated ‘hacktivist’ group – took credit for an intrusion into US medical device company Stryker, abusing the company’s Microsoft corporate environment to disrupt order processing, manufacturing, and shipping operations. 

Handala typically claims credit through hack-and-leak operations after disruptive attacks. In the Stryker case, no evidence supports suggestions that an Iranian actor obtained access specifically for retaliation rather than leveraging preexisting access. 

As with most purported hacktivist activity, the incident caused real operational disruption but was amplified for narrative effect. The hack-and-leak playbook – public claim of responsibility, data leaks, and coordinated amplification – is designed to reach past the target itself, a signal  to domestic Iranian audiences, adversary governments, and international observers alike.

Similarly, several hacktivist groups carried out DDoS attacks and website defacements, in which claims of scale and impact were exaggerated. They were posted to Telegram, reshared across affiliated channels, and picked up as fact. The damage was likely negligible; the effect was psychological, not operational.

Other disruptive activity was attributed to or suspected to come from Iran during the same timeframe. In March, the Los Angeles Metropolitan Transportation Authority was breached by a reportedly MOIS-linked group in a destructive incident that deleted virtual machines and backups. In July, Iran was again implicated in attacks against water utilities across several US states. A four-day outage at a small UK power generator was publicly linked to Iran, although attribution remains unconfirmed. Most recently, the Iranian state-linked Mehr News Agency claimed a cyberattack on a US-bound oil tanker had compromised the ship’s engine-room systems. 

IRGC-affiliated actors have been running these same sorts of low-sophistication, high visibility attacks against exposed operational technology devices since at least 2023, already targeting US water facilities; the 2026 utility attacks follow a predictable pattern. Similarly, MOIS-linked actors using the hack-and-leak model also emerged during the 2023-24 Israel-Hamas war and have operated along the same lines since. The main thing that has changed is the volume of media attention and, in the case of the tanker, that Iran’s own state media generated the dramatic claims directly, without a front. 

Tracking of Iranian phishing campaigns from January through August 2026 shows similar patterns of intelligence collection, consistent with pre-war conditions. 

Prior to the recent war, the threat group known as Muddywater (aka Mango Sandstorm, TA450, also affiliated with the MOIS) carried out regular campaigns against Middle Eastern and US targets using lures themed around conferences and aerospace, delivering malicious attachments that dropped custom malware. 

Charming Kitten (Mint Sandstorm, TA453, linked to the Islamic Revolutionary Guard Corps, IRGC) operated on a different model, using benign conversation starters as an approach to target thinktanks and university faculty, spoofing researchers and academics to build rapport before following up with credential phishing. 

Based on Proofpoint telemetry, another Iranian actor, UNK_SmokeScreen (Obsidian Sandstorm), has used a similar routine – benign conversations, credential phishing, occasional malware delivery – to target academia, thinktanks, NGOs, and media.

After 28 February, all of these threat groups went quiet. The silence held for roughly four to six weeks, across all actors regardless of their individual pre-war activities. Some actors eventually returned; others have not been seen since. In the phishing realm, only IRGC-affiliated actors have resurfaced; at the time of writing, MOIS-affiliated phishing actors do not appear to have returned to email activity, even as MOIS-linked groups remained active in the disruptive space. 

Those that came back picked up essentially where they left off: same techniques, same volume, same cadence. No evidence of adaptation or escalation was observed. There was no indication of destructive operations (those which cause permanent damage, rather than the interruptions and recoverable impacts of disruptive campaigns), wipers, or disinformation in email campaigns, as has been seen in prior conflicts. The activity remained largely consistent with pre-war patterns: focused on espionage, targeting the US, Europe, and Middle East.

Separating capability from effect

Post-war activity indicates that Iranian government priorities across both espionage and disruption remained consistent. While actors suspected of alignment with other states used the war in lures and showed a new emphasis on targeting Middle Eastern governments, Iranian actors didn’t seem to change. This indicates that the lack of retaliatory wave was a deliberate choice – or the result of constraints that look like a choice. 

The gap between Iran’s capability and intent is also worth examining. There were clear signs of disruption for some actors – extended silences, operator downtime, damage to command infrastructure, and the operational effect of the 88-day internet blackout – but also steady activity and consistent intent from others. 

The IRGC-MOIS split in phishing, for example, is inconclusive. The halt in MOIS phishing alongside continued MOIS-linked cyber activity in other areas likely points to a tasking shift within MOIS rather than a broader agency pause, but that cannot currently be confirmed.

The disruptive activity that has occurred, meanwhile, has been limited. Stryker caused operational disruption, not destruction. The Los Angeles Metro breach deleted backups but did not affect bus or rail services. The water utility attacks locked out operators but did not contaminate supplies or cause sustained outages. The UK power incident took a small generator offline for four days, with no impact to the wider grid. A US Coast Guard cyber team and the FBI confirmed evidence of malicious cyber activity against ships, but no operational disruption. 

The doomsday predictions of wipers against US infrastructure at scale, hack-and-leak operations against defence and political targets, and coordinated destructive campaigns of the sort deployed in Ukraine never materialised, despite the destructive capability demonstrated in previous conflicts.

Beyond the assumption

Threat assessments during conflict tend to base their analysis on capability and intent signals from peacetime, then assume escalation. In Iran, the data shows that not to be the case. 

The bigger mystery is the phishing actors that went quiet following the initial strikes. Restraint itself can be a signal. Continued MOIS-linked activity alongside the sustained MOIS phishing quiet could be read as strategic signalling or divergent tasking. When – or if – those phishing groups return, whether they resume the same patterns or adapt, reconfigure, and emerge as new groups will tell us a lot about Iranian cyber priorities. 

The data so far has shown what actors couldn’t or didn’t do under wartime conditions; what they choose to do once those conditions lift is the more useful question.