Cyber Advisory: Increased Cyber Risk Amid U.S.–Israel–Iran Escalation

This is a developing situation: The analysis below reflects publicly available reporting and historical threat intelligence as of March 2, 2026.

On February 28, 2026, coordinated military strikes involving the United States and Israel targeted locations in Iran. International media sources have confirmed that Iran’s Supreme Leader, Ayatollah Ali Khamenei, was killed in the strikes. Subsequent reporting indicates that Iran has launched retaliatory actions, including missile attacks in the region.

Historically, periods of direct military escalation in the Middle East have correlated with increased concern about cyber activity from state-aligned and ideologically motivated threat actors. During heightened tensions, Iran-linked actors have shown a willingness to conduct disruptive and psychologically oriented operations. Organizations should review detection, incident response, and resiliency measures accordingly.

Updated Advisory (March 2, 2026)

Sophos X-Ops Counter Threat Unit (CTU) have observed a surge in hacktivist activity, but not an escalation in risk, across Telegram, X, and underground forums following the February 28 strikes, primarily from pro-Iran personas including Handala Hack team and APTIran. Activity has largely consisted of distributed denial-of-service (DDoS) attacks, website defacements, and unverified claims of compromises involving Israeli infrastructure.

Many of the alleged compromises shared via social media remain unverified. Historically, hacktivist groups involved in regional geopolitical conflicts exaggerate operational impact or recycle previously leaked data to amplify effects. Organizations should differentiate between online claims and confirmed intrusions and rely on trusted threat intelligence sources for validation.

Emerging and reactivated groups, including Cyber Toufan, Cyber Support Front, Iranian Avenger, and Cyb3r Drag0nz, are primarily engaging in unsophisticated tactics, broad and embellished claims, and amplifying retaliatory messaging, while the BaqiyatLock ransomware-as-a-service group has publicly offered free affiliate access to actors targeting Israeli interests.

Organizations in the United States and Israel should maintain heightened vigilance for DDoS activity, credential attacks, hack-and-leak campaigns, and opportunistic ransomware operations framed as ideological retaliation. Organizations in GCC states should likewise remain vigilant, as hacktivists often conduct actions in support of, or in perceived alignment with, their cause. It would not be surprising to see such activity expand to additional countries in the region, including those listed above.

Original Advisory (March 1, 2026)

Sophos X-Ops assess the likelihood of opportunistic and potentially disruptive cyber activity has increased in the near term and provide guidance for organizations during this time.

Executive Assessment

• Threat Level: Elevated
• Primary Risk Window: Immediate to short term (days to weeks)
• Most Likely Activity: Disruptive, opportunistic, or influence-oriented operations
• Potentially Impacted Sectors: Government, critical infrastructure, financial services, defense-adjacent commercial entities

Threat Landscape Context

Threat actors publicly attributed by multiple governments and security researchers to Iranian state interests have previously conducted operations through proxy groups or online personas. These entities have claimed responsibility for attacks, disseminated stolen data, and amplified narratives intended to impose reputational or operational costs. For example:

• The “HomeLand Justice” persona has been publicly linked to politically motivated wiper and “hack-and-leak” operations against Albanian government entities since 2022.
• On February 28, 2026, Handala Hack, a hacktivist persona linked to Iran’s Ministry of Intelligence and Security (MOIS), claimed attacks in Jordan and threatened other countries in the region. This group routinely overstates their capability and impact of attacks however on occasion has been capable of executing data theft and wiper attacks.

As the situation develops, the likelihood increases that proxy groups or ideologically motivated actors (hacktivists) may take action, including cyberattacks, against Israeli- and U.S.-affiliated military, commercial, or civilian targets. Such activity would most likely include:

• Website defacement campaigns
• Distributed denial-of-service (DDoS) attacks
• Ransomware deployment
• Wiper malware deployment
• Hack-and-leak attacks under the guise of a data theft extortion attempt
• Repackaging or amplification of previous data breaches
• Opportunistic targeting of internet-exposed systems
• Credential-based attacks such as phishing and password spraying

While some Iranian military and intelligence-linked groups have historically overstated operational success, they remain capable actors. Documented activity attributed to Iran-linked actors has included data theft, ransomware deployment, wiper malware, and public release of stolen information. Historically reported targets have included government entities, critical infrastructure operators, and financial sector organizations.

Recommended Defensive Measures

Sophos X-Ops recommends heightened vigilance across organizations. Key defensive readiness measures include:

Identity & Access Controls

• Enforce multi-factor authentication (MFA) across remote access and privileged accounts
• Monitor for password spraying and anomalous authentication activity
• Review privileged access and apply least-privilege principles

Exposure Reduction

• Patch internet-facing systems against known vulnerabilities
• Conduct external attack surface reviews, minimizing exposed services
• Validate VPN and remote access configurations

Detection & Response

• Ensure EDR/XDR solutions are fully operational and monitored
• Increase alert triage sensitivity for phishing and credential abuse campaigns
• Review logging and telemetry coverage across cloud and on-prem environments
• Provide a mechanism for employees to report suspicious requests received via email, telephone, social media and messaging apps

Resilience & Recovery

• Validate backup integrity, including offline or immutable copies
• Review incident response playbooks and executive notification workflows
• Exercise business continuity procedures against ransomware or destructive malware scenarios

Information Recovery

• Rely on established, reputable, and long-standing sources for geopolitical and cybersecurity reporting
• Use trusted authoritative sources to validate emerging claims, potential misinformation, or disinformation before operationalizing decisions
• Reinforce internal guidance to prevent amplification of unverified or misleading information

Organizations should prioritize defense-in-depth, enhanced detection capabilities, incident readiness, and user awareness. Cyber activity associated with geopolitical developments can persist beyond immediate news cycles, making sustained vigilance important.

MITRE ATT&CK Observations and Anticipated Techniques

Based on historical activity publicly attributed to Iran-aligned threat actors, the following MITRE ATT&CK techniques are assessed as most relevant during periods of geopolitical escalation.

While no specific campaign has been confirmed in connection with the current events at the time of publication, organizations should monitor for the following behaviors:

Initial Access

• T1566 – Phishing (including spearphishing attachments and links)
• T1190 – Exploit Public-Facing Application
• T1133 – External Remote Services (VPN and remote access exploitation)

Credential Access

• T1110 – Brute Force (including password spraying)
• T1555 – Credentials from Password Stores
• T1003 – OS Credential Dumping

Persistence & Privilege Escalation

• T1098 – Account Manipulation
• T1055 – Process Injection

Defense Evasion

• T1562 – Impair Defenses
• T1070 – Indicator Removal on Host
• T1027 – Obfuscated or Compressed Files and Information

Command & Control

• T1071 – Application Layer Protocol
• T1105 – Ingress Tool Transfer
• T1573 – Encrypted Channel

Impact

• T1486 – Data Encrypted for Impact (Ransomware)
• T1485 – Data Destruction (Wiper Activity)
• T1490 – Inhibit System Recovery
• T1491 – Defacement

Historically observed campaigns have often combined credential-based access, lateral movement, and destructive payload deployment with concurrent information operations such as stolen data leaks or defacement messaging.

Organizations should ensure detection and response capabilities are tuned to identify behaviors associated with these techniques, particularly across identity infrastructure, externally exposed services, and backup systems.

Sophos X-Ops continues to monitor developments across technical telemetry, open-source reporting, and partner intelligence channels. We will publish updates if material changes in cyber activity are observed. Please monitor our GitHub for Indicators of Compromise.

For additional resources to support, please visit:

• CISA Shields Up: https://www.cisa.gov/shields-up
• Iran Threat Overview and Advisories (CISA): https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran
• NCSC Recommended Actions During Heightened Threat Periods: https://www.ncsc.gov.uk/guidance/actions-to-take-when-the-cyber-threat-is-heightened
• ENISA Cyber Resilience Guidance: https://www.enisa.europa.eu/publications/boosting-your-organisations-cyber-resilience