CRIL Reports Escalating Cyber Operations Across the Middle East
Summary
CRIL reports escalating conflict-linked cyber activity across the Middle East, including campaigns by more than 70 hacktivist groups, infrastructure targeting, malicious crisis lures and reported connectivity and maritime disruptions.
Key points
- CRIL says cyber operations intensified alongside military activity from February 28, 2026, targeting connectivity, government services and media networks.
- Researchers identified campaigns by more than 70 hacktivist groups, including DDoS attacks, website defacements, credential theft attempts and disinformation.
- CRIL links Charming Kitten (APT35), APT33, MuddyWater, OilRig and Pioneer Kitten to espionage and infrastructure-targeting activity.
- Researchers identified a malicious app disguised as an Israeli missile-alert app that collected user data.
- The article reports a near-total internet blackout in Iran and navigation disruptions near the Strait of Hormuz that reportedly affected more than 1,100 ships.
- CRIL observed more than 8,000 crisis-related domains and describes malware lures, government-service impersonation and fraudulent donation sites.
- Recommended defenses include MFA, vulnerability patching, continuous monitoring, incident-response readiness and threat-intelligence collaboration.
Article Details
- Event Type
- Reported escalation of cyber operations, hacktivist campaigns, and cybercriminal activity accompanying military conflict in the Middle East.
- Impact
- Reported activity includes disruption of internet connectivity and government and media services, DDoS attacks, defacements, credential-theft attempts, espionage, and attacks targeting infrastructure and multiple sectors. A malicious app disguised as an Israeli missile alert app reportedly collected user data. The article says an operation reportedly caused a near-total internet blackout in Iran and that navigation disruptions near the Strait of Hormuz reportedly affected more than 1,100 ships. The reported activity raises risks to critical infrastructure, maritime transport, and energy supply routes.
Threat Actors
BLEAK IONCRIL researchers link this Iran-associated group to espionage and infrastructure-targeting campaigns.Charming KittenCRIL researchers link this Iran-associated group to espionage and infrastructure-targeting campaigns. The article identifies APT35 as an alternate name.CyberAv3ngersDescribed as an Iranian-aligned hacktivist group that launched DDoS attacks, attempted industrial control system intrusions, and leaked stolen data.DieNetDescribed as an Iranian-aligned hacktivist group that launched DDoS attacks, attempted industrial control system intrusions, and leaked stolen data.HandalaDescribed as an Iranian-aligned hacktivist group that launched DDoS attacks, attempted industrial control system intrusions, and leaked stolen data.MuddyWaterCRIL researchers link this Iran-associated group to espionage and infrastructure-targeting campaigns.OilRigCRIL researchers link this Iran-associated group to espionage and infrastructure-targeting campaigns.Pioneer KittenCRIL researchers link this Iran-associated group to espionage and infrastructure-targeting campaigns.RICH IONThe article identifies APT35 as an alternate name for Charming Kitten, which CRIL researchers link to espionage and infrastructure-targeting campaigns.Team 313Described as an Iranian-aligned hacktivist group that launched DDoS attacks, attempted industrial control system intrusions, and leaked stolen data.
Countries
IranIran-linked threat actors such as Charming Kitten, APT33, MuddyWater, OilRig, and Pioneer Kitten are linked to espionage and infrastructure-targeting campaigns.IsraelAccording to CRIL, the conflict entered a more aggressive phase on February 28, 2026, after an escalation involving Iran, the United States, and Israel.United StatesAccording to CRIL, the conflict entered a more aggressive phase on February 28, 2026, after an escalation involving Iran, the United States, and Israel.
Industries
AviationThese groups typically focus on sectors including aviation, telecommunications, government networks, and energy systems.CommunicationsState-backed groups, hacktivists, and cybercriminals are targeting government, energy, finance, and communications systems across the Middle East.EnergyState-backed groups, hacktivists, and cybercriminals are targeting government, energy, finance, and communications systems across the Middle East.GovernmentState-backed groups, hacktivists, and cybercriminals are targeting government, energy, finance, and communications systems across the Middle East.logisticsThese incidents demonstrate how Middle East cyber warfare can affect international trade and logistics networks.