Iran-Linked Hackers Target U.S. and Middle Eastern Organizations Amid War
Summary
A report describes pro-Iranian hackers’ claimed disruption of Stryker and attempted targeting of cameras and other organizations since the war began, while experts warn U.S. critical infrastructure and defense-linked firms may face increased cyber activity.
Key points
- Handala claimed responsibility for disrupting systems at Stryker, saying the action was retaliation for suspected U.S. strikes; the article does not independently confirm the group’s claim.
- Since the war began, pro-Iranian hackers have tried to penetrate cameras in Middle Eastern countries, reportedly to aid missile targeting, and have targeted other regional organizations.
- Polish authorities are investigating a cyberattack on a nuclear research facility but say another group may be responsible.
- Experts identify U.S. defense contractors, government vendors, and critical infrastructure—including hospitals, water plants, and power stations—as potential targets.
- Experts describe denial-of-service attacks, website defacements, and hack-and-leak operations as possible tactics, and advise keeping patches and security tools current and removing stale accounts.
- CrowdStrike researchers detected increased activity from Russian hackers supporting Tehran; Z-Pentest claimed responsibility for disrupting several U.S. networks, including ones involving closed-circuit cameras.
Article Details
- Event Type
- Reported cyberattacks and targeting by pro-Iranian hackers during the war, including claimed disruptions of U.S. organizations and suspected targeting of critical infrastructure.
- Impact
- Handala claimed responsibility for an attack disrupting systems at medical technology company Stryker; the article does not independently confirm the group's attribution. Z-Pentest claimed responsibility for disrupting several U.S. networks, including networks involving closed-circuit cameras. Other reported or attempted activity includes camera intrusions for missile-targeting intelligence and targeting of data centers and industrial facilities. Potential consequences include disruption, data destruction, and increased risk to defense, healthcare, energy, water, and transportation infrastructure.
MITRE ATT&CK
T1491.002 · External DefacementWebsite defacements are described as a possible attack method that could prevent organizations from communicating with customers.T1498 · Network Denial of ServiceThe article describes denial-of-service attacks intended to jam networks and prevent legitimate users from accessing them.T1585.001 · Social Media AccountsIranian hackers reportedly set up fake social media accounts to spread false or exaggerated claims.T1656 · ImpersonationIranian hackers reportedly impersonated American activists online to encourage protests against Israel.
People
Adam MeyersHead of counter adversary operations at CrowdStrike; discussed the timing of Z-Pentest's claimed attacks and the apparent targeting of U.S. interests.Ismael ValenzuelaVice president of threat intelligence at Arctic Wolf; characterized Handala's focus as data destruction rather than financial extortion.James TurgalVice president at Optiv and former FBI agent; assessed Iran and its proxies as seeking impact and disruption.Kevin MandiaFounder of Mandiant and Armadin; commented on the risk of cyber activity escalating during the conflict.Shaun WilliamsSenior director at SentinelOne and former FBI and CIA officer; assessed the sophistication of the attacks and advised organizations on defensive measures.
Threat Actors
HandalaClaimed responsibility for the attack that disrupted systems at Stryker and said it was retaliation for suspected U.S. strikes that killed Iranian schoolchildren. The article reports the claim but does not independently establish attribution.Z-PentestClaimed responsibility for disrupting several U.S. networks, including some involving closed-circuit cameras. The article attributes the claim to the group; responsibility is not independently confirmed.
Countries
IranHackers supporting Iran claimed responsibility for a significant cyberattack Wednesday against U.S.IsraelThey have targeted data centers in the region, as well as industrial facilities in Israel, a school in Saudi Arabia and an airport in Kuwait.KuwaitThey have targeted data centers in the region, as well as industrial facilities in Israel, a school in Saudi Arabia and an airport in Kuwait.RussiaRussia and China present the greatest cyber threats to the U.S., while North Korea is a growing concern.Saudi ArabiaThey have targeted data centers in the region, as well as industrial facilities in Israel, a school in Saudi Arabia and an airport in Kuwait.United StatesPro-Iranian hackers are targeting sites in the Middle East and starting to stretch into the United States during the war, raising the risk of American defense contractors, power stations and water plants being swept
Industries
Data centersThey have targeted data centers in the region, as well as industrial facilities in Israel, a school in Saudi Arabia and an airport in Kuwait.DefenseMiddle East and starting to stretch into the United States during the war, raising the risk of American defense contractors, power stations and water plants being swept into a wave of digital chaos that could expandEnergyThe goal is to wear down the American war effort, drive up the costs of energy, strain cyber resources and cause as much pain as possible for American companies that depend on the defense industry.Governmentdefense contractors, government vendors and businesses that work with Israel are likely targets, as is critical infrastructure such as hospitals, ports, water plants, power stations and railways.medical technologypro-Palestinian hackers claimed credit for disrupting systems at Stryker, a Michigan-based medical technology company. A group known as Handala said the attack was in retaliation for suspected U.S. strikesNuclear researchPolish authorities are investigating a recent cyberattack — on a nuclear research facility — that may have ties to Iran, though they acknowledge that another group could be behind the attack and using the Iran war to