Insikt Group Warns Iran War Could Escalate Cyber and Influence Operations
Summary
Recorded Future’s Insikt Group assesses that the Iran war is driving influence operations and may spur retaliatory cyber activity. It identifies Iranian-aligned networks, likely tactics, and organizational risks, while noting major intrusions were not independentlyly”—
Key points
- Insikt Group says cyber remains an asymmetric capability for Iran and assesses retaliatory cyber activity could escalate; the country's internet blackout may delay groups' operations.
- The article identifies critical infrastructure, government, defense, and defense contractors as potential targets. It notes that large-scale intrusions had not been independently verified as of March 2.
- Scanning, brute forcing, password spraying, and probing after the blackout lifts are cited as possible indicators of groups re-operationalizing; DDoS activity is another signal to watch.
- Handala Hack Team claimed it compromised an Israeli oil and gas company, but the article says the claim was under investigation and indicators were not robust.
- Insikt Group observed conflict-related content from Storm-2035 and ION-79; claims about Iranian military successes were described as unverified or debunked.
- The report describes influence operations using inauthentic accounts and AI-generated media, and outlines three possible conflict scenarios with related cyber and operational risks.
Article Details
- Publisher
- Recorded Future (Insikt Group)
- Report Period
- 2026-02-28 to 2026-03-04; updated 2026-03-04
- Scope
- Regional conflict and Iranian cyber and influence threats, with commercial and organizational risks.
- Key Statistics
- Approximately 900 US-Israeli strikes were conducted in the first 12 hours; the IDF confirmed striking 500 Iranian targets.
- Iranian retaliation targeted at least nine countries.
- Strait of Hormuz transits declined by 90% since the prior week, according to vessel activity analysis by Marine Traffic.
- An AI-generated image tied to claims about the USS Abraham Lincoln reportedly reached more than 5 million views within hours before being debunked.
- Forty senior IRGC commanders were reportedly killed across Iran.
- Recommendations
- Patch all public-facing technologies.
- Watch for scanning, brute forcing, password spraying, probing, and DDoS activity, particularly when Iran’s internet blackout lifts.
- Monitor the organization’s brand for impersonation and coordinated inauthentic activity.
- Assess operational and financial exposure to a 30- or 60-day closure of the Strait of Hormuz.
MITRE ATT&CK
T1021 · Remote ServicesThe report advises monitoring named Iranian APT groups’ established patterns for lateral movement.T1078 · Valid AccountsThe report cites valid-account access as an initial-access concern and says Iranian APT groups may use opportunistic approaches to gain network access.T1110 · Brute ForceBrute forcing is identified as a possible early access attempt to watch for as Iranian cyber forces re-operationalize.T1110.003 · Password SprayingPassword spraying is specifically identified as a possible early access technique to watch for as Iranian cyber forces re-operationalize.T1498 · Network Denial of ServiceDDoS campaigns are described as a possible early signal of Iranian cyber activity.T1595 · Active ScanningActive scanning is identified as an early signal of Iranian cyber forces re-operationalizing; this is presented as an indicator to watch, not confirmed activity against a specific organization.
Threat Actors
APT IRANNamed among pro-Iran hacktivist groups that announced coordinated cyber operations against Israeli and regional targets.CALANQUE IONListed as an Iranian APT group with established patterns for initial access and lateral movement.Cotton SandstormListed as an Iranian APT group with established patterns for initial access and lateral movement.Cyber FattahNamed among pro-Iran hacktivist groups that announced coordinated cyber operations against Israeli and regional targets.Cyber Islamic ResistanceNamed among pro-Iran hacktivist groups that announced coordinated cyber operations against Israeli and regional targets.Handala Hack TeamDescribed as an Iran-affiliated hacktivist front that claimed to have compromised an Israeli oil and gas company; the claim was under investigation and indicators were not yet robust.MuddyWaterListed as an Iranian APT group with established patterns for initial access and lateral movement.Peach SandstormListed as an Iranian APT group with established patterns for initial access and lateral movement.RipperSecNamed among pro-Iran hacktivist groups that announced coordinated cyber operations against Israeli and regional targets.SOLAR IONListed as an Iranian APT group with established patterns for initial access and lateral movement.
Countries
Bahrainstrikes against US military installations and regional allies across at least nine countries — including Bahrain, Qatar, Kuwait, the UAE, Saudi Arabia, Jordan, Iraq, Israel, and Cyprus.Cyprusleast nine countries — including Bahrain, Qatar, Kuwait, the UAE, Saudi Arabia, Jordan, Iraq, Israel, and Cyprus.IranThe United States and Israel launched coordinated strikes on Iran (Operation Epic Fury / Operation Lion’s Roar) that killed Supreme Leader Ali Khamenei and senior commanders, triggering widespread Iranian missile andIraqallies across at least nine countries — including Bahrain, Qatar, Kuwait, the UAE, Saudi Arabia, Jordan, Iraq, Israel, and Cyprus.IsraelThe United States and Israel launched coordinated strikes on Iran (Operation Epic Fury / Operation Lion’s Roar) that killed Supreme Leader Ali Khamenei and senior commanders, triggering widespread Iranian missile andJordanregional allies across at least nine countries — including Bahrain, Qatar, Kuwait, the UAE, Saudi Arabia, Jordan, Iraq, Israel, and Cyprus.KuwaitUS military installations and regional allies across at least nine countries — including Bahrain, Qatar, Kuwait, the UAE, Saudi Arabia, Jordan, Iraq, Israel, and Cyprus.Qatarthe region and significant commercial disruption such as a 90% decline in Strait of Hormuz transits and Qatar declaring force majeure.Saudi Arabiaand regional allies across at least nine countries — including Bahrain, Qatar, Kuwait, the UAE, Saudi Arabia, Jordan, Iraq, Israel, and Cyprus.United StatesThe United States and Israel launched coordinated strikes on Iran (Operation Epic Fury / Operation Lion’s Roar) that killed Supreme Leader Ali Khamenei and senior commanders, triggering widespread Iranian missile and
Industries
Critical infrastructurethreat actors, as well as those with exposure to energy markets, maritime shipping, and critical infrastructure potentially impacted by regional escalation.Defense~900 strikes in the first 12 hours, killing Supreme Leader Ali Khamenei and numerous senior IRGC and defense officials.Defense industrial baseCritical infrastructure, government, defense, and the defense industrial base will be at the top of the targeting list.Energynine countries, causing military and civilian casualties and closing or disrupting regional maritime and energy operations.GovernmentHowever, the Iranian government had not issued any formal statement confirming Mojtaba Khamenei had been chosen as Supreme Leader; Ayatollah Ahmad Khatami, a member of the Assembly of Experts and its powerful GuardianInsuranceMajor commercial impact: Strait of Hormuz transits dropped ~90%, Qatar declared force majeure on gas exports, and regional energy and shipping sectors face sustained volatility and insurance costs.logisticsdata leak claims), potentially followed by destructive state-linked cyber operations targeting energy, logistics, and telecom networks. Operational downtime risk increases.Maritime shippingstate-sponsored or state-aligned threat actors, as well as those with exposure to energy markets, maritime shipping, and critical infrastructure potentially impacted by regional escalation.Medianetwork surge, psychological deterrence), with networks pivoting inauthentic accounts and AI-generated media to shape perceptions.