Article Reports Cyber Operations Expanding Amid Iran-U.S.-Israel Conflict
Summary
The article reports that U.S. and Israeli operations against Iran combined kinetic strikes with cyber and information operations, while actors and hacktivists conducted phishing, DDoS, defacements and other activity across the region.
Key points
- The article reports that Iran’s internet infrastructure was reduced to 1–4% functionality, affecting state media, government services and communications.
- It names MuddyWater, APT42, Prince of Persia/Infy, UNC6446 and CRESCENTHARVEST in connection with reported phishing, data theft and server exploitation.
- The article says more than 70 hacktivist organizations carried out DDoS attacks, defacements and credential theft across multiple countries.
- A RedAlert APK reportedly mimicked Israel’s missile alert app.
- The article describes retaliatory missile and drone attacks and reports civilian casualties and infrastructure damage, including at Dubai International Airport and an AWS data center.
- It warns that hacktivist activity and opportunistic ransomware and social engineering could sustain disruption, and recommends credential monitoring, DDoS mitigation and proactive malware defense.
Article Details
- Event Type
- Hybrid military and cyber conflict involving kinetic operations, cyber intrusions, and information operations.
- Impact
- Iran’s internet infrastructure was reportedly reduced to 1–4% functionality, affecting state media, government services, and military communications. The article also reports civilian casualties and infrastructure damage, including at Dubai International Airport and an AWS cloud data center, alongside phishing, data theft, server exploitation, DDoS attacks, website defacements, and credential theft.
MITRE ATT&CK
Threat Actors
CALANQUE IONIdentified among pre-existing cyber actors said to have amplified the conflict through phishing, data theft, and server exploitation. The article gives “Charming Kitten” parenthetically with APT42.CARDINALThe article describes this group as pro-Russian and says it opportunistically aligned with Iranian interests during the conflict.Charming KittenListed parenthetically with APT42 among pre-existing cyber actors said to have amplified the conflict through phishing, data theft, and server exploitation.CRESCENTHARVESTIdentified among pre-existing cyber actors said to have amplified the conflict through phishing, data theft, and server exploitation; the article does not attribute specific actions to this actor individually.InfyListed as “Prince of Persia/Infy” among pre-existing cyber actors said to have amplified the conflict through phishing, data theft, and server exploitation.MuddyWaterIdentified among pre-existing cyber actors said to have amplified the conflict through phishing, data theft, and server exploitation; the article does not attribute specific actions to this actor individually.NoName057(16)The article describes this group as pro-Russian and says it opportunistically aligned with Iranian interests during the conflict.Prince of PersiaListed as “Prince of Persia/Infy” among pre-existing cyber actors said to have amplified the conflict through phishing, data theft, and server exploitation.UNC6446Identified among pre-existing cyber actors said to have amplified the conflict through phishing, data theft, and server exploitation; the article does not attribute specific actions to this actor individually.
Malware
Vendors
Countries
IranA hybrid campaign between Iran, the United States, and Israel — labeled Operation Epic Fury by the US and Operation Roaring Lion by Israel — merged kinetic strikes, cyber intrusions, and information operations toIsraelA hybrid campaign between Iran, the United States, and Israel — labeled Operation Epic Fury by the US and Operation Roaring Lion by Israel — merged kinetic strikes, cyber intrusions, and information operations toUnited StatesA hybrid campaign between Iran, the United States, and Israel — labeled Operation Epic Fury by the US and Operation Roaring Lion by Israel — merged kinetic strikes, cyber intrusions, and information operations to
Industries
GovernmentIran’s domestic internet infrastructure was reportedly reduced to 1–4% functionality, as state media, government services, and military communications came under sustained digital assault.MediaIran’s internet infrastructure was reportedly reduced to 1–4% functionality, impacting state media, services, and communications.MilitaryThe offensive involved state and non-state cyber actors, hacktivists, and large military deployments, demonstrating cyber as a co-equal domain in modern conflict.