Unit 42 Reports Retaliatory Cyber Activity After U.S.-Israeli Operations
Summary
Unit 42 reports escalating retaliatory cyber activity after U.S. and Israeli operations. It says Iran’s connectivity fell to 1–4%, while groups including Handala and Russian Legion made unverified claims of access to Israeli systems.
Key points
- Unit 42 describes a multi-vector cyber campaign following the U.S. Operation Epic Fury and Israel’s Operation Roaring Lion.
- The report says internet connectivity in Iran fell to 1–4%, potentially hindering operations by state-aligned actors based there.
- Unit 42 says cells outside the region may continue activity with less coordination.
- Handala claims it infiltrated IDF networks and leaked documents; the article provides no independent confirmation.
- Russian Legion claims access to Israel’s Iron Dome system; the claim is unverified in the article.
- Unit 42 tracks Iranian state-sponsored groups it identifies as Serpens and warns of possible targeting of high-value organizations and supply chains.
Article Details
- Event Type
- Reported escalation of a multi-vector retaliatory cyber campaign following U.S. Operation Epic Fury and Israel’s Operation Roaring Lion.
- Impact
- Iran’s internet connectivity reportedly fell to 1–4%, which Unit 42 says may limit near-term cyber activity by state-aligned groups operating inside the country. Handala and Russian Legion claimed intrusions involving IDF networks and Iron Dome, respectively; these claims are not independently confirmed in the article. NoName057(16) is reported to have conducted disruptive operations. Unit 42 warns that activity could extend to high-value targets, supply chains, and critical infrastructure.
Threat Actors
CARDINALThe collective claimed access to Israel’s Iron Dome system and said it controlled radars, intercepted targets, and monitored in real time; the article does not independently confirm the claim.HandalaThe group claimed to have infiltrated IDF networks and leaked documents related to the Magen Tsafoni operation; the article does not independently confirm the claim.NoName057(16)The article describes this pro-Russian group as having targeted municipal, political, and defense entities with disruptive operations.SerpensUnit 42 tracks Serpens as an Iranian state-sponsored constellation whose groups typically use destructive and psychological tactics to project and amplify political messaging.
Products
Countries
IranConnectivity inside Iran has plunged to 1–4%, likely limiting in-country state actor operations while dispersed groups like Handala and Russian Legion claim disruptive strikes — including alleged intrusions into IDFIsraelOperation Epic Fury and Israel’s Operation Roaring Lion on February 28, Unit 42 reports a multi-vector retaliatory cyber campaign by state-aligned actors and global hacktivist collectives is escalating across theUnited StatesFollowing the U.S.