CloudSek Report Details Cyber Threats Amid Israel-Iran Escalation
Summary
CloudSek’s situation report reviews cyber activity and spillover risks during the February 27–March 1, 2026 Middle East escalation, including claimed hacktivist operations, disruptions in Iran, regional threats, and defensive recommendations.
Key points
- The report says Iran’s internet connectivity fell to about 4% of normal levels during reported cyber disruption coinciding with the February 28 strikes.
- CloudSek monitored more than 150 hacktivist incidents claimed between February 28 and March 1, mainly DDoS, defacement, and alleged data-theft operations; some claims had limited technical validation.
- The report describes UAE disclosures of foiled cyber campaigns against government and financial sectors, including at least 128 confirmed incidents in early 2026.
- It identifies credential theft, phishing, VPN and edge-device compromise, web shells, and DDoS among the principal regional risks.
- The report warns that energy, finance, government, healthcare, aviation, telecom, and supply-chain organizations outside the immediate conflict zone could face spillover threats.
- Recommended defenses include MFA, credential rotation, remote-access audits, endpoint monitoring, tested offline backups, and heightened threat hunting.
Article Details
- Publisher
- CloudSek
- Report Period
- 2026-02-27 to 2026-03-01; some regional activity is described as ongoing.
- Scope
- Cyber activity and spillover risks associated with the Middle East escalation, including hacktivist claims and impacts on regional and global sectors.
- Sample Size
- More than 150 hacktivist incidents claimed in open channels monitored by CloudSek’s Middle East feeds.
- Key Statistics
- Iran’s internet traffic reportedly fell to roughly 4% of normal levels on 2026-02-28.
- The UAE reported at least 128 confirmed cyber threat incidents in early 2026.
- More than 150 hacktivist incidents were claimed between 2026-02-28 and 2026-03-01; attribution was self-reported and technical validation was limited for some claims.
- Nation of Saviors claimed a 21 GB data theft from a Saudi private entity; the claim is not independently validated in the report.
- Recommendations
- Rotate employee credentials organization-wide and enforce MFA on external access paths, including VPN, RDP, SSH, and cloud administration consoles.
- Audit VPN and remote-access appliances for backdoors, unknown accounts, and unauthorized changes; patch urgently and segment management interfaces.
- Deploy EDR/XDR and log collection across endpoints and servers, and integrate threat intelligence and IOC/TTP updates into SIEM and detection engineering workflows.
- Maintain offline, immutable backups for critical systems and regularly test restoration under simulated wiper or ransomware scenarios.
- Strengthen IT–OT segmentation and strictly limit remote access to ICS environments.
People
Threat Actors
404 CREW CYBER TEAMReportedly conducted operations against Iranian CCTV systems and disclosed web vulnerabilities; the article also names Disrupt0r.Anonymous SylhetListed alongside SylhetGangSG1 and SYLHET GANG SG in the report’s account of DDoS attacks against Middle Eastern government and infrastructure entities.APT33Named as part of Iran’s cyber ecosystem and described as a potential frontline tool in renewed confrontation.APT35Named as part of Iran’s cyber ecosystem and described as a potential frontline tool in renewed confrontation.ARABIAN_GHOSTSIssued threat statements targeting Israel, the United States, Saudi Arabia, and the UAE under #OpIsraelTeam branding, according to the report.Babayo Error SystemAnnounced intended operations against Israel and India; the report notes limited technical substantiation.BD Anonymous TeamReportedly targeted Qatar’s Ministry of Interior online services with DDoS activity.Cyber Islamic ResistanceReportedly announced cooperation with other hacktivist and APT-branded actors to coordinate operations against Israel, the United States, and states hosting U.S. bases.DarkStormTeamClaimed DDoS operations and data-leak activity against Israeli financial entities, with some reported spillover targeting in Saudi Arabia.DieNet NetworkThe report says it led DDoS campaigns against government portals, telecom providers, airports, and financial institutions; the article also lists DieNet Network V5.DieNet Network V5Listed alongside DieNet Network in the report’s account of DDoS campaigns against government portals, telecom providers, airports, and financial institutions.Disrupt0rNamed alongside 404 CREW CYBER TEAM in the report’s account of operations against Iranian CCTV systems and web vulnerabilities.DragonForce MalaysiaReportedly issued threat messaging and mobilization content directed at Israeli infrastructure.GhostPrincessNamed in connection with amplification of #OpIsrael campaigns, coordinated messaging across GCC states, and threats against Israeli utilities and defense-adjacent entities; the article also lists TheGhostsITM.Handala GroupClaimed disruption of Jordanian gas-station infrastructure and asserted a nationwide shutdown; the claim is described as unverified.Keymous PlusAnnounced intended operations against Israel and India; the report notes limited technical substantiation.MuddyWaterNamed as part of Iran’s cyber ecosystem and described as a potential frontline tool in renewed confrontation.Nation of SaviorsClaimed DDoS attacks, website compromise, and data exfiltration, including disruption of Israel’s Education Ministry and a claimed 21 GB theft from a Saudi private entity.OilRigNamed as part of Iran’s cyber ecosystem and described as a potential frontline tool in renewed confrontation.Predatory SparrowNamed in connection with reported Israeli-attributed cyberattacks on Iranian fuel distribution, steel plants, and financial institutions.RipperSecReportedly conducted DDoS campaigns against Israeli government and drone-related assets and issued time-specific disruption announcements.SYLHET GANG SGListed alongside SylhetGangSG1 and Anonymous Sylhet in the report’s account of DDoS attacks against Middle Eastern government and infrastructure entities.SylhetGangSG1Named among groups reported to have conducted DDoS attacks against Middle Eastern government and infrastructure entities; the article also lists SYLHET GANG SG and Anonymous Sylhet.TheGhostsITMListed alongside GhostPrincess in the report’s account of #OpIsrael campaign amplification and threats against Israeli utilities and defense-adjacent entities.
Vendors
Products
BeVigilFor BeVigil users: To further harden your assets, patch critical findings identified in Web App Scanners and CVE Scanners to eliminate low-hanging threats and increase the barrier of entry for attempting threat actors.XvigilFor Xvigil users: Use the Compromised Computer module and Credential Breaches module to check leaked credentials across the deep and dark web. From Magnitude, select HIGH to filter and prioritize critical leaked
Tools
Countries
BahrainIran retaliated with ballistic missiles and drones targeting Israel and U.S. bases across Jordan, Syria, Kuwait, Bahrain, Qatar, Saudi Arabia, and the UAE, while the Houthi movement in Yemen resumed Red Sea attacks.FranceEuropean Union states (notably Germany, France, United Kingdom) – Host financial, industrial, and energy firms active in Gulf and Israeli markets and are frequent targets of Iranian-linked cyber activity.GermanyEuropean Union states (notably Germany, France, United Kingdom) – Host financial, industrial, and energy firms active in Gulf and Israeli markets and are frequent targets of Iranian-linked cyber activity.IndiaSecond-order affected countries including India, European states, Japan, and South Korea face elevated risk from espionage, supply-chain compromise, DDoS, ransomware, and disinformation as threat actors exploit globalIrangeopolitical and cyber landscape in the Middle East following the joint Israeli–United States strikes on Iran launched on 28 February 2026, and the associated cyber operations and spillover risks from 27 February-IsraelIsrael and the United States have conducted coordinated strikes on Iranian leadership, military, and nuclear sites under Operation Roaring Lion/Epic Fury, while Iran has retaliated with missile barrages across IsraelJapanSecond-order affected countries including India, European states, Japan, and South Korea face elevated risk from espionage, supply-chain compromise, DDoS, ransomware, and disinformation as threat actors exploit globalJordanIran retaliated with ballistic missiles and drones targeting Israel and U.S. bases across Jordan, Syria, Kuwait, Bahrain, Qatar, Saudi Arabia, and the UAE, while the Houthi movement in Yemen resumed Red Sea attacks.KuwaitIran retaliated with ballistic missiles and drones targeting Israel and U.S. bases across Jordan, Syria, Kuwait, Bahrain, Qatar, Saudi Arabia, and the UAE, while the Houthi movement in Yemen resumed Red Sea attacks.LebanonSimultaneously, Lebanon and Yemen-based proxies including Hezbollah and the Houthis have increased pressure, elevating maritime, aviation, and related cyber risk exposure.QatarIran retaliated with ballistic missiles and drones targeting Israel and U.S. bases across Jordan, Syria, Kuwait, Bahrain, Qatar, Saudi Arabia, and the UAE, while the Houthi movement in Yemen resumed Red Sea attacks.Saudi ArabiaIran retaliated with ballistic missiles and drones targeting Israel and U.S. bases across Jordan, Syria, Kuwait, Bahrain, Qatar, Saudi Arabia, and the UAE, while the Houthi movement in Yemen resumed Red Sea attacks.South KoreaSecond-order affected countries including India, European states, Japan, and South Korea face elevated risk from espionage, supply-chain compromise, DDoS, ransomware, and disinformation as threat actors exploit globalSyriaIran retaliated with ballistic missiles and drones targeting Israel and U.S. bases across Jordan, Syria, Kuwait, Bahrain, Qatar, Saudi Arabia, and the UAE, while the Houthi movement in Yemen resumed Red Sea attacks.TurkeyTurkey – Regional logistics and telecom hub bridging Europe and the Middle East, with exposure via transit routes and energy corridors.United Arab EmiratesUnited KingdomEuropean Union states (notably Germany, France, United Kingdom) – Host financial, industrial, and energy firms active in Gulf and Israeli markets and are frequent targets of Iranian-linked cyber activity.United Statesthe rapidly evolving geopolitical and cyber landscape in the Middle East following the joint Israeli–United States strikes on Iran launched on 28 February 2026, and the associated cyber operations and spillover risksYemenIran retaliated with ballistic missiles and drones targeting Israel and U.S. bases across Jordan, Syria, Kuwait, Bahrain, Qatar, Saudi Arabia, and the UAE, while the Houthi movement in Yemen resumed Red Sea attacks.
Industries
Aviationto a near-total internet blackout, disruption of government services, media, and parts of energy and aviation infrastructure.DefenseJordan – Hosts U.S. forces and missile defense assets.EducationMultiple firms observed VPN backdoor exploitation, persistent web shells, and multi-sector targeting across finance, healthcare, education, technology, and retail.Energycontributing to a near-total internet blackout, disruption of government services, media, and parts of energy and aviation infrastructure.Financial ServicesAt least 128 confirmed cyber threat incidents in early 2026, heavily affecting government administration, banking, and financial services.Governmentcyberattack in history against Iran, contributing to a near-total internet blackout, disruption of government services, media, and parts of energy and aviation infrastructure.HealthcareMaintain offline, immutable backups for critical systems, particularly ICS/OT, healthcare, and core business applications; regularly test restoration under simulated wiper or ransomware scenarios.Mediahistory against Iran, contributing to a near-total internet blackout, disruption of government services, media, and parts of energy and aviation infrastructure.RetailMultiple firms observed VPN backdoor exploitation, persistent web shells, and multi-sector targeting across finance, healthcare, education, technology, and retail.Shippingransomware, and disinformation as threat actors exploit global interdependencies in energy, finance, shipping, and IT services.TechnologyMultiple firms observed VPN backdoor exploitation, persistent web shells, and multi-sector targeting across finance, healthcare, education, technology, and retail.TelecommunicationsWater utilitiesTargeting of Israeli and U.S. government and defense entities, financial institutions, media, healthcare, water utilities, and critical infrastructure across the Middle East and Western states.