When Cyberspace Became the Last Battlefield: Iran's Digital War and Its Limits- 208

June 17, 2026

On February 28, 2026, the United States and Israel launched coordinated strikes against Iran under Operations Epic Fury and Roaring Lion, killing Supreme Leader Ali Khamenei and dismantling Iran's conventional military infrastructure within days. What followed in cyberspace was not the digital shock-and-awe many had anticipated from a state long regarded as a capable cyber power. It was something more complex, more instructive, and in many ways more revealing about the true nature of cyber conflict in the age of hybrid warfare: a cascade of operations spanning state actors, intelligence proxies, hacktivist collectives, and opportunistic criminals — asymmetric, noisy, and strategically bounded by the same conventional defeat that had silenced Iran's missiles

The cyber dimension of the conflict did not begin on February 28. It began years earlier, in the patient, methodical work of pre-positioning. US Cyber Command and Israel's Unit 8200 were, in the words of General Dan Caine, Chairman of the Joint Chiefs, the "first movers" of the operation — their work preceding the first airstrike by months if not years. According to a Financial Times investigation drawing on senior US and Israeli officials, Israel had systematically infiltrated Tehran's traffic camera networks, tracking the movements of Khamenei's bodyguards, mapping their shifts, their routes, their patterns of life around his compound on Pasteur Street. "Long before the bombs fell, we knew Tehran like we know Jerusalem," one intelligence official told the newspaper. The operation described was not a cyberattack in the conventional sense — it was persistent, silent surveillance converted at the decisive moment into targeting data. Unit 8200's signals intelligence capabilities, combined with what sources described as an "assembly line" processing billions of data points from cameras, social networks, and communications intercepts, produced what one official called "a single product: targets."

At the moment of the strikes, US Cyber Command moved to blind Iran entirely. Cellular networks around Khamenei's compound were seized, keeping phone lines busy and preventing his security detail from receiving warnings. Iran's national internet connectivity collapsed to approximately one to four percent of normal levels according to NetBlocks monitoring — a blackout affecting ninety million people that lasted over seventy-two hours. State media outlets including the Islamic Republican News Agency and the IRGC-affiliated Tasnim were hacked. In a particularly symbolic operation attributed to Israeli cyber units, BadeSaba, a prayer-timing application with five million Iranian users, was hijacked to deliver messages in Persian calling on military personnel to defect and citizens to protest. The integration of cyber capabilities into the kinetic campaign was, by all accounts, unprecedented in its depth and coordination. Crucially, the US military also disclosed that Anthropic's AI model Claude was used by US Central Command for intelligence assessments and target identification — the most significant publicly confirmed use of commercial AI in a combat operation, which simultaneously triggered a public confrontation between the Trump administration and Anthropic over the limits of AI deployment in warfare.

It is within this geopolitical architecture that China's role must be situated, briefly but clearly. While Tehran fought, Beijing supplied. Satellite imagery from Chinese commercial operator Earth Eye Co provided Iran with precise targeting data for US military facilities in the Middle East. Chinese companies transferred missile fuel precursors — sodium perchlorate sufficient for hundreds of ballistic missiles — through sanctioned vessels operating out of Zhuhai. Reports of shoulder-fired anti-aircraft systems and CM-302 anti-ship cruise missiles followed. China's material support did not translate directly into cyber capability, but it sustained Iran's broader war capacity and signaled to Tehran that it was not entirely isolated — a signal with implications for the willingness to continue operations across all domains, including the digital one.

Iran's cyber retaliation, when it came, did not match the scale of what had been anticipated. US officials speaking at the Asness Summit on Modern Conflict characterized Iran's approach as closer to criminal methodology than state-level shock-and-awe: opportunistic intrusions leveraging stolen credentials purchased on dark web markets, amplified through information operations to appear more devastating than they were. "They bought valid credentials off the dark web," said Kevin Mandia, longtime cyber first responder. "It's low and slow. I would argue that is like a criminal element." Former NSA Director Tim Haugh echoed the assessment, noting that the Stryker operation — the most prominent Iranian retaliatory cyberattack — did not rely on novel malware or zero-day exploits. It relied on a social-engineered employee and legitimate Microsoft Intune credentials used to factory-reset tens of thousands of devices across seventy-nine countries. Devastating in effect, unsophisticated in method.

The Stryker attack brought into sharp relief the actor behind much of Iran's digital offensive: Handala, formally attributed by the US Department of Justice to Iran's Ministry of Intelligence and Security. The FBI seized four of the group's domains, and the DOJ described Handala not as a hacktivist collective but as an intelligence unit using a fictitious activist identity to mask its operational role. The attribution confirmed what Israeli cybersecurity firm Check Point Research had documented for years — that Handala, also tracked as Void Manticore, Storm-0842, and Banished Kitten, was a MOIS counter-terrorism unit commanded by sanctioned deputy minister Yahya Hosseini Panjaki, reportedly killed in the opening strikes. The group's model, as Check Point's Gil Messing described it, was not espionage in the traditional sense: "Their model is to create destruction, make noise, stir chaos, hit targets that will get everyone talking about them, and generally generate a sense of vulnerability." Hack-and-leak over ransomware. Psychological damage over financial extraction. Maximum public exposure over covert persistence.

The operational record bore this out. Before the February strikes, Handala had breached the databases of Clalit Health Services, Israel's largest health fund serving 4.8 million citizens, publishing medical records of over ten thousand patients as a warning. It had defaced the Academy of the Hebrew Language website with the message "No need to learn Hebrew anymore. You won't need it much longer." It had hijacked public address systems in twenty Israeli kindergartens to broadcast air raid sirens. It had hacked the personal Gmail account of FBI Director Kash Patel — retaliation for the FBI's domain seizures — publishing over three hundred emails. It had doxxed 2,379 US Marines stationed in the Persian Gulf, sending WhatsApp messages to their personal phones from a spoofed Bahraini number: "Your identities are fully known to our missile units, and every move you make is under our surveillance." The FBI's takedown of four domains temporarily disrupted the infrastructure. Within twenty-four hours, Handala had rebuilt and was back online. 

The broader Iranian cyber ecosystem mobilized in parallel. Within seventy-two hours of the February 28 strikes, intelligence firm CloudSEK documented over 150 distinct hacktivist incidents involving more than 170 active groups across 16 countries. Phishing attacks against Israeli targets surged 540 percent, with 603 distinct campaigns identified in a single day. The Altoufan Team, linked to the IRGC, claimed SCADA access to Jordan's grain silo network and reported gradually raising storage temperatures in northern facilities — a claim, if credible, representing the spoilage of 75,000 tons of wheat. Russia-aligned actors including NoName057(16) and DieNet joined the campaign, attacking Israeli water infrastructure, telecommunications operators, aviation systems, and Gulf state financial institutions — a convergence of pro-Iranian and pro-Russian operational interests that expanded the threat surface beyond formal alliance structures. 

On the underground data markets, 48 million Iranian civil records, banking data from Mellat, Melli, and Saderat, and IRGC-linked financial exchange databases appeared for sale — a consequence of the simultaneous Israeli offensive exposing Iranian systems to opportunistic extraction.

Iran's own offensive was further constrained by a paradox its leadership had not anticipated: the internet blackout imposed partly by US-Israeli cyber operations and partly by the regime's own defensive disconnections was degrading the operational capacity of its own cyber units. Palo Alto Networks Unit 42 researchers confirmed that the regime's self-imposed network cuts were hampering state cyber operators as much as they were protecting civilian infrastructure. MuddyWater, detected embedded in several US company networks including the Israeli branch of a defense-sector software firm, was found operating with pre-staged infrastructure — C2 domains registered weeks before the kinetic strikes, certificates with seventy-two-hour validity windows, Python-based loaders with provocative naming conventions including a code-signing certificate issued in the name of "Donald Gay" — a deliberate provocation timed to the days immediately following Khamenei's death.

The IRGC-affiliated Tasnim News Agency, meanwhile, published a thinly veiled warning about the vulnerability of undersea fiber-optic cables running through the Strait of Hormuz — seven major communication systems carrying over ninety-seven percent of regional internet traffic, connecting Gulf state data centers to Europe, Asia, and Africa. The warning, accompanied by a detailed cable map, named the Falcon, AAE-1, TGN-Gulf, and SEA-ME-WE systems explicitly. No attack followed, but the signal was clear: as Iran's conventional naval force had been largely destroyed, the sixty percent of the IRGC's asymmetric naval arm that remained operational — fast-attack speedboats — retained the capacity for subsea sabotage. The digital chokepoint had been identified and publicly marked.

What the full arc of this conflict reveals is a structural truth about cyber power that the Iran war has forced into sharper focus than any previous confrontation: cyber operations are force multipliers, not force replacements. The US-Israeli offensive demonstrated their maximum potential — persistent pre-positioning, precision targeting, communications blackout, psychological operations — all integrated into a kinetic campaign at a level of coordination never publicly confirmed before. Iran's response demonstrated their limits when conventional capability has been degraded: loud, persistent, psychologically disruptive, but strategically bounded. The regime's last instrument of asymmetric pressure was not a zero-day exploit or a sophisticated wiper. It was a WhatsApp message sent to a Marine's personal phone, signed by a cartoon boy with bare feet.