Iran Tensions Increase Likelihood of Cyberattacks

THE THREAT

On June 12th and 13th, 2025, Israel conducted preemptive strikes against Iran, targeting military sites, a uranium enrichment facility, nuclear research centers, military bases, and other targets. The initial attack resulted in the death of high-ranking Iranian military and Islamic Revolutionary Guard Corps (IRGC) members. This military engagement is tracked under the name Operation Rising Lion; the reported goal is degrading Iran’s nuclear capabilities.

eSentire assesses with medium confidence that a portion of Iran’s response to this operation will include cyberattacks. Future Iranian cyberattacks may impact both private and government organizations in Israel and allied countries. Israel and its allies also face an increased risk of targeting by pro-Iranian hacktivist groups, although these attacks will likely be less impactful than the state response.

Organizations with operations in or affiliations to Israel are strongly encouraged to review and implement the recommended security measures outlined below.

What we’re doing about it

• eSentire MDR for Network has detections in place for known infrastructure utilized by Iranian threat actors
• eSentire MDR for Endpoint has detections in place for tools utilized by Iranian threat actors
• eSentire’s Threat Response Unit (TRU) actively tracks Iranian-based threats
  • eSentire maintains a number of detections for known Iranian associated Tactics, Techniques, and Procedures (TTPs)
• eSentire security teams continue to monitor for new information related to Iranian based threat actors and develop additional detections across eSentire platforms

What you should do about it

• Deploy Endpoint Detection and Response (EDR) agents to all supported assets
• Implement Multi-Factor Authentication (MFA) on all user accounts wherever possible
• Enforce a strict password policy across the organization to enhance account security
• Ensure all externally facing systems are fully patched and running the latest updates
• Implement a process for users to report suspicious activity
• Additional Recommendations for Organizations in Critical Infrastructures Sectors:
  • Implement network segmentation to isolate critical systems and limit lateral movement
  • Check programmable logic controllers (PLCs) for default or weak passwords and update them accordingly
  • Refer to CISA’s advisory on IRGC-Affiliated Cyber Actors targeting PLCs across multiple sectors for further guidance and additional recommendations

Additional information

Cyberattacks may be viewed by the Iranian government as a viable response to the recent kinetic attacks by Israel. While the primary target of activity is expected to be Israel, the US awareness/encouragement of the operation, and past military support of Israel, increases the likelihood of attacks against US organizations. These attacks are less resource intensive to conduct, when compared to physical attacks, and may still have a widespread impact. Additionally, attribution for cyberattacks is a difficult process, as such, Iranian APTs may impersonate other threat actors to establish plausible deniability. This would allow Iran to respond, without directly raising tensions in the region. The goal of new attacks would likely include data theft for espionage purposes, and potentially the deployment of destructive wiper malware.

Iranian state-sponsored threat actors, such as MuddyWater (Mercury Sandstorm), APT33 (Peach Sandstorm), APT34 (OilRig, Hazel Sandstorm), APT35 (Charming Kitten, Mint Sandstorm), APT39 (Remix Kitten), APT42, Silent Librarian, and Pioneer Kitten have a long history of targeting both Israel and Western organizations. Past targets of Iranian APTs include critical infrastructure such as energy and water & wastewater, as well as the government, telecommunication, education, healthcare, defense, finance, and aerospace sectors.

eSentire is aware of reports that Iranian threat actors employ a variety of different means to gain initial access into victim organizations. These include, but are not limited to, phishing and other social engineering-based vectors, bruteforce attacks, and the exploitation of vulnerabilities in Internet-facing assets.

In July 2022, an Iranian group operating under the name “HomeLand Justice” deployed wiper malware disguised as ransomware against Albania. In both 2023 and 2024, threat actors associated with the IRGC have targeted water and wastewater treatment facilities in North America and Israel with disruptive attacks. Additionally, in 2024, CISA reported that Iranian-based threat actors were identified supporting financially motivated ransomware attacks against organizations located in the US.

Hacktivist activity following Israel’s attack is also possible. Hacktivist activity is less sophisticated than attacks carried out by APT groups but may still be impactful. These attacks may include website defacements, hack-and-leak operations, and the deployment of ransomware or wiper malware.

For more information on Iranian APT activity, as well as recommendations, see CISA’s Iran Cyber Threat Overview and Advisories.

References:

[1] https://www.reuters.com/world/us/trump-said-us-was-aware-israels-plans-attack-iran-wsj-reports-2025-06-13/ 
[2] https://attack.mitre.org/groups/G0069/ 
[3] https://attack.mitre.org/groups/G0064/ 
[4] https://attack.mitre.org/groups/G0049/ 
[5] https://attack.mitre.org/groups/G0059/ 
[6] https://attack.mitre.org/groups/G0087/ 
[7] https://attack.mitre.org/groups/G1044/ 
[8] https://attack.mitre.org/groups/G0122/ 
[9] https://us-cert.cisa.gov/ncas/alerts/aa20-259a 
[10] https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a 
[11] https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a 
[12] https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a 
[13] https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran