According to a specialized report by Unit 42, the threat intelligence arm of Palo Alto Networks, an increase in the activity of external actors and hacktivists has been detected, although the capability of state-based groups within Iran is temporarily mitigated due to a drastic drop in their internet connectivity.
Impact of Infrastructure on Cyber Defense Since the morning of February 28, internet availability in Iran has dropped to levels between 1% and 4%. However, specialists warn that some units may be operating in operational isolation, which could lead to autonomous tactics by cells located outside of Iranian territory. For threat actors located outside the region, it is estimated that hacktivist groups will direct their efforts against organizations perceived as adversaries.
Unit 42 warns of an increase in cyberattacks by external activists Following the start of joint military operations, an increase in the activity of hacktivist groups and digital proxies executing trans-regional cyberattacks has been observed. The Unit 42 report highlights that other state actors may attempt to take advantage of the current instability to launch their own cyberattacks and advance their particular interests.
In the face of this scenario, organizations are recommended to strengthen their threat prevention systems, advanced URL filtering, and DNS security to identify malicious domains. The Unit 42 incident response team continues to monitor the situation to provide proactive assessments that allow reducing the risk of compromises in critical infrastructure.
Although the initial impact is expected to be low to medium, geographically dispersed operators could target governments hosting U.S. military bases in order to disrupt logistics. This degradation of connectivity, coupled with the impact on command structures, hinders the ability of state-aligned threat actors to coordinate and execute sophisticated cyberattacks in the short term. Expected methods include Distributed Denial of Service (DDoS) attacks and 'hack and leak' campaigns.
Evolution of Espionage Tactics Historically, the targets of these groups have included espionage and disruption through the use of artificial intelligence for spear-phishing campaigns, exploitation of known vulnerabilities, and covert infrastructure.
