Iran is well known for its support for armed proxies like Hamas, Hezbollah, and the Houthis. Recently, its drones and rockets have shaken the region. But something much more silent is being used as part of Iran’s portfolio of power – cyber war.
Cyber is a major front in modern security. Most societies rely heavily on cyber capacities, and everything from air traffic control to the local Starbucks cannot function without secure and reliable internet. By being so dependent on the digital world, our societies are “target-rich” from the point of view of potential attacks. The more systems a society uses, the more targets an aggressor has to choose from.
Iran’s cyber warfare is directed through two main state-controlled agencies. The first is the Iranian Revolutionary Guards Council (IRGC), which focuses on offensive acts like overtly disruptive attacks. The second is the Ministry of Intelligence and Security (MOIS), which deals with more long-term strategic cyber operations such as intelligence gathering and surveillance. True to form, Iran also uses proxies, including contractors, front companies, and commercially-motivated hackers.
Open source data show that Israel has been a frequent target of Iran’s cyber warfare offensives. In March 2026, an Iranian group called Wa’ad Al Akirah (The name of the group is an allusion to a Quran verse promising judgment) targeted a number of highly sensitive targets, hitting finance, healthcare, and even the civil alert system in a five-day assault. Attacking the civil alert system is interesting, as it would prevent Israelis from hearing sirens about incoming drones and missiles. In Ukraine, Russian hackers have disrupted the air raid system. It is likely Iran learned of this tactic from its autocratic ally. That same month, an Iranian-linked group called the Cyber Isnaad Group targeted the transport and fuel networks of Israel in a series of attacks.
Iranian hackers have spread their attacks against Israel and Jews outside of the Middle East, including attacks in Britain. In March 2026, a cyber threat actor known as the “Conqueror’s Army” launched a denial of service (DDoS) attack on a British charity working on projects in Israel. As the war escalated, experts have warned that Iran’s cyber army is not done with the UK. Rob Domain, CEO of a cyber security consultancy, told LBC that Britain’s energy grid, London Underground network, and air traffic control could all be taken out in just a single attack. The consequences of such attacks are unthinkable.
Even the Henry Jackson Society itself has not been spared Iranian cyber aggression. An Iranian threat actor posed as a Henry Jackson Society staff member, then contacted people in the think tank world to register for a (fictitious) conference. The website the targets were directed to was used by Iran to harvest data and intelligence on think tanks, some of which work closely with the defence and technology sectors in Western countries, which Iran wishes to compromise. While the eyes of the world are on the Straits of Hormuz, perhaps they should also be on cyberspace, where Iranian actors lurk ready to pounce.
