How Tehran’s Use of Cyber Operations in the U.S.–Iran Conflict Has Evolved

• Recent Attacks: Since July 26, 2026, cyberattacks hit water facilities in six U.S. states.
• Likely Culprit: Signs point to Iranian cyber actors, though attribution is not yet confirmed.
• Significance: Reflects Iran’s evolving cyber strategy in its conflict with the U.S. and Israel.

 Key Strategic Trends

1. Shift to Direct War Support

• Early conflict: “Opportunistic disruption” (hacktivist defacements, unsophisticated attacks).
• Now: Strategic alignment with wartime objectives.
• Cyber espionage prioritized:
• Hacked SS7 to locate U.S. troops → informed kinetic strikes.
• Targeted U.S./Israeli officials to understand decision-making.
• Hacked cameras for targeting and damage assessment.
• Expanded espionage into aviation, defense, telecom, and satellite sectors.

2. Offensive Cyber to Shape Environment

• Iran uses cyber operations as information warfare tools.
• Breadth: Attacks across U.S. infrastructure (local gov systems, gas stations, water facilities).
• Depth: Hack-and-leak attacks on U.S./Israeli officials, publishing military personnel data.
• Objective:
• Project power globally.
• Undermine adversaries’ reputation and security.
• Create fear, division, and chaos among citizens.
• AI Role: Enhances reconnaissance, malware development, social engineering, and propaganda creation.

3. Operating Under Constraints

• Attacks on U.S. water facilities are serious but consistent with Iran’s historic targeting patterns.
• Doctrine: “Calibrated escalation” – inflict costs without triggering full-scale war.
• Constraints:
• U.S./Israeli strikes on IRGC cyber HQ.
• Iran’s own internet shutdown.
• Damage to telecom infrastructure (e.g., July strike destroyed 100 masts).
• Despite this, Iran maintains cyber activity via “two-tier” internet and satellite connectivity.

Conclusion

• Iran’s cyber strategy is asymmetric warfare, complementing its leverage over the Strait of Hormuz.
• Cyber operations are secondary but enabling tools: inform kinetic strikes, amplify economic pressure, shape narratives.
• Attacks on U.S. water facilities, if confirmed, are opportunistic targeting rather than major escalation.
• Future risks: Iran likely preparing new accesses and capabilities, with potential focus on U.S. midterm elections.
• U.S. resilience: Manual fallback systems prevented water supply disruption, highlighting the importance of vigilance.

Key Takeaways

• Iran’s cyber operations have shifted from opportunistic disruption to strategic alignment with war aims.
• Information warfare is central: cyberattacks are designed to project power and sow division.
• Despite constraints, Iran continues to innovate, especially with AI-enabled cyber operations.
• Cyber remains a constrained but potent lever in Iran’s asymmetric toolkit, alongside drones, missiles, and economic pressure.