As military conflict intensifies in the Middle East, with Israel’s recent strike on Iranian territory followed by reported U.S. “bunker-buster” airstrikes on suspected Iranian nuclear facilities, cybersecurity experts are warning of a heightened risk of retaliatory cyberattacks—particularly targeting the United States and its allies.
According to John Hultquist, chief analyst at Google’s Threat Intelligence Group, Iran’s cyber response may soon extend beyond the region.
“In light of recent developments, the likelihood of disruptive cyberattacks against U.S. targets by Iranian actors has increased,” said Hultquist. “In recent years Iran has primarily focused this activity on Israel, especially following October 7th. Those incidents offer useful insight into the capability and limitations of Iranian actors.”
Iranian cyber actors, many aligned with the country’s Islamic Revolutionary Guard Corps (IRGC), have a history of launching retaliatory attacks in the wake of geopolitical escalations. These range from defacement campaigns and DDoS attacks to more sophisticated operations targeting critical infrastructure. Hultquist noted, however, that Iran’s track record of disruptive attacks remains mixed, with many incidents exaggerated by Tehran to heighten psychological impact.
“Iran has had mixed results with disruptive cyberattacks and they frequently fabricate and exaggerate their effects in an effort to boost their psychological impact,” Hultquist added. “We should be careful not to overestimate these incidents and inadvertently assist the actors. The impacts may still be very serious for individual enterprises, which can prepare by taking many of the same steps they would to prevent ransomware.”
The warning comes amid mounting concerns that Iran may attempt to expand its cyber campaign against U.S. targets—government agencies, critical infrastructure, or private enterprises—as part of its asymmetric response to the strikes. Cybersecurity analysts are closely monitoring state-backed groups like APT33 and APT34, which have previously conducted both espionage and destructive campaigns across the globe.
Hultquist also stressed that Iran’s long-running cyber-espionage efforts against U.S. interests have never ceased. These efforts are likely to intensify in the wake of Washington’s role in the latest military escalations.
“Iran already targets the U.S. with cyberespionage which they use to directly and indirectly gather geopolitical insight and surveil persons of interest,” he said. “Persons and individuals associated with Iran policy are frequently targeted through organizational and personal accounts and should be on the lookout for social engineering schemes. Individuals are also targeted indirectly by Iranian cyber-espionage against telecoms, airlines, hospitality, and other organisations who have data that can be used to identify and track persons of interest.”
These tactics—targeting both direct and indirect avenues for intelligence gathering—are typical of Iran’s cyber playbook, which often blurs the line between nation-state surveillance and low-level harassment. Threat actors frequently exploit weak points in supply chains, third-party services, and unpatched systems to infiltrate networks and extract information.
Rising Global Concerns
The situation is being closely monitored by U.S. federal cybersecurity agencies, including CISA and the NSA, both of which have issued reminders to critical infrastructure operators to implement multi-layered defences, conduct phishing awareness training, and review incident response plans. Major enterprises in sectors such as energy, finance, health care, and transportation remain on alert for anomalous network activity.
International observers have also raised concerns that Iranian cyber operations could become more aggressive, potentially targeting not just the U.S. and Israel, but also regional allies such as Saudi Arabia and the UAE. In recent years, Iranian-linked threat groups have been implicated in attempted sabotage of petrochemical plants and oil terminals across the Gulf.
While the full impact of the latest kinetic actions is still unfolding, analysts warn that cyberspace will likely be one of the first and most active theatres of retaliation. Unlike traditional military operations, cyberattacks offer Tehran the ability to hit back with deniability, asymmetric impact, and psychological reach—without crossing the conventional red lines that risk a full-scale war.
Preparing for the Fallout
For companies and organisations concerned about being caught in the digital crossfire, Hultquist advised vigilance and practical steps to harden defences.
“Many of the same steps enterprises take to defend against ransomware—like maintaining offline backups, segmenting networks, and keeping software up to date—can significantly reduce the impact of Iranian cyber operations,” he said.
The warning is timely. As the geopolitical situation remains volatile, enterprises and government agencies alike must prepare not only for the next news headline—but for what may already be happening quietly in the background of their networks.
