Cyber weapons in the Israel-Iran conflict may hit the US
(2025/06/14)
- Reference: 1749852448
- News link: https://www.theregister.co.uk/2025/06/13/cyber_weapons_israel_iran/
- Source link:
The current Israel–Iran military conflict is taking place in the era of hybrid war, where cyberattacks amplify and assist missiles and troops, and is being waged between two countries with very capable destructive cyber weapons.
Iran is widely expected to retaliate against Israel's missile strikes with cyber operations — and these could extend to American targets, according to cyber warfare experts and threat analysts.
"I would expect there to be a cyber component of both the Israeli and Iranian activities," former White House advisor Michael Daniel told The Register .
[1]
Daniel, who now leads the threat-intel sharing nonprofit Cyber Threat Alliance, said both countries "have the capability to conduct a range of activities, from fully reversible DDoS [distributed denial-of-service] attacks, which could disrupt online services temporarily, to destructive wiper attacks. At the very least, I am sure both sides are using cyber capabilities to conduct espionage and reconnaissance."
[2]
[3]
While cyber espionage began well before Israel's June 13 strikes on Iran's nuclear sites and military commanders, the worry is that Iran may launch destructive cyberattacks now that its military capabilities have been dealt a serious blow.
"Iranian cyber activity has not been as extensive outside of the Middle East but could shift in light of the military actions," Google threat intelligence group chief analyst John Hultquist said in an email sent to The Register . "Iranian cyber espionage activity already targets the US government, military, and political [sector], but new activity may threaten privately owned critical infrastructure, or even private individuals."
[4]
Tehran has the capacity to carry out destructive attacks — but to date, their success and technical sophistication have been limited.
The United States has too many cyber vulnerabilities that Iran can exploit – particularly in small unities and critical infrastructure operators
In 2023, Iran's [5]CyberAv3ngers carried intrusions across multiple US water systems, relying on default passwords for internet-accessible programmable logic controllers. In a second round of attacks, the Islamic Revolutionary Guard Corps-linked crew [6]used custom malware to remotely control US and Israel-based water and fuel management systems.
But aside from posting videos bragging about the intrusions on their Telegram sites, the attackers didn't really do anything with the access they gained to these critical systems.
"Fortunately, they didn't understand what kind of access they had," Annie Fixler, director of the Center on Cyber and Technology Innovation at the national security think tank Foundation for Defense of Democracies, told The Register . "They could have caused significant disruption if they had been savvier."
If the loss of top generals and key facilities turns out to have crippled Iran's chances of a successful military response, retaliation in cyberspace becomes an even bigger threat, she added.
[7]
"I would not be surprised to see Iran activate additional cyber operatives, instructing them to target anything and everything they can in Israel as well as in the United States," Fixler said. "Even if the directive doesn't come from Tehran, pro-regime hackers can read the writing on the wall and will launch additional operations."
Israel has historically been fairly resilient against Iranian cyberattacks, according to Fixler. "The United States, however, has too many cyber vulnerabilities that Iran can exploit – particularly in small utilities and critical infrastructure operators," she added. "US companies should be on alert so that they do not become targets of opportunity for Iran."
[8]Iran-linked crew used custom 'cyberweapon' in US critical infrastructure attacks
[9]US warns Iranian terrorist crew broke into 'multiple' US water facilities
[10]Hacktivist attacks erupt in Middle East following Hamas assault on Israel
[11]Hacktivism resurges – but don't be fooled, it's often state-backed goons in masks
[12]Israeli hacktivist group brags it took down Iran's internet
However, much like they've done in the past, we should expect Iranian hackers to exaggerate or make false claims about the success of these disruptive cyberattacks, Hultquist added. "The goal of many of these operations is psychological rather than practical, and it is important not to overestimate their impact," he said.
"When it comes to disruptive attacks, typically the Iranians have deployed wipers against targets in critical infrastructure and other organizations," Hultquist told The Register . "We will probably see more of that in Israel and we could see it in the US as well. In those cases, it's not unusual for them to claim that the attack is far more impactful than it really is."
Cybersecurity advisor Tom Kellermann, who served on the Commission on Cyber Security under President Barack Obama, said he expects to see CyberAv3ngers and the Iranian Cyber Army launch destructive cyberattacks against water utilities, electric, and transportation infrastructure. "Wipers and [13]NotPetya-style ransomware will be used," he predicted.
Plus, he warned, it's important to remember that Iran has an alliance with Russia and China, both of whom also have well-developed cyber weapons and government-backed cyber operatives at the ready.
"I foresee a systemic, pronounced campaign by not only the regime but [its] allies," he told The Register . "If the US gets embroiled, I foresee China launching cyberattacks on behalf of [its] ally. If Israel hits Iran's oil, which China is the largest importer of, China will also act." ®
Get our [14]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aEzz0gsD13qlhmT_Qvk3YgAAAA0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aEzz0gsD13qlhmT_Qvk3YgAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aEzz0gsD13qlhmT_Qvk3YgAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aEzz0gsD13qlhmT_Qvk3YgAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2023/12/04/iran_terrorist_us_water_attacks/
[6] https://www.theregister.com/2024/12/13/iran_cyberweapon_us_attacks/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aEzz0gsD13qlhmT_Qvk3YgAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2024/12/13/iran_cyberweapon_us_attacks/
[9] https://www.theregister.com/2023/12/04/iran_terrorist_us_water_attacks/
[10] https://www.theregister.com/2023/10/09/hacktivism_middle_east/
[11] https://www.theregister.com/2025/04/13/hacktivism_is_having_a_resurgence/
[12] https://www.theregister.com/2024/08/02/israeli_hacktivists/
[13] https://www.theregister.com/2017/06/28/petya_notpetya_ransomware/
[14] https://whitepapers.theregister.com/
Iran is widely expected to retaliate against Israel's missile strikes with cyber operations — and these could extend to American targets, according to cyber warfare experts and threat analysts.
"I would expect there to be a cyber component of both the Israeli and Iranian activities," former White House advisor Michael Daniel told The Register .
[1]
Daniel, who now leads the threat-intel sharing nonprofit Cyber Threat Alliance, said both countries "have the capability to conduct a range of activities, from fully reversible DDoS [distributed denial-of-service] attacks, which could disrupt online services temporarily, to destructive wiper attacks. At the very least, I am sure both sides are using cyber capabilities to conduct espionage and reconnaissance."
[2]
[3]
While cyber espionage began well before Israel's June 13 strikes on Iran's nuclear sites and military commanders, the worry is that Iran may launch destructive cyberattacks now that its military capabilities have been dealt a serious blow.
"Iranian cyber activity has not been as extensive outside of the Middle East but could shift in light of the military actions," Google threat intelligence group chief analyst John Hultquist said in an email sent to The Register . "Iranian cyber espionage activity already targets the US government, military, and political [sector], but new activity may threaten privately owned critical infrastructure, or even private individuals."
[4]
Tehran has the capacity to carry out destructive attacks — but to date, their success and technical sophistication have been limited.
The United States has too many cyber vulnerabilities that Iran can exploit – particularly in small unities and critical infrastructure operators
In 2023, Iran's [5]CyberAv3ngers carried intrusions across multiple US water systems, relying on default passwords for internet-accessible programmable logic controllers. In a second round of attacks, the Islamic Revolutionary Guard Corps-linked crew [6]used custom malware to remotely control US and Israel-based water and fuel management systems.
But aside from posting videos bragging about the intrusions on their Telegram sites, the attackers didn't really do anything with the access they gained to these critical systems.
"Fortunately, they didn't understand what kind of access they had," Annie Fixler, director of the Center on Cyber and Technology Innovation at the national security think tank Foundation for Defense of Democracies, told The Register . "They could have caused significant disruption if they had been savvier."
If the loss of top generals and key facilities turns out to have crippled Iran's chances of a successful military response, retaliation in cyberspace becomes an even bigger threat, she added.
[7]
"I would not be surprised to see Iran activate additional cyber operatives, instructing them to target anything and everything they can in Israel as well as in the United States," Fixler said. "Even if the directive doesn't come from Tehran, pro-regime hackers can read the writing on the wall and will launch additional operations."
Israel has historically been fairly resilient against Iranian cyberattacks, according to Fixler. "The United States, however, has too many cyber vulnerabilities that Iran can exploit – particularly in small utilities and critical infrastructure operators," she added. "US companies should be on alert so that they do not become targets of opportunity for Iran."
[8]Iran-linked crew used custom 'cyberweapon' in US critical infrastructure attacks
[9]US warns Iranian terrorist crew broke into 'multiple' US water facilities
[10]Hacktivist attacks erupt in Middle East following Hamas assault on Israel
[11]Hacktivism resurges – but don't be fooled, it's often state-backed goons in masks
[12]Israeli hacktivist group brags it took down Iran's internet
However, much like they've done in the past, we should expect Iranian hackers to exaggerate or make false claims about the success of these disruptive cyberattacks, Hultquist added. "The goal of many of these operations is psychological rather than practical, and it is important not to overestimate their impact," he said.
"When it comes to disruptive attacks, typically the Iranians have deployed wipers against targets in critical infrastructure and other organizations," Hultquist told The Register . "We will probably see more of that in Israel and we could see it in the US as well. In those cases, it's not unusual for them to claim that the attack is far more impactful than it really is."
Cybersecurity advisor Tom Kellermann, who served on the Commission on Cyber Security under President Barack Obama, said he expects to see CyberAv3ngers and the Iranian Cyber Army launch destructive cyberattacks against water utilities, electric, and transportation infrastructure. "Wipers and [13]NotPetya-style ransomware will be used," he predicted.
Plus, he warned, it's important to remember that Iran has an alliance with Russia and China, both of whom also have well-developed cyber weapons and government-backed cyber operatives at the ready.
"I foresee a systemic, pronounced campaign by not only the regime but [its] allies," he told The Register . "If the US gets embroiled, I foresee China launching cyberattacks on behalf of [its] ally. If Israel hits Iran's oil, which China is the largest importer of, China will also act." ®
Get our [14]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aEzz0gsD13qlhmT_Qvk3YgAAAA0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aEzz0gsD13qlhmT_Qvk3YgAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aEzz0gsD13qlhmT_Qvk3YgAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aEzz0gsD13qlhmT_Qvk3YgAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2023/12/04/iran_terrorist_us_water_attacks/
[6] https://www.theregister.com/2024/12/13/iran_cyberweapon_us_attacks/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aEzz0gsD13qlhmT_Qvk3YgAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2024/12/13/iran_cyberweapon_us_attacks/
[9] https://www.theregister.com/2023/12/04/iran_terrorist_us_water_attacks/
[10] https://www.theregister.com/2023/10/09/hacktivism_middle_east/
[11] https://www.theregister.com/2025/04/13/hacktivism_is_having_a_resurgence/
[12] https://www.theregister.com/2024/08/02/israeli_hacktivists/
[13] https://www.theregister.com/2017/06/28/petya_notpetya_ransomware/
[14] https://whitepapers.theregister.com/
Re: Macron: "France reaffirms Israel’s right to defend itself"
Pascal Monett
Every time that idiot opens his mouth, he manages to put his foot in it.
Thank goodness he can't be reelected.
Re: Macron: "France reaffirms Israel’s right to defend itself"
GNU SedGawk
The German FM got a slap down
Did anyone tell you sir that “ targeted strikes against nuclear facilities” are prohibited under article 56 of the additional protocol to the Geneva Conventions to which Germany is a party, and that the use of force in international relations is generally prohibited in article 2(4) of the @UN
Charter with the exception of the right of self defense in the case of armed attack or upon authorization by the Security Council in the case of collective security action.
You might want to familiarize yourself with the basic tenets of international law…
He'd written "The situation in the Middle East has escalated dramatically overnight. Israel has carried out targeted strikes against Iranian nuclear facilities. Iran is responding with hundreds of drone attacks on Israel. This development is more than alarming."
he's being mocked, but it's a consistent framing, it's okay to do whatever, and as the French goes "It's a dangerous animal, it retaliates when attacked" / "Cet animal est très méchant, Quand on l'attaque il se défend."
"fully reversible DDoS attacks"
Pascal Monett
Um, sorry but I don't see the use an attack method that can be "reversed". Does that mean it can be bounced back to the attacker ?
I've tried to search for this, but the best reference I get is [1]this one , and they don't mention that kind of attack.
Could someone enlighten me ?
[1] https://www.fortinet.com/resources/cyberglossary/ddos-attack
Macron: "France reaffirms Israel’s right to defend itself"
To quote the wonderful Francesca Albanese
On the day Israel, unprovoked, has attacked Iran, killing 80 people, the president of a major European power, finally admits that in the Middle East, Israel, and only Israel, has the right to defend itself.