Digital Battlefield Emerges: Israel-Iran Cyber Conflict Escalates Globally
Summary
- Escalating Tensions: Cyberattacks between Israel and Iran intensified alongside the military conflict in June 2025.
- Critical Infrastructure at Risk: Banks, ports, water systems and other infrastructure have been targeted over the years.
- Global Implications: Hacker groups aligned with each side can hit targets in other countries too.
- Response Strategies: Information sharing and stronger defenses for critical infrastructure are the main recommendations.
A cyber front in the Israel-Iran war
The cyber conflict between Israel and Iran stepped up sharply in June 2025 alongside the military strikes between the two countries. The digital fight is not new. Both sides have targeted each other’s infrastructure for years.
In 2020, a cyberattack disrupted Iran’s Shahid Rajaee port, an attack widely attributed to Israel. Earlier that year, Israel said attackers tried to tamper with its water systems, which officials blamed on Iran. In June 2025, a pro-Israel group called Predatory Sparrow claimed it destroyed data at Iran’s state-owned Bank Sepah on June 17, then hit the Nobitex cryptocurrency exchange the next day, where analysts tracked more than $90 million sent to addresses nobody can access.
Infrastructure in the line of fire
Hacker groups aligned with each side make the conflict harder to predict. They go after targets that affect daily life, from banks and fuel systems to utilities and transport.
Get the 5-Minute Weekday Cyber Brief
The cyber stories worth paying attention to, filtered from 100+ trusted sources and explained fast.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Attacks on financial services hit ordinary people quickly. Bank Sepah customers faced disruptions after the June attack.
Spillover beyond the region
The direct conflict is between Israel and Iran, but the risk spreads. Hacking tools and techniques move between groups, and allies of each country can be targeted.
Companies with links to either side have reason to raise their guard. U.S. agencies warned in June 2025 that Iranian-linked actors could target American networks in response to the strikes.
Removed claims
An earlier version of this article described a large cyberattack on a European power grid linked to the conflict, and a disruption of Tehran’s transit network. Neither claim could be confirmed, and both have been removed.
How defenders are responding
Countries are sharing more intelligence and coordinating responses.
Security experts recommend layered defenses for critical infrastructure: real-time threat detection, public-private partnerships, and regular updates to security controls. Basic steps such as changing default passwords on internet-connected industrial devices still prevent many attacks.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Attributed comment removed
A quote attributed to a “Dr. Sabine Fischer” in an earlier version could not be verified and has been removed.
What comes next
The Israel-Iran cyber conflict shows how quickly digital attacks follow military ones, and how they can reach banks and other civilian targets within days. Infrastructure operators far from the region should plan for that.
Preparation is the practical response. Patch internet-facing systems, lock down remote access, and know who to call before an attack hits.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: Apache’s HTTP/2 fix, then Check Point break-ins, a ScreenConnect add-on and a GitHub secret stealer
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.