Iran-linked cyber operations in conflict show how warfare scales online

At a glance

What this is: SecurityScorecard describes how Iran-linked cyber activity during the June 2025 Israel-Iran conflict combined reconnaissance, phishing, data theft, defacement and malware with propaganda and recruitment.

Why it matters: For IAM, NHI and broader security teams, the key lesson is that conflict-driven operations now move across social channels, web infrastructure and payload delivery fast enough to outpace static detections and routine playbooks.

Context

This article is about conflict-driven cyber operations, where influence, disruption and intelligence collection all move together. The primary governance gap is that defenders still tend to separate propaganda, phishing, malware and reconnaissance into different monitoring lanes, even when the same actor network is using them as one campaign.

The article also has a genuine identity angle because the reported activity used phishing, social engineering and coordinated messaging channels to support access, collection and disruption. That matters to identity programmes because trust in sender, channel and timing becomes part of the attack surface, especially when conflict narratives are used to increase click-through and lower user suspicion.

Key questions

Q: What breaks when conflict-linked phishing, propaganda and malware are treated as separate problems?

A: Teams miss the campaign logic. In conflict-driven operations, the same actor network can use messaging channels, timing cues and lure infrastructure to move from persuasion to access and then to disruption. If monitoring, phishing response and malware triage sit in separate silos, defenders lose the ability to see coordinated intent early enough to disrupt it.

Q: Why do wartime cyber campaigns increase identity and trust risk?

A: Because conflict narratives lower user suspicion and create urgency. Attackers exploit that context to make phishing, recruitment and impersonation messages look timely or legitimate. Identity teams should assume that sender reputation, message context and channel choice all become attack vectors when kinetic events are in play.

Q: What are the warning signs that a conflict-linked campaign is becoming coordinated?

A: Look for repeated timing around military events, shared themes across multiple groups, the reuse of channels such as Telegram, and a mix of reconnaissance, defacement, data theft and phishing that points to a common operational rhythm rather than isolated opportunism.

Q: How should defenders respond when hostile activity is tied to an active conflict?

A: Use a campaign view, not an incident-by-incident view. Correlate public chatter, phishing infrastructure, web defacement and endpoint alerts in the same operational queue, and elevate verification controls for users likely to receive conflict-themed lures or impersonation attempts.

Technical breakdown

How conflict-linked cyber operations coordinate reconnaissance and phishing

Conflict-linked campaigns often begin with low-noise reconnaissance and social engineering rather than overt destructive action. In this article, the same actor ecosystem used messaging platforms, conflict themes and timed infrastructure to identify targets, lure users and stage follow-on activity. That pattern matters because the reconnaissance layer is no longer separate from the influence layer. When propaganda, recruitment and phishing sit in the same operating cycle, defenders have to treat channel monitoring and credential-risk monitoring as one problem, not two.

Practical implication: fuse social-channel intelligence with phishing detection and account-risk monitoring so the first signal is not a user click.

Why defacement, data theft and malware often travel together in wartime campaigns

Defacement, data theft and malware look like different tactics, but in coordinated conflict activity they often support a single objective: intimidation plus operational disruption. Defacement creates visibility, stolen data supports narrative amplification or extortion, and malware can be held back for escalation or timed disruption. The article’s mix of web attacks and payload activity shows how wartime actors optimise for attention and chaos, not just persistence. That makes asset exposure, privileged access and web application hygiene part of the same defensive picture.

Practical implication: tie website integrity controls, data-loss controls and malware detection into one incident view when conflict-linked activity rises.

Telegram and conflict timing as a command-and-control substitute

The report shows how Telegram channels function as a shared staging and coordination layer, even when actors lack a single formal command structure. In practice, that means operational tempo can come from distributed tasking, public rhetoric and time-linked triggers rather than a classic malware C2 stack. The result is a more fluid threat model: actors can recruit, coordinate and redirect activity quickly when kinetic events shift. For defenders, the key is understanding that communication infrastructure itself can become operational infrastructure.

Practical implication: watch public coordination channels and align monitoring windows to conflict events, not only to technical indicators.

Threat narrative

Attacker objective: The attackers sought to turn wartime conditions into a blended digital campaign of intimidation, disruption, intelligence collection and narrative control.

1. Entry began with conflict-themed phishing and reconnaissance activity that used social engineering hooks tied to the Israel-Iran war.
2. Credential or access collection was supported by lure infrastructure, scanning and messaging that helped target victims and direct follow-on operations.
3. Escalation took the form of coordinated data theft, website defacement and malware delivery aligned to military developments and propaganda goals.
4. The objective was to intimidate adversaries, disrupt businesses, collect intelligence and amplify Iran-aligned messaging during active conflict.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Conflict-linked cyber operations are no longer a side channel to warfare, they are part of the operating model. The article shows a blended ecosystem of proxies, hacktivists and state-aligned actors that moved in step with military events. That means defenders should stop treating propaganda, phishing and malware as separate problem classes when the campaign logic is shared.

Telegram has become a coordination layer, not just a communication platform. The report’s emphasis on messaging channels shows how public coordination can substitute for some of the structure once associated with traditional command-and-control. This complicates attribution, shortens decision cycles and makes pre-incident monitoring of influence channels more valuable than waiting for binary malware evidence.

Conflict timing creates a trust gap that identity teams cannot ignore. When phishing, recruitment and intimidation are timed to headlines and military action, users are more likely to accept urgent messages and skip normal verification. That raises the value of step-up controls, sender validation and context-aware anti-phishing measures across human and non-human workflows alike.

State-linked and ideologically aligned actors can converge on the same target set without identical tasking. The article’s mix of IRGC-linked groups, proxies and loosely aligned collectives shows that defenders should model the threat ecosystem, not a single actor. Practitioner implication: build detection and response around campaign behaviour, because the operational pattern is more stable than the label attached to it.

Coordinated conflict campaigns widen the surface of identity trust. The same network that pushes defacement and data theft also uses social engineering, which means trust in account, channel and message source becomes a shared control plane. For identity programmes, that makes verification, monitoring and response part of wartime resilience, not just access administration.

What this signals

Conflict-linked cyber operations compress reconnaissance, social engineering and payload delivery into the same operating window, so defenders need to monitor channels, infrastructure and user risk together rather than as separate domains.

Conflict-trust exploitation: attackers weaponise war narratives to make phishing and impersonation messages feel credible, which means verification controls must become context aware whenever geopolitical events raise urgency.

For practitioners, the key shift is from indicator chasing to campaign tracking. When a threat ecosystem can recruit, coordinate and attack through the same public channels, response quality depends on seeing the operational pattern early.

For practitioners

• Integrate conflict intelligence into detection pipelines Feed public conflict indicators, channel activity and war-linked narratives into phishing, malware and SOC workflows so analysts can correlate campaign timing with technical alerts.
• Harden phishing-resistant verification for urgent messages Require stronger verification for messages tied to breaking events, especially where social engineering uses conflict themes, time pressure or authority cues.
• Unify web, data and endpoint response for coordinated campaigns Treat defacement, data theft and malware as one incident class when they appear together, because the article shows these tactics can be orchestrated as a single offensive effort.
• Monitor public coordination channels for campaign staging Track Telegram and similar platforms for recruitment, tasking and timing signals that can precede phishing bursts, payload delivery or rapid target shifts.

Key takeaways

• Iran-linked cyber activity during the June 2025 conflict blended espionage, propaganda and disruption into one distributed campaign.
• The article links that activity to more than 178 active groups and 250,000 messages, showing a broad and persistent operating ecosystem.
• Defenders need integrated monitoring of social channels, phishing infrastructure and conflict timing so identity trust does not become the easiest entry point.

Key terms

• Conflict-linked cyber operations: Cyber activity that is timed to, shaped by, or intended to support an ongoing political or military conflict. These operations often combine disruption, propaganda, reconnaissance, theft, and intimidation. The key feature is alignment with real-world events, which changes how defenders should prioritise monitoring and response.
• Conflict-Trust Exploitation: The use of war, crisis or emergency narratives to lower a target's scepticism and speed up action. Attackers rely on urgency, authority and emotional pressure to make malicious messages or requests appear legitimate at the moment of highest attention.
• Digital Foot Soldiers: A loose network of proxies, hacktivists and aligned actors that carries out online tasks in support of a state or cause. The group may not share formal command structures, but it can still create coordinated effects through shared narratives, timing and tooling.
• Campaign Correlation: The process of linking multiple malicious messages or events to the same attack pattern. It helps teams see a phishing campaign rather than isolated emails, which improves containment, reduces repeated manual effort, and speeds organisation-wide remediation.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security practitioners connect identity control to broader access risk across modern environments.