Topic starter
11/07/2026 8:33 pm
TL;DR: During the June 2025 Israel-Iran conflict, coordinated reconnaissance, phishing, data theft, defacement, and malware activity tied to war objectives emerged across Iranian proxies and hacktivists, according to SecurityScorecard’s STRIKE team. The analysis of 250,000 messages from more than 178 active groups shows conflict-linked cyber operations now blend propaganda, recruitment, and disruption, which raises the bar for detection and response.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “From the Depths of the Shadows: IRGC and Hacker Collectives Of The 12-Day War”.
Key questions
Q: What breaks when conflict-linked phishing, propaganda and malware are treated as separate problems?
A: Teams miss the campaign logic.
Q: Why do wartime cyber campaigns increase identity and trust risk?
A: Because conflict narratives lower user suspicion and create urgency.
Q: What are the warning signs that a conflict-linked campaign is becoming coordinated?
A: Look for repeated timing around military events, shared themes across multiple groups, the reuse of channels such as Telegram, and a mix of reconnaissance, defacement, data theft and phishing that points to a common operational rhythm rather than isolated opportunism.
Practitioner guidance
- Integrate conflict intelligence into detection pipelines Feed public conflict indicators, channel activity and war-linked narratives into phishing, malware and SOC workflows so analysts can correlate campaign timing with technical alerts.
- Harden phishing-resistant verification for urgent messages Require stronger verification for messages tied to breaking events, especially where social engineering uses conflict themes, time pressure or authority cues.
- Unify web, data and endpoint response for coordinated campaigns Treat defacement, data theft and malware as one incident class when they appear together, because the article shows these tactics can be orchestrated as a single offensive effort.
Bottom line: Iran-linked cyber activity during the June 2025 conflict blended espionage, propaganda and disruption into one distributed campaign.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:01 pm
Conflict-linked cyber operations are no longer a side channel to warfare, they are part of the operating model. The article shows a blended ecosystem of proxies, hacktivists and state-aligned actors that moved in step with military events. That means defenders should stop treating propaganda, phishing and malware as separate problem classes when the campaign logic is shared.
A question worth separating out:
Q: How should defenders respond when hostile activity is tied to an active conflict?
A: Use a campaign view, not an incident-by-incident view. Correlate public chatter, phishing infrastructure, web defacement and endpoint alerts in the same operational queue, and elevate verification controls for users likely to receive conflict-themed lures or impersonation attempts.
👉 Read our full editorial: Iran-linked cyber operations in conflict show how warfare scales online