DHS Warns of Pro-Iranian Hacktivists Targeting U.S. Networks

The Department of Homeland Security (DHS) has raised alarms over an increasing wave of low-level cyberattacks targeting U.S. networks, orchestrated by pro-Iranian hacktivist groups.

This warning comes in the wake of heightened geopolitical tensions following the United States’ military strikes on three Iranian nuclear facilities on June 22, 2025, and Iran’s retaliatory missile attacks on U.S. bases in Qatar and Iraq the following day.

Escalating Cyber Threats Amid Israel-Iran Conflict

The DHS advisory highlights the involvement of state-aligned cyber groups such as “Team 313,” which claimed responsibility for a Distributed Denial of Service (DDoS) attack on the Truth Social platform earlier today, citing the nuclear facility strikes as their motivation.

Though this attribution remains unverified, the incident underscores the growing nexus between kinetic warfare and cyber operations in the ongoing Israel-Iran conflict.

The DHS cautions that U.S. organizations, particularly those with ties to Israel or utilizing Israeli technologies like programmable logic controllers (PLCs), are at heightened risk.

Pro-Iranian hacktivists, potentially backed by the Iranian government, are expected to deploy a mix of DDoS campaigns and exploits targeting exposed operational technology (OT) devices within the next one to four weeks.

According to ReliaQuest Report, these attacks are forecasted to be both opportunistic exploiting insecure OT systems such as human-machine interfaces (HMIs) and deliberate, aiming to disrupt entities supporting U.S. efforts in the conflict.

Sophisticated Attack Vectors

Beyond hacktivist groups, Iranian advanced persistent threat (APT) actors like APT33 and APT34 are likely to conduct espionage operations focusing on defense and military sectors to intercept strategic plans.

Such cyber activities are anticipated to align with kinetic military actions, amplifying their impact by weakening national morale and economic stability, reminiscent of past high-impact attacks like the 2014 cyber assault on a Las Vegas casino that resulted in $40 million in damages after its CEO voiced anti-Iran sentiments.

Moreover, the advisory points to a broader cyber landscape where groups like the pro-Palestine “Handala” have claimed to steal over 2 terabytes of data from Israeli firms since June 14, 2025, while pro-Israel group “Predatory Sparrow” has targeted Iranian infrastructure, including Bank Sepah and the Nobitex cryptocurrency exchange in mid-June.

This tit-for-tat cyber warfare extends the threat surface to international businesses tied to either nation, risking data breaches and operational downtime.

To mitigate these risks, the DHS recommends a multilayered defense strategy, emphasizing cloud-based DDoS protection, traffic filtering, and robust authentication for public-facing portals.

Organizations are urged to disable non-essential services, especially OT-related ones, and replace default credentials with strong, unique passwords to prevent brute-force attacks, a tactic frequently employed by groups like CyberAv3ngers, which targeted U.S. water facilities in 2023 by exploiting default PLC passwords.

As the cyber conflict escalates in tandem with physical confrontations, the urgency for fortified cybersecurity measures has never been clearer for U.S. entities navigating this volatile geopolitical landscape.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates