Iran Cyber Ops Merge With PsyOps and EW Amid Escalating Conflict

A new phase of the Iran war is unfolding in which ballistic missiles, drones, electronic warfare, and cyber operations are being deployed in parallel, with cyber activity increasingly tied to kinetic targeting, damage assessment, and strategic messaging.

Iran’s leadership has framed retaliation as a duty following the death of Ayatollah Ali Khamenei, while President Donald Trump has warned that US operations will continue “until all of our objectives are achieved,” signaling a prolonged confrontation with a strong cyber component.

As US‑Israeli strikes degrade Iran’s conventional and command infrastructure, Tehran and its proxies are leaning more heavily on distributed denial-of-service (DDoS) attacks, data theft, destructive malware, and psychological operations, often fronted by hacktivist personas.

Resecurity and other firms assess that these actors are operating within an “Islamic Resilience Cyber Axis,” a loose constellation of pro‑Iran groups and allies that blends ideological motivations with opportunistic cybercrime, including paid DDoS-for-hire operations and data-leak trading.

Based on Resecurity’s assessment, Iran lacks the capacity to generate DDoS attack volumes required for a significant impact and has had to engage with hacktivists and third-party underground services. Many of these actors have refused to provide any services.

Rise of Iran-Linked Cyber Operations

Iran’s own cyber capacity has been constrained by bombardment of IRGC cyber units and large‑scale connectivity disruptions, forcing it to outsource volume and capabilities to sympathetic or rented infrastructure in the underground ecosystem.

One of subdivisions, the Electronic Operations Room, is responsible for malicious cyber activity. These actors are often associated not only with Iranian but also with pro-Hamas groups.

The Handala Hack Team has emerged as one of the most credible and operationally effective pro‑Iran personas, recently claiming a destructive attack against US medical technology giant Stryker on March 11, 2026.

The wiper and data‑theft operation severely disrupted Stryker’s global network, preventing employees across dozens of countries from accessing systems and illustrating the willingness of Iran-linked operators to strike healthcare and critical industries well outside the immediate warzone.

Analysts link Handala to Iran’s Ministry of Intelligence and Security and view the Stryker incident as a signal that cyber retaliation is shifting from noisy, low‑impact DDoS waves toward more strategic sabotage and ransomware‑style extortion.

Many such DDOS attacks have been conducted using third-party underground services, such as ‘stressers’ for rent, such as Cosmic Network (V2), SpaceStresser, TheFlashDDOS, and EliteStresser.

At the same time, maritime and aviation domains are being stressed by unprecedented GPS spoofing and jamming, blurring the line between electronic warfare and cyber risk.

Maritime analytics firm Windward reported that within 24 hours of the first US‑Israeli strikes, more than 1,100 vessels in Gulf waters experienced navigation anomalies, including false positions over airports, nuclear plants, and inland locations, while subsequent analysis showed over 1,650 ships affected on March 7 alone a 55% jump in interference events.

This sustained GNSS disruption increases collision risk, complicates sanctions and compliance monitoring, and threatens operational technology that relies on accurate positioning, turning the Strait of Hormuz and surrounding corridors into contested electromagnetic spaces as well as kinetic chokepoints.

Infrastructure and Technology Networks

Hacktivist activity around this conflict has also taken on a pronounced psychological and propaganda dimension, with Iran-aligned and pro‑Western actors staging defacements, exaggerated breach claims, and AI‑generated imagery to shape perceptions of battlefield momentum.

Resecurity and independent researchers note that many “leaks” of Israeli military or civilian data recycle older dumps while being framed as fresh compromises, amplifying uncertainty and stress among targeted populations.

Parallel misinformation campaigns have promoted false narratives about successful strikes on high‑value US assets and downplayed Iranian losses, while pro‑Western groups have hit Iranian religious apps and media outlets to erode Tehran’s domestic information control and disrupt wartime messaging.

Looking ahead, security analysts expect Iran-linked operators and their proxies to pivot further into ransomware, targeted data‑wiping, and high‑impact intrusions against energy, logistics, and healthcare as the conflict grinds on.

The convergence of kinetic attacks, hacktivism, electronic warfare, and influence operations around Iran underscores a broader trend: cyber is no longer a side show to state conflict but an integral, multi‑layered theater where proxy groups, criminal syndicates, and nation‑states all compete to shape outcomes, narratives, and leverage.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.