Israel, Iran and US escalate cyber attacks after Operation Epic Fury

Israel, Iran and the United States are engaged in a fast-escalating cyber conflict that targets each other’s governments, militaries and critical infrastructure, according to Euronews. The report says military action by Israel and the US against Iran is spilling into cyberspace amid a rise in digital attacks by hackers on both sides. Joint US-Israel military operation Roaring Lion, also known as Epic Fury, began over the weekend, and US President Donald Trump said operations could continue for several weeks.

Euronews reports that Iran launched a series of strikes across the Middle East, hitting American bases and airports in the United Arab Emirates, Bahrain, Qatar and Kuwait, and that several people have died. The outlet does not give a casualty breakdown in its report.

Cyber incidents have also affected civilians. Iran’s BadeSaba Calendar, a religious app with more than five million downloads on the Google Play store, was reportedly hacked over the weekend. Users received notifications reading “Help is on the way!” and “It’s time for reckoning,” according to screenshots circulating on social media. Euronews did not independently verify the screenshots.

A group calling itself the Islamic Cyber Resistance Axis has claimed several cyber campaigns, including an operation against Israeli defence company Rafael’s air defence systems and another against a drone detection service called VigilAir. The group has reportedly tried to recruit cyber experts for a “great epic battle” against Israel and the United States. Separately, Euronews reports, citing cybersecurity firm Sophos, that a hacker persona called Handla Hack, which is linked to Iran’s Ministry of Intelligence and Security (MOIS), claimed attacks in Jordan and threatened other countries in the region. A senior American official told the Jerusalem Post that the United States is using an “information warfare campaign” against Iran to disrupt the regime’s military capabilities and to pressure senior regime officials to defect.

Internet access inside Iran has also been restricted. Internet monitoring companies Netblocks and Cloudflare report that Iran’s internet has been severely limited for the last 48 hours due to restrictions from the regime. Euronews notes that this follows an internet shutdown during protests that left the country without internet for most of the month.

Analysts expect cyber activity to intensify. According to an analysis from the American cybersecurity company Anomali, cited by Euronews, Iran will rely on cyber attacks as its primary retaliation tool because conventional military operations have been crippled. Anomali claims that APT42 and APT33, two groups with links to the Islamic Revolutionary Guard Corps (IRGC) and MOIS, known as MuddyWater, have already been mobilised. SentinelOne, another American cybersecurity company, says Iranian-linked groups are likely to target Israeli and American defence, government and intelligence networks in the coming days. Anomali says the most likely tactic is wiper malware, designed to permanently erase data and disable systems, and Euronews notes that distributed denial-of-service attacks are another well-documented Iranian method. SentinelOne warned that Iranian actors could amplify disinformation to “shape public perception” about military failures or harm to civilians, including allegations of Israeli war crimes, Israeli and American military losses, and fabricated claims of cyber retaliation. Such unverified claims call for careful weighing of evidence before judgment (Proverbs 18:17).

Sophos, according to Euronews, says Iranian groups have sometimes overstated their capabilities but “remain capable actors.” Past Iranian operations have targeted critical infrastructure and the financial sector in addition to government domains.

Source: Read the original report