Escalation of Cyber Risks in Iran: Continuous Escalation of Attacks

Summary: Unit 42 of Palo Alto Networks reports that cyber risks in Iran have escalated, with an increase in wiper attacks and phishing campaigns linked to the ongoing conflict.

The latest threat brief from Unit 42 paints a scenario of growing risk associated with the conflict in Iran, where signals of destructive activity, thematic phishing, and greater mobilization of hacktivist actors are combined. The report does not present a single isolated incident but an accumulation of indicators pointing to sustained pressure on the digital environment linked to the regional crisis.

One of the most delicate points is the increase in the risk of wiper attacks, which fall into a particularly serious category because they seek not just to steal or extort, but to destroy. This is compounded by a broader campaign of deception involving thousands of phishing URLs related to the conflict and designed to exploit urgency, polarization, and trust in recognizable brands or institutions.

The report also notes that the strong decline in internet availability within Iran does not eliminate the threat but reconfigures the landscape of actors and tactics. While certain state operations may be limited, hacktivist groups both inside and outside the country gain prominence and can intensify opportunistic or propagandistic actions.

As a strategic read, the brief is crucial because it reminds us that geopolitical crises do not only generate military or diplomatic risks: they also rapidly alter the digital threat landscape for businesses, media, infrastructure, and users.

Key facts

  • Iran has maintained an internet blackout ranging from 1% to 4%
  • Increase in wiper attacks and conflict-themed phishing campaigns
  • Hacktivist actors both within and outside the country are intensifying their activities

Why it matters

This report is critical for businesses and organizations operating in the conflict zone, as it suggests an increase in cyber activity and a diversification of tactics by threat actors.