Cyber Operations — 2026-03-26

Iran Cyber Retaliation Surges with DDoS and Wiper Campaigns Targeting US Critical Infrastructure

Palo Alto Unit 42 documented an escalating Iranian cyber campaign targeting US critical infrastructure since strikes began February 28. The Cyber Islamic Resistance established a joint Electronic Operations Room consolidating hacktivist groups under one operational banner. Top targeted sectors include national government, aerospace/defense, and technology, with elevated exposure in energy, financial services, healthcare, and telecommunications. Backdoors installed on several US company networks in late February were activated post-strikes. The March 15 Stryker attack is characterized as the largest wartime cyberattack against the US in history.

Analysis
The establishment of a joint Electronic Operations Room consolidating hacktivist groups under one command mirrors the conventional Axis of Resistance coordination model. The energy, healthcare, and telecom targeting profile suggests preparation for follow-on disruptive attacks rather than intelligence collection, consistent with wartime retaliation doctrine.

1 sources

Cyber retaliation surges after US-Israel strikes on Iran - Industrial Cyber