Cyberattack Disrupts Four Major Iranian Banks Knocking Digital Services Offline

Analysis
The attack's targeting of shared communications infrastructure rather than individual institutions points to an actor with architectural knowledge of Iran's financial network, but attribution within 60 days is unlikely. Iran's pattern of non-attribution in prior banking incidents, combined with escalatory risk of naming a capable state adversary during active ceasefire negotiations, removes the mechanism that would otherwise force disclosure. Low confidence reflects near-total reliance on state-controlled characterization: the Bank Coordination Council statement is the sole primary source, with secondary outlets amplifying without independent forensic access. Simultaneous disruption across four linked institutions is equally consistent with a cascading internal failure that authorities characterized as an attack to limit domestic accountability exposure. Unattributed, allied cyber defenders lack a named actor for threat modeling, deferring deterrence calculus indefinitely.