Adversary Intelligence — 2026-04-29

Iran Cyber Threat May Be Low and Slow Rather Than Shock and Awe, U.S. Officials Say

Senior U.S. cyber officials, including NSA and Cyber Command leadership, assessed that Iranian cyber retaliation against the United States will more likely manifest as persistent low-level operations than dramatic attacks, according to The Record. Officials characterized the expected Iranian approach as low and slow rather than shock and awe, suggesting Tehran will prioritize sustained espionage and disruption campaigns over high-visibility destructive operations during the ongoing conflict.

Analysis
Per a single Record report citing named senior U.S. officials with direct SIGINT access, NSA and Cyber Command assess that Iran will pursue persistent espionage and disruption campaigns rather than spectacular attacks. Tehran has historically reserved destructive cyber capability for regional targets, Shamoon against Saudi Arabia, operations against Israeli water systems, while keeping U.S.-directed operations below that threshold. A publicly attributed destructive or disruptive operation against U.S. critical infrastructure within the next 90 days is unlikely. Pre-positioning by Iranian actors inside U.S. networks may represent latent destructive capability appearing benign until activated during escalation. The officials' low-and-slow framing may simultaneously calibrate domestic expectations away from a cyber-specific crisis that could complicate the broader conflict trajectory.

1 sources

Iran cyber threat may be less shock and awe than low and slow, officials say - The Record