Iran Conflict — 2026-03-22

60+ Pro-Iranian Cyber Threat Groups Active; Electronic Operations Room Coordinates Attacks on Western Infrastructure

Unit 42 tracks 60+ active threat groups aligned with the Iran conflict — 53 operating on the pro-Iranian side under the 'Electronic Operations Room' established February 28. Targets include Israeli payment systems, Kuwaiti government sites, airport services, and water utility SCADA systems. Hydro Kitten (IRGC) has signaled plans to target Western financial sector. Soufan Center assessed cyber operations as Iran's primary asymmetric leverage as conventional capacity degrades.

Analysis
Prior INTSUM noted CISA acting director contradicted private sector on Iranian cyber threat level. Unit 42's count of 60+ groups validates private-sector assessment. IC Brief reported CISA at 38% staffing — the gap between threat escalation and defensive capacity is widening.

1 sources

Cyber Operations as Iran's Asymmetric Leverage - Soufan Center