Iran Deploys Three-Tiered Cyber Campaign Against US and Israeli Critical Infrastructure

Iranian cyber operations have escalated into a coordinated three-tier campaign: elite MOIS/IRGC units conducting espionage, state-aligned proxies deploying ransomware and wipers, and hacktivist groups like Handala conducting disruptive attacks. Targets include energy grid operators, financial institutions, water utilities, and telecommunications networks. CyberAv3ngers has claimed access to operational control systems at water utilities. MOIS-linked Void Manticore operates Handala as a front, blending data exfiltration with destructive attacks using AI-enhanced spear-phishing and supply chain compromises. CISA and NSA have urged all critical infrastructure operators to review defensive postures.