IC Technology & Surveillance — 2026-06-25

Space Sector Faces 400 Percent Surge in Cyberattacks as IRGC and MOIS-Linked Groups Target Satellite Operators

BLUFIRGC-linked groups will likely strike a commercial satellite operator within six months, as Iranian planners have folded space denial into integrated campaign design faster than ground-segment defenses have adapted.

Vantor CISO Norm Laudermilch told a June 23 CyberSat webinar that space sector security event tempo is running 400 percent above pre-war levels, citing simultaneous nation-state and hacktivist campaigns as a departure from the opportunistic activity seen in prior geopolitical crises 12. IRGC-linked group Mobir claimed cyberattacks against Space42, Thuraya, Yahsat, Arabsat, and the UAE Space Agency; IRGC-affiliated APT33 separately claimed to have exfiltrated 375 terabytes of data from Lockheed Martin 1. MOIS-linked Handala has moved from defacement and phishing to AI-enabled credential theft and voice-impersonation attacks targeting Lockheed Martin personnel in Israel, according to Laudermilch and ETH Zurich researcher Clémence Poirier 12. Five Eyes cybersecurity chiefs jointly warned Monday that frontier AI models are compressing offensive cyber timelines from years to months 1.

Analysis
Simultaneous kinetic and cyber targeting of Gulf satellite operators in February 2026 signals Iranian planners have integrated space denial into operational campaign design. Handala's pivot from defacement to AI-enabled voice impersonation marks a capability escalation that ground-segment identity controls are not calibrated to absorb. The 400 percent activity surge may instead reflect improved detection coverage at space sector firms rather than genuine escalation in Iranian offensive tempo. IRGC-linked groups will likely conduct a confirmed compromise against a commercial satellite operator within the next six months, and a confirmed breach gives regulators the forcing function that voluntary disclosure frameworks currently lack. Moderate confidence reflects sourcing drawn from expert interpretation of attack patterns rather than direct visibility into Iranian operational planning.
2 sources
  1. Space Sector Faces 400% Surge in Cyberattacks Amid Iran War, Experts Say - Via Satellite
  2. Iranian Hacker Groups Using AI to Target Space Infrastructure, Experts Say - National Defense Magazine

View in full brief →

UNCLASSIFIED // OPEN SOURCE