Despite warnings issued by US and Israeli authorities following strikes on Iranian nuclear facilities, the Islamic Republic's cyber activity does not appear to have escalated significantly. According to several cybersecurity experts, Tehran's offensive capabilities may be greatly overestimated, as its recent digital counterattacks have been deemed unsophisticated and relatively low in volume.
In recent weeks, as a fragile ceasefire between Iran and its adversaries holds, cybersecurity analysts in the United States and Israel have detected only moderate activity, far from the widespread cyberattacks feared. Pro-Iranian groups, accused of acting as proxies for Tehran's intelligence services, have claimed responsibility for several hacks targeting Israeli and Western companies, but these claims remain largely unverified.
Among these actors, a collective named Handala Hack claimed to have stolen sensitive data in the wake of the airstrikes. This group, which emerged after Hamas's attack on Israel in October 2023, is believed to be linked to Iran's Intelligence Ministry, according to several cybersecurity researchers. However, the true extent of its intrusions remains unclear.
Nicole Fishbein, an Israeli expert at Intezer, points out that "the techniques used are not particularly sophisticated" and that the level of activity remains "relatively low." Rafe Pilling, a senior analyst at Sophos, describes a mix of "ineffective hacktivist attacks" and "probably slightly more effective but limited targeted operations."
Historically, Iran has been accused of spectacular cyberattacks, such as the 2012 attack on Saudi Aramco, which reportedly crippled tens of thousands of machines. But experts say nothing comparable has been observed recently, despite the tense geopolitical context.
While the Iranian cyber threat remains a long-term strategic concern, recent events suggest that it has not yet materialized in the form feared by Washington and Tel Aviv. It remains to be seen whether this restraint is tactical or indicative of structural limitations.
