Hackers backing Iran not likely to be dissuaded by ceasefire for long

Iranian Hackers Vow to Continue Cyberattacks Despite Ceasefire Agreement

Pro-Iranian hackers have warned that the fragile ceasefire between Iran, the United States, and Israel will not halt their digital warfare campaigns, raising concerns among American cybersecurity experts about the vulnerability of critical infrastructure.

One prominent hacking collective, Handala, announced it would temporarily suspend attacks against U.S. targets while continuing operations against Israel. The group made it clear, however, that it plans to resume targeting American interests when strategically advantageous.

“We did not begin this war, but we will be the ones to finish it,” the group stated on its X social media account. “And let it be clear: The cyber war did not begin with the military conflict, and it will not end with any military ceasefire.”

The two-week ceasefire appears increasingly unstable as significant disagreements emerge between the involved parties, with each claiming victory in the conflict. This political uncertainty has cybersecurity experts on high alert.

Handala, which operates independently of Tehran while supporting Iranian and Palestinian interests, has already demonstrated its capabilities by disrupting operations at U.S. medical manufacturer Stryker and allegedly breaching FBI Director Kash Patel’s personal email account. These actions represent just a fraction of the cyber operations conducted by Iran’s network of proxy hacking groups.

Last month, the group claimed responsibility for targeting Stryker, a Michigan-based medical equipment company, stating the attack was retaliation for strikes that killed Iranian schoolchildren. In response, the FBI seized four web domains used by the group to disseminate its messages. Handala subsequently leaked photographs of FBI Director Patel after claiming to have compromised his personal email.

U.S. federal agencies issued a joint warning on Tuesday about Iran-backed hackers infiltrating internet-connected programmable logic controllers (PLCs) used to automate critical technology across various industrial sectors. These controllers are essential components in ports, power plants, and water facilities—making them prime targets for foreign hackers seeking to disrupt American daily life.

The advisory from the FBI, National Security Agency, and Cybersecurity and Infrastructure Security Agency (CISA) urged organizations utilizing this technology to verify and update their security measures immediately. As of Wednesday, CISA had not provided any statements regarding how the ceasefire might affect cybersecurity postures.

Markus Mueller, a cybersecurity executive at Nozomi Networks, predicts that contrary to what might be expected, cyberattacks against American organizations will likely increase rather than decrease following the ceasefire agreement. He explained that periods of reduced conventional hostilities often allow hackers to pivot from regional targets directly involved in the conflict to U.S. organizations that supported the war effort, including data centers, technology companies, and defense contractors.

“With a ceasefire, we will likely see an expansion of cyber activity both in scale and scope,” Mueller said. “These groups will likely try to execute a high-profile attack such as what we saw with Stryker.”

Mueller also warned that some groups based in Iran or Russia might attempt to circumvent the truce by launching significant cyberattacks designed to capture American public attention.

Other pro-Iranian hackers have reportedly attempted to install malware on Israelis’ phones, infiltrate surveillance cameras in Middle Eastern countries to improve Iran’s missile targeting capabilities, and breach data centers and industrial facilities in Israel, Saudi Arabia, and Kuwait.

Cybersecurity experts note that while attacks attributed to pro-Iranian hackers have been numerous, their impact has thus far been relatively limited. These operations appear designed primarily to boost morale among Iran’s supporters while highlighting ongoing vulnerabilities in their opponents’ digital infrastructure, despite the military advantages held by the United States and its allies.

As the situation develops, critical infrastructure operators and cybersecurity professionals across the United States remain vigilant, recognizing that the digital battlefield knows no ceasefire.