Contents

• Introduction
• The Rise of Cyberwarfare
• Inside the Cyber Arsenal of Iran and Israel
  • Iranian State-Sponsored Activities
  • Israeli State-Sponsored Activities
• Recent Escalations & Newsworthy Incidents
  • Iranian groups targeting the U.S. in retaliation for attacks on Iran’s nuclear facilities
  • $90M wiped from an Iranian cryptocurrency exchange
• Patterns of Attack: Tools & Techniques
  • Iranian Threat Actors
  • Israeli-Linked Cyber Operations
• Strategic Motives & Civilian Impact
  • Strategic Motives
  • Civilian Impact
• Conclusion: The World Beyond the Firewall

Introduction

Warfare has evolved. It is no longer limited to tanks, drones, and missiles. In the ongoing geopolitical conflict between Iran and Israel, the battlefield has expanded into cyberspace. Both nations now engage in digital warfare, where state-sponsored hackers deploy a variety of sophisticated techniques to steal data, manipulate public discourse, and even cause physical destruction through malicious code.

Unlike traditional warfare, cyberattacks often leave no visible trace but their impact ripples across borders. This blog explores one of the most intense digital conflicts in the Middle East: Iran vs. Israel. We'll examine the state-backed hacking groups involved, highlight recent high-impact incidents, and unpack the ever-evolving tools and techniques they use.

The Rise of Cyberwarfare

To understand today’s cyber battlefield, we need to go back to one of the most important moments in cyber history: **Stuxnet**. This wasn’t just a virus to steal data , it was a weapon. Believed to be created by the U.S. and Israel and discovered in 2010 , Stuxnet was designed to quietly slip into Iran’s Natanz nuclear facility and cause real physical damage. It made the centrifuges spin in a way that eventually broke them, all without anyone noticing at first. This attack changed everything , showing the world that a piece of code could damage machines, disrupt nations, and start a new kind of warfare.

In response, Iran began investing heavily in its own cyber capabilities. Between 2012 and 2013, Iran launched operations like **Ababil**, a series of DDoS attacks against U.S. banks, and the **Madi** spyware campaign targeting infrastructure across the Middle East.

Over the years, Iran has continued carrying out cyberattacks against Israel. In 2023, an Israel-backed group called Predatory Sparrow targeted Iran’s fuel distribution system. Iranian state media reported that close to 70% of the country’s gas stations were out of service The news quickly spread, and the group shared updates about the attack on their Telegram channelGonjeshke Darande Official.

Soon after, Iranian-backed groups like CyberAv3ngers responded by launching cyberattacks against Israeli critical infrastructure. These weren’t just simple hacks they often mixed real intrusions with misinformation to create confusion and psychological pressure NextGov report.

These digital confrontations continue to escalate, both in scale and severity. The next section highlights the key cyber entities responsible for these operations.

Inside the Cyber Arsenal of Iran and Israel

This is a conflict of digital asymmetry. Iran is believed to have a broader array of APT (Advanced Persistent Threat) groups, which has led to a higher volume of notable cyber incidents. However, Israel while having fewer known APTs maintains a reputation for precision and advanced tactics in its cyber operations.

Iranian State-Sponsored Activities

Iran has quite a few state-backed hacker groups that have been active over the years. Some of the well-known ones include MuddyWater (also called Static Kitten or Mercury), APT35 (also known as Charming Kitten, Phosphorus, or Newscaster), and APT42. Then there are groups like Hexane (Lyceum), APT33 (Elfin), and APT34 (OilRig or Helix Kitten), which have been linked to different cyber spying and hacking operations. Others like Agrius, Emennet Pasargad, Cobalt Mirage, and Tortoiseshell have also popped up more recently and seem to be pretty aggressive in their approach. Groups like Moses Staff and APT39 (Remix Kitten) are also part of this network, each with their own specific goals and targets.

Israeli State-Sponsored Activities

When it comes to cyber operations, Israel is known for being highly advanced, and one of the key players is Unit 8200, which is basically their main cyber intelligence unit. They’ve been linked to some major operations, including Stuxnet, a famous cyberattack that was reportedly a joint effort between the U.S. and Israel to disrupt Iran’s nuclear program. Then there’s Flame, a super sophisticated cyber espionage tool that was designed to gather massive amounts of data. Another set of tools, known as Duqu and its later version Duqu 2.0, have also been connected to Israeli cyber activity and are believed to be linked to the same people behind Stuxnet.

Recent Escalations & Newsworthy Incidents

Iranian groups targeting the U.S. in retaliation for attacks on Iran’s nuclear facilities

After the recent attacks on Iran’s nuclear sites which are believed to involve both the U.S. and Israel , Iranian hacker groups have increased their cyberattacks. On June 13, these groups started sending more phishing emails and launched attacks on important systems. This led both U.S. and Israeli governments to issue public warnings.

In response, authorities have issued advisories urging public and private sector organizations to remain vigilant against spear-phishing attempts, ransomware attacks, and data-wiping malware frequently deployed by Iranian-affiliated groups.

$90M wiped from an Iranian cryptocurrency exchange

On June 18, 2025, Nobitex, Iran’s largest cryptocurrency exchange, was hacked by a group named Gonjeshke Drande in a cyberattack that resulted in the loss of more than $90 million in various cryptocurrencies including Bitcoin, Ethereum, Dogecoin, Ripple, Solana, Tron, and Ton.

What made this incident especially alarming were the messages embedded in the attackers’ wallet addresses. These included politically charged phrases like:

"FuckIRGCTerroristsNoBiTEX"

The group publicly accused Nobitex of helping the IRGC (Islamic Revolutionary Guard Corps) bypass international sanctions.

To support their claims, they added cryptographic hashes ,a kind of digital fingerprint into the transaction data. These hashes suggest the hackers may have access to Nobitex’s internal files or source code. If they release this information later, the hashes could be used to prove it’s real.

What’s most striking is that the stolen cryptocurrency was likely sent to wallets that even the hackers can’t access. This means they weren’t trying to make money ,they wanted to destroy the funds on purpose, as a form of punishment and protest.

Patterns of Attack: Tools & Techniques

Iranian Threat Actors

Iranian cyber threat groups — including APT33, APT34, APT35, and MuddyWater — are known for their sophisticated and persistent operations. They often begin attacks with social engineering, particularly spear-phishing emails. These emails typically include malicious attachments or links to fake login portals that mimic well-known services like Google or Microsoft, aiming to trick users into revealing their credentials.

In addition to phishing, these groups frequently exploit exposed or unpatched systems, such as VPN gateways or RDP instances, especially those protected by weak or default passwords.

To maintain communication with compromised systems, Iranian groups often rely on:

• HTTP or DNS-based C2 channels
• Public platforms, like Telegram bots, to bypass traditional network defenses

Israeli-Linked Cyber Operations

In contrast, Israeli-linked cyber operations are highly targeted and typically aligned with intelligence or military objectives. These campaigns avoid noisy tactics like mass phishing. Instead, they rely on covert entry points and custom tools.

Israel’s best-known operations include Stuxnet—a joint U.S.-Israel malware campaign that physically sabotaged Iran’s nuclear centrifuges, ushering in a new era of cyberweapons capable of real-world damage.

Advanced Entry Points and Tools

These operations often begin through sophisticated attack vectors, such as:

• Supply chain compromises
• Zero-day vulnerabilities
• Custom-built exploits tailored for specific industrial control systems (ICS)

Strategic Motives & Civilian Impact

Strategic Motives

Both Iran and Israel use cyberwarfare to pursue their goals without starting a full-scale military war.

• Iran often launches cyberattacks in response to physical attacks on its facilities, such as its nuclear sites. It also uses cyberattacks to gather information that helps improve its defenses.
• Israel, on the other hand, uses cyber operations mainly to prevent threats before they happen by disrupting enemy systems and collecting important intelligence. Israel is known for advanced cyberattacks like Stuxnet, which targeted Iran’s nuclear program.

Cyberwarfare allows both countries to act with lower costs, less risk, and greater secrecy. It helps them show strength, test new tools, and send political messages all while avoiding crossing the threshold of traditional war.

Civilian Impact

Although the targets are often governments or military, civilians often suffer collateral damage. For example:

• Iranian hospitals have been hit by ransomware or disruptions, worsening health outcomes.
• Israeli water systems or telecommunications networks have been targeted, affecting everyday services.
• The $90 million crypto exchange hack impacted ordinary Iranian investors.

Conclusion: The World Beyond the Firewall

As Iran and Israel sharpen their digital arsenals, the world watches from beyond the firewall , whether knowingly or not.

In this new age, every connected device is a potential weapon or target. Cybersecurity is no longer just a technical issue , it is a matter of national defense, economic security, and global stability.

As this digital cold war escalates, the importance of vigilance, transparency, and international cooperation becomes more critical than ever. Because the next war may not be fought in trenches or skies but in lines of code.