Executive Summary
Since the launch of Operation Epic Fury in late February 2026, the cyber dimension of the Middle East conflict has evolved from highly visible disruption into a more complex and sustained threat landscape. Early activity was characterized by DDoS attacks, defacements, and public breach claims. Over time, reporting shows a clear shift toward more targeted and persistent operations, including reconnaissance, credential compromise, exploitation of exposed services, and attempts to establish longer-term access within organizations.
Across the reporting cycle, cyber activity has increasingly blended disruption, espionage, influence operations, and opportunistic intrusion. While high-volume attacks continue to generate visibility, the more significant risk may lie in quieter, ongoing efforts to gain footholds in enterprise environments and critical systems. This progression suggests a move beyond short-term impact toward sustained pressure, intelligence gathering, and the potential for more coordinated or disruptive activity as the conflict continues to unfold.
Due to the ongoing conflict in the region, CyberProof Threat Research Teams continue to monitor the situation.
CTI Update 2: March 5, 2026
There has been a transition from high-visibility disruption to reconnaissance-driven intrusion campaigns following the escalation triggered by Operation Epic Fury. While early activity was dominated by DDoS attacks, defacements, and influence operations, Iranian state-linked actors are now actively scanning enterprise environments and exploiting newly disclosed vulnerabilities to establish long-term access. This aligns with a familiar pattern of initial disruption followed by quieter efforts focused on credential compromise, infrastructure reconnaissance, and persistent foothold establishment.
At the same time, the threat landscape is rapidly expanding, with 149 hacktivist-led DDoS attacks targeting 110 organizations across 16 countries, demonstrating large-scale mobilization of aligned actors. Multiple groups are actively conducting disruption campaigns and amplifying claims through messaging platforms to reinforce geopolitical narratives.
In parallel, Iranian actors are increasingly targeting internet-connected devices such as IP cameras and surveillance systems, indicating an overlap between cyber operations and physical conflict dynamics. Overall, disruption remains highly visible, but the more significant risk lies in ongoing efforts to gain persistent access across targeted networks.
Visit the Cyber Threat Intelligence on Middle East Escalations Resource Hub for new developments.
