The United States’ war with Iran has no clear exit ramp. Periods of negotiation or reduced hostilities may interrupt the fighting, but they are unlikely to end the broader confrontation. Even if economic pressure forces change within the Iranian hierarchy, a more moderate leadership may not control much. And even if a cessation of hostilities holds, the asymmetric war is likely to continue.
For cyber defenders, that means the U.S. military, the defense industrial base (DIB) that supports it, and domestic critical infrastructure remain priority targets. Modern warfare is no longer limited to physical front lines. It has reached into corporate networks, industrial control systems, and the thousands of contractors and suppliers that sustain U.S. military operations.
Asymmetric war, asymmetric cyber
Iran’s military doctrine has long emphasized asymmetric tactics, from proxy militias and drone swarms to small boat harassment in the Strait of Hormuz. If you cannot match your adversary directly, force them to absorb pain across as many vectors as possible.
Cyber operations follow the same logic. The goal is not a decisive digital victory, but to impose economic costs, disrupt logistics, degrade industrial capacity, and generate friction everywhere at once.
Iran’s cyber effort includes dozens of loosely affiliated groups. ranging from state contractors to Islamic Revolutionary Guard Corps (IRGC) and Ministry of Intelligence and Security (MOIS) proxies to freelance hacktivists. Their capabilities vary widely, but sophistication is beside the point. They move quickly, hit a large number of targets and do not stop. Collectively, they can cause significant disruption, and defenders have to answer all of it.
No more red lines
Iran built much of its cyber program around intelligence collection and influence operations, but it has repeatedly demonstrated a willingness to cause disruption. It targeted U.S. banks with distributed denial-of-service (DDoS) attacks from 2011 to 2013, breached the control system of a New York dam in 2013, hit Las Vegas Sands with destructive wiper malware in 2014, and targeted Israeli-made controllers at dozens of U.S. facilities in 2023.
Historically, however, Iran stopped short of sustained attacks on American critical services because crossing certain thresholds risked military retaliation. However, this risk calculus has fundamentally changed. Iran’s leadership has been assassinated, the country repeatedly bombed, and its economy placed under enormous pressure. The regime is fighting for survival, and the escalation threshold has moved with it.
Iran’s recent attacks on U.S. water utilities are a clear sign that the gloves are coming off.
What does that mean in practice?
- Fear of U.S. retaliation is less of a deterrent. Whatever punishment Washington devises now folds into pain Iran is already absorbing. Defenders should not plan around restraint that may no longer have a rational basis.
- Iran does not need top-tier capabilities. Russia and China may be more sophisticated, but Iran has repeatedly breached critical infrastructure. When targets are soft, relatively crude attacks can be enough.
- Iran is getting help. CrowdStrike detected a surge in Russian hacktivist activity supporting Tehran since the war began, including groups claiming attacks against U.S. networks.
- The military supply chain is the real prize. Disrupting civilian infrastructure raises costs on the American public. But disrupting the logistics and industrial capacity supporting US military operations has direct battlefield value. This is what makes the defense industrial base a priority target.
An evolving threat landscape
State-directed attacks are targeting industrial control systems. In April 2026, the Cybersecurity and Infrastructure Security Agency, Environmental Protection Agency, FBI, National Security Agency and other agencies warned that Iranian-affiliated actors were targeting internet-facing industrial equipment across government, water and energy systems, manipulating controls and causing operational disruption. By mid-August, utilities in at least 12 states had reported incidents, with some operators losing remote control and reverting to manual operations. The objective was not data theft, but disruption.
Additionally, ideologically aligned hacktivists are operating in parallel. They may be less sophisticated, but they can still halt production with ransomware or other relatively simple attacks. More importantly, they multiply Iran’s reach by hitting more targets while state teams focus on higher-value objectives. The two can also work in tandem, with criminal or hacktivist groups gaining initial access that more capable state actors can exploit. This means an intrusion that looks like ordinary cybercrime may be the opening move of something much bigger.
Another concern is the emergence of hybrid physical-cyber operations. Check Point tracked hundreds of Iranian attempts to compromise internet-connected cameras across countries experiencing missile activity. Iranian actors have also used cyber operations to locate military personnel and support kinetic targeting, while cyber-enabled surveillance and intelligence gathering have been tied to plots against U.S. officials and regime critics. Pro-Iranian hackers have also openly discussed targeting data centers supporting U.S. military communications and targeting systems.
Underlying all three is a pivot toward operational technology. Altering a programmable logic controller (PLC) does not simply expose information. It changes the physical world by slowing a production line, creating false readings, or disrupting manufacture of components destined for weapons systems.
The supply chain is the battlefield
Major primes have the resources and regulatory pressure to run meaningful security programs. The thousands of small- and mid-sized subcontractors feeding into them often do not. If the objective is to degrade military-industrial capacity, those weaker nodes are attractive precisely because they connect to more hardened targets.
A compromised managed service provider can provide access to dozens of downstream facilities. A supplier with legitimate credentials can become an open door into a prime’s network. Iranian operators are mapping these relationships, harvesting credentials, and looking for the connective tissue between organizations. A defense contractor’s security posture is no longer just its own problem.
Defending against the threat
None of this requires becoming a cyber fortress overnight, but every defense contractor should reassess whether its cybersecurity reflects today’s threat environment or the one that existed five years ago.
Begin with the threat model. If your program is built primarily around protecting intellectual property, you are defending the last war. The objective now may be disruption or destruction. Iranian operators frequently use wiper malware and may also weaponize ransomware. Assume an attack could be intended to delete data, disrupt operations or damage systems, and build your recovery plans accordingly.
Treat operational technology (OT) security as seriously as IT security. Know your supply chain well enough to identify the weakest links, because adversaries are mapping them too. Monitor continuously rather than checking compliance boxes periodically.
Expect simultaneous and overlapping attacks. State units, proxies, hacktivists, and criminal crews may work together. A proxy may gain initial access and hand it off to a state-backed team, while Iranian actors have also brokered access to ransomware affiliates and paid criminals to hit U.S. and Israeli targets. State operations can also masquerade as ordinary cybercrime. What looks like a criminal attack may be the opening move of something much larger.
Don’t stop your Cybersecurity Maturity Model Certification (CMMC) efforts. Phase 2 may be paused, but the threat isn’t. Our research mapped 130 techniques used by five Iranian threat groups against the National Institute of Standards and Technology’s Special Publication 800-171 baseline. Sixty-eight percent can be mitigated by controls already in it, and 100% can be detected with the right monitoring. Four controls carry most of that weight: system monitoring, configuration settings, baseline configuration and malicious code protection.
The conflict with Iran is a stark demonstration of what modern asymmetric warfare looks like. What Iran is demonstrating through these attacks will not stay with Iran. China, Russia, and other U.S. adversaries are watching. Defense contractors should plan accordingly.
Darron Makrokanis is chief revenue officer of Summit 7.
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.