Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Iran-linked cyber activity during the June 2025 Israel-Iran conflict showed more strategic alignment than a collection of unrelated attacks might suggest. SecurityScorecard and the Middle East Institute described shared messaging, campaign timing and adaptation. That is evidence of coordination across parts of an Iran-aligned ecosystem—not proof that every participating group took orders from a single command.
What “more coordinated” means in this case
The assessment is about patterns in activity and messaging during the 12-day conflict, not a proven chain of command. The observed ecosystem included channels assessed as linked to Iranian cyber forces, regional proxies and ideologically aligned hacktivists. Their interests could overlap without their having the same sponsor, orders or operational control.
In its analysis, the SecurityScorecard STRIKE Team wrote: “Our analysis reveals a detailed map of operations that were fast, targeted, and ideologically charged,”. Analyst Nima Khorrami, writing for the Middle East Institute, described “greater coordination, clearer strategic intent, and the integration of digital tools across military, political, and psychological domains,”. These are assessments of the campaign’s observed character; neither statement establishes that all groups were centrally directed.
What evidence supports the assessment?
A large but bounded view of Telegram activity
SecurityScorecard’s STRIKE Team analyzed 250,000 Telegram messages from more than 178 groups active over the 12-day conflict. Those figures describe the scale of the team’s message dataset. They are not counts of verified cyberattacks, confirmed Iranian state-run groups or successful intrusions.
#1 Best Overall
The analysis found propaganda and operational messaging, including Telegram recruitment and coordination. Read alongside the Middle East Institute’s policy analysis, this provides evidence of a shared strategic environment and alignment among some actors. A message shared in a public channel, however, does not by itself show who gave an instruction or whether a group followed it.
Campaigns adapted as the fighting intensified
CyberScoop reported that Imperial Kitten, also known as Tortoiseshell, shifted tactics as hostilities intensified, using conflict-themed phishing lures and infrastructure built soon after the physical fighting began. The timing and tailored lures are consistent with responsive planning or tasking. They do not identify the precise chain of command behind the activity.
Multiple sides mobilized online
ZeroFox Intelligence identified over 120 cyber threat collectives contributing to the escalation and observed increased activity from both Iran-aligned and Israel-aligned groups. The figure is ZeroFox’s count of observed collectives in 2025, not a measure of successful attacks or a count limited to Iranian actors. ZeroFox cautioned that public claims and the number of groups observed should not be mistaken for verified impact.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Who was involved—and why the distinctions matter
The reporting describes several kinds of participants, whose relationships with Iran were not equivalent:
Rank #3
- Channels assessed as operated or sponsored by Iranian cyber forces: SecurityScorecard assessed some channels as connected to Iranian cyber forces with moderate confidence. That is an attribution judgment, not public proof of state control over every operation posted there.
- Regional cyber proxies: These actors could advance interests aligned with Iran without the available reporting establishing the extent of direction or control in each case.
- Ideologically aligned hacktivists: Collectives in this category may act from political or ideological sympathy. Shared goals or messaging do not, on their own, demonstrate state sponsorship.
Calling all three categories “Iranian hackers” can therefore overstate what is known. “Iran-aligned” is more accurate for activity where the reporting indicates alignment but does not establish direct state control.
What kinds of cyber activity were reported?
SecurityScorecard’s account covered both information operations and technical activity: propaganda and recruitment; reconnaissance and vulnerability scanning; phishing; website defacements; data theft; and claims of attacks on public entities and critical infrastructure. ZeroFox also reported public claims of DDoS attacks and hack-and-leak activity.
These methods serve different purposes. Messaging can amplify a political narrative; reconnaissance and scanning can look for potential targets or weaknesses; phishing can seek access; and defacement, DDoS or leaked data can create visible disruption or pressure. A public claim that one of these actions occurred is not confirmation that a system was compromised or that the claimed target suffered meaningful harm.
Did the cyber activity change the military outcome?
The available reporting does not establish a decisive military advantage from the cyber operations. CyberScoop relayed an Atlantic Council assessment that cyber activity shaped and augmented the information environment but did not provide decisive military advantage. Nikita Shah, a senior resident fellow at the Atlantic Council’s Cyber Statecraft Initiative, cautioned: “It can be easy to conflate the volume of cyber activity in the Israel-Iran war with decisive impact,”.
Best Value
That distinction matters because public attack claims, message volume and the number of active collectives describe activity, not effect. The materials do not provide a reliable consolidated count of successful attacks or a quantified measure of damage attributable to this cyber activity.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to judge coordination claims in future conflicts
Group counts and message totals are useful context, but they cannot rank campaigns by themselves. A sound comparison should keep separate the questions of who acted, how activity related to events on the ground, what was technically done and what effect was independently verified.
- Attribution: What evidence connects an actor to a state, proxy relationship or ideological cause, and how confident is that assessment?
- Timing: Did activity begin or change in relation to kinetic events? Timing can suggest responsiveness, but does not establish command.
- Coordination signals: Were there shared messages, infrastructure, tools or target choices? Similarity is informative but not conclusive proof of centralized direction.
- Tactics and targets: Which methods and sectors were involved, and are reports describing attempts, claims or confirmed incidents?
- Verified effect: Is there independent evidence of compromise, disruption or damage, and can it be attributed to the cyber operation?
The available SecurityScorecard and ZeroFox materials do not provide a standardized cross-conflict dataset, so comparing campaigns by raw group or message counts alone would be misleading.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
What the March 2026 warning does—and does not—show
A joint advisory issued in March 2026 said critical-infrastructure organizations should prepare for possible increased activity from Iranian state-sponsored actors, aligned hacktivists and cybercriminal groups. The advisory also clarified that an organization’s participation in it did not mean that organization was experiencing increased activity. It is subsequent preparedness guidance, not evidence about the conduct or impact of the June 2025 conflict.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
