Iranian cyberattacks against Israel triple as smaller businesses become new battlefield

Iranian cyber activity targeting Israel surged sharply during June 2026, with Israeli authorities recording approximately 4,800 hostile cyber incidents as the military confrontation between Iran, Israel and the United States expanded into digital networks.

The June 2026 total was three times the approximately 1,600 incidents registered during Israeli military operations against Iran in June 2025. Yossi Karadi, Director General of the Israel National Cyber Directorate, said the attacks targeted critical infrastructure systems, major institutions, small and medium-sized businesses and members of the public.

Israel said attacks against critical infrastructure had been repelled, but some less-protected companies suffered the complete deletion of their computer systems. Law firms and accounting businesses were among the smaller organisations targeted, illustrating how the cyber conflict has expanded beyond military agencies and major technology operators.

The incident count does not mean that 4,800 Israeli organisations were successfully breached or that every event caused operational damage. It represents hostile activity recorded by Israeli authorities and may include attempted intrusions, disruptive attacks, malicious communications and other cyber incidents attributed to Iranian or Iran-aligned actors.

Iran usually denies conducting cyber campaigns against foreign countries and has repeatedly said that Iranian institutions are also targeted by hostile cyber operations. The latest figures were provided by Israel and had not been independently confirmed by Iranian authorities.

Why did Iranian cyber activity against Israel triple during the June 2026 military confrontation?

Cyber operations allow states and aligned groups to continue applying pressure even when conventional military attacks are paused, limited or constrained by diplomatic negotiations.

The latest surge followed the United States and Israeli military offensive against Iran and the subsequent exchanges involving missiles, drones, shipping routes and regional military installations. Physical hostilities have moved through periods of escalation and ceasefire, but cyber actors can continue operating without aircraft crossing borders or missiles appearing on radar.

Yossi Karadi said there was effectively no ceasefire in cyberspace. The Israeli assessment reflects a broader feature of modern conflict: cyber operations can gather intelligence, disrupt services and create public anxiety while remaining below the threshold that would automatically trigger a conventional military response.

Some attacks may be prepared weeks or months before a crisis. Threat actors can gain access to networks, steal credentials or identify exposed systems during quieter periods, then use those positions when geopolitical tensions intensify.

Other operations can be launched rapidly by hacktivist groups using denial-of-service tools, stolen passwords or publicly available vulnerabilities. This creates a mixed threat environment involving sophisticated state-directed actors, contractors, ideologically aligned hackers and groups seeking publicity.

The tripling of reported activity does not necessarily mean that every attacker became more technically advanced. It may reflect an increase in the number of participating groups, heavier targeting of easily accessible organisations and the activation of previously established access.

Microsoft’s 2025 threat intelligence data identified Israel as the destination for 64 percent of notifications connected to Iranian state-linked cyber activity, far ahead of the United States, United Arab Emirates and other targeted countries. Microsoft said Iran used cyber operations against Israel for intelligence collection, disruption and retaliation below the level of open warfare.

Why are law firms, accountants and smaller companies becoming strategic cyber targets?

Smaller businesses may not appear to possess the strategic value of an electricity company, military contractor or government ministry, but they often hold information and access that can lead to more important targets.

Law firms store contracts, litigation files, corporate ownership records, negotiation documents and communications involving government agencies, defence companies and senior executives. Accounting firms maintain financial records, tax data, payroll information and access to clients’ financial systems.

A smaller professional-services provider may also connect electronically to dozens or hundreds of customers. Compromising one provider can give an attacker trusted email accounts, shared documents or remote access that can be used against larger organisations.

These businesses frequently operate with smaller cybersecurity teams and less redundancy than banks, government departments or critical infrastructure operators. They may rely on outsourced technology support, older software or systems that cannot be taken offline easily for maintenance.

Yossi Karadi said some easier-to-penetrate companies had their systems wiped. A destructive attack of that kind can remove files, disable computers and interrupt operations even when the attacker does not permanently damage physical infrastructure.

Microsoft identified information technology providers as the most heavily targeted sector among Iranian cyber operations in its 2025 data, accounting for 21 percent of observed targeting. Research and academic organisations represented 15 percent, while government, transportation and communications organisations were also prominent targets.

The focus on information technology companies reflects their position inside digital supply chains. An attacker that compromises a technology provider can potentially reach customer networks, sensitive communications and multiple downstream sectors through one operation.

The June 2026 cyber campaign therefore shows why national resilience cannot depend exclusively on protecting power stations, military systems and major government networks. A country’s digital security can be weakened through thousands of smaller organisations that support its economy and institutions.

How can Israel repel critical infrastructure attacks while companies still lose entire systems?

Critical infrastructure organisations generally receive greater regulatory attention, intelligence support and government coordination than ordinary commercial businesses.

Electricity, water, telecommunications, healthcare, finance and transportation operators are expected to maintain incident-response procedures, backup systems and specialised security teams. They may also receive threat indicators from national agencies before attacks become widely visible.

This layered defence can stop or contain intrusions before they interrupt essential services. It can also help operators isolate compromised systems and continue providing services through alternative infrastructure.

The absence of a successful critical infrastructure shutdown does not mean those systems were not targeted. Israeli authorities said hostile activity was directed against infrastructure networks, but the attacks had been repelled at the time of the June 29 disclosure.

Smaller organisations may lack the same defensive depth. A business can be effectively paralysed when its file servers, accounting systems, customer records and employee devices are simultaneously deleted or encrypted.

A technically simple attack can therefore produce a severe business impact. An attacker does not always need to penetrate a sophisticated industrial-control system. Destroying ordinary office systems may be enough to interrupt legal work, financial transactions, manufacturing administration or logistics.

Microsoft found that phishing or social engineering initiated 28 percent of breaches examined in its broader incident-response data. Unpatched internet-facing systems accounted for 18 percent, while exposed remote services accounted for 12 percent. Those global figures are not specific to the June attacks against Israel, but they show how familiar weaknesses continue to provide entry points.

The central security lesson is that national cyber resilience depends on recovery as well as prevention. Organisations need offline backups, tested restoration plans and clear authority to isolate systems quickly when an intrusion is detected.

What types of cyber operations are Iran-aligned groups using against Israeli targets?

Iran-linked cyber activity includes espionage, destructive malware, information theft, disruption and psychological operations designed to influence public confidence.

Espionage campaigns seek access to government, military, research and corporate information. Attackers may use convincing emails, false professional identities and compromised accounts to approach officials, researchers, journalists or executives.

Destructive operations focus on disabling or deleting systems. These attacks can be presented as ransomware even when financial payment is not the principal objective. The visible demand for money may disguise a state-linked effort to destroy data or interrupt operations.

Distributed denial-of-service attacks flood websites or online services with traffic, making them temporarily unavailable. These operations are relatively easy to publicise and can create the appearance of widespread disruption even when underlying networks remain secure.

Hack-and-leak campaigns combine intrusion with public disclosure. Attackers steal information, release selected documents and use social media channels to maximise political or psychological impact. The released material may be authentic, altered, incomplete or presented without context.

Google Threat Intelligence Group said pro-Iran hacktivist operations had moved beyond basic nuisance attacks towards data leaks, operational disruption, supply-chain compromise and campaigns targeting military personnel. Groups have publicised alleged breaches involving Israeli defence manufacturers, technology companies and logistics providers.

Doxxing operations publish personal information about soldiers, officials, intelligence personnel or defence-sector employees. Their purpose may include intimidation, reputational damage and the creation of fear among individuals connected to national security institutions.

The diversity of methods makes attribution difficult. A group may describe itself as an independent hacktivist organisation while using access, infrastructure or information connected to a state-backed operation. State-linked actors may also use hacktivist branding to obscure responsibility.

Why is reliable attribution difficult during an active cyber conflict between Iran and Israel?

Cyberattacks do not carry visible national markings comparable to military aircraft or naval vessels. Attackers can route activity through servers in several countries, use stolen infrastructure and adopt tools available to criminal groups.

Investigators therefore rely on combinations of evidence. These can include technical methods, malware code, infrastructure reuse, working hours, target selection and links to previously identified operations.

Even strong technical attribution does not always establish the precise relationship between a group and a government. An operation may be directly controlled by an intelligence agency, conducted by a contractor or launched by an ideologically aligned group acting with limited coordination.

Microsoft reported increasing overlap in methods and resources among some Iranian cyber actors. Microsoft said the convergence could reflect shared personnel, contractor support, central direction or deliberate efforts to make attribution more difficult.

Public claims also need cautious treatment. Hacktivist channels frequently exaggerate their access, reuse old information or claim responsibility for disruptions caused by unrelated technical failures.

Governments have incentives to shape the narrative. Israel benefits from demonstrating that its critical infrastructure remains resilient while highlighting the scale of Iranian aggression. Iran benefits from denying responsibility for attacks that could invite retaliation while publicising alleged cyber successes against Israeli institutions.

The June figure of 4,800 incidents should therefore be understood as an Israeli security assessment. It demonstrates a large increase in recorded hostile activity, but it does not provide a public technical breakdown establishing the origin, success rate and impact of every event.

Could cyberattacks continue even if the United States, Israel and Iran preserve a ceasefire?

Cyber activity is likely to remain a source of confrontation because it offers strategic advantages that physical attacks do not.

A cyber operation can be denied, delayed or conducted through intermediaries. The target may not immediately know whether an outage resulted from an attack, human error or equipment failure.

This uncertainty can reduce the immediate political cost for the attacker. It also complicates retaliation because governments may hesitate to respond before attribution reaches a high level of confidence.

Cyber operations can support conventional military planning by collecting information about logistics, transportation, communications and industrial capacity. Access obtained during a ceasefire may be retained for possible use during a later conflict.

The digital environment also includes private actors that are not bound by formal ceasefire arrangements between governments. Hacktivist groups may continue targeting perceived enemies even when political leaders have agreed to halt missile or drone attacks.

A sustained cyber campaign could still damage diplomacy. The destruction of a hospital network, power system or major financial platform could be treated as a serious escalation even without physical weapons.

The most difficult policy question is determining when a cyberattack crosses the threshold from espionage or disruption into an armed attack. International law recognises that severe cyber operations can have consequences comparable to physical force, but governments have not established a universally accepted response framework.

Israel’s ability to protect critical infrastructure has prevented the June surge from producing a publicly confirmed national emergency. The danger lies in the possibility that one successful intrusion could generate consequences much larger than the thousands of unsuccessful or contained attempts surrounding it.

What are the key takeaways from the surge in Iranian cyberattacks against Israel?

• Israel recorded approximately 4,800 hostile cyber incidents during June 2026, three times the roughly 1,600 incidents registered during Israeli military operations against Iran in June 2025.
• Yossi Karadi, Director General of the Israel National Cyber Directorate, said attackers targeted critical infrastructure, major institutions, smaller companies and members of the public during the latest escalation.
• Israeli authorities said critical infrastructure attacks had been repelled, but some less-protected companies suffered the complete deletion of their computer systems following successful intrusions.
• The 4,800 figure does not represent 4,800 confirmed successful breaches because the total may include attempted intrusions, disruptions and other hostile activity recorded by Israeli security authorities.
• Law firms, accounting firms and technology providers are strategically valuable because they hold sensitive information and maintain trusted digital connections with larger corporate and government clients.
• Microsoft identified Israel as the target of 64 percent of Iranian state-linked cyber notifications in its 2025 threat data, with information technology and research organisations among the most targeted sectors.
• Pro-Iran cyber groups have increasingly used destructive attacks, hack-and-leak operations, supply-chain compromises and doxxing campaigns intended to disrupt organisations and weaken public confidence.
• A conventional ceasefire may not end cyber conflict because state-linked actors and hacktivist groups can continue operating through deniable infrastructure without launching visible military attacks.