Cyber conflict spills beyond borders as geopolitical crisis fuels global attack surge

When Iran's internet nearly vanished in late February—dropping to just 1 to 4 percent of its normal traffic after coordinated US and Israeli strikes on military and nuclear targets—the country didn't simply lose connection. It effectively disappeared from the global internet, according to network monitoring data tracked by cybersecurity researchers. But the cyber conflict didn't stop. It moved outward.

Even as Iran went dark, operations continued across borders, carried out by state-backed actors, proxy groups, and independent hackers who didn't need a functioning domestic internet to keep working. Within weeks, researchers documented a sharp spike in global threat activity tied to the conflict—coordinated campaigns by dozens of hacktivist groups, waves of phishing attacks, scams, and disruptive intrusions targeting organisations far outside the Middle East. What emerged wasn't a contained cyberwar. It was something more complex: modern geopolitical crisis functioning simultaneously as both cover and opportunity for a shadow economy of cybercrime, where attacks kept moving even when countries themselves went offline.

The cyber offensive began almost in parallel with the February 28 military strikes. Websites were defaced. Government platforms went down. BadeSaba, a religious app with more than 5 million downloads, was hacked to display messages urging users to abandon the regime. Iranian state news agency IRNA was taken offline. The IRGC-linked Tasnim website faced disruptions and message alterations. The scale suggested coordination beyond isolated incidents. Western intelligence sources indicated the cyber operations aimed to disrupt Iran's ability to mount a response—limiting communications and degrading command systems. According to cybersecurity firm Palo Alto Networks' Unit 42, the conflict quickly pulled in both state-backed actors and loosely aligned hacktivist groups. CloudSEK tracked more than 150 claimed hacktivist incidents between February 28 and March 1, largely involving denial-of-service attacks, website defacements, and data breach claims. Researchers also observed Iranian-aligned actors conducting reconnaissance and initiating denial-of-service attacks before the strikes even landed.

This surge built on an already expanding baseline of global cyber threat activity. According to the World Economic Forum's Global Cybersecurity Outlook 2026, 77 percent of organisations globally reported a rise in phishing and fraud, while 73 percent of individuals experienced cyber-enabled crime. The average number of weekly cyberattacks per organisation had more than doubled in recent years, from 818 to 1,984. Breaches now moved from initial access to data exfiltration in under 72 minutes in some cases. Into this landscape, the US-Iran conflict landed.

What distinguished this moment was the scope and the targets. Beyond websites and media systems, the early cyber campaign appeared to target deeper infrastructure. CloudSEK said attacks likely combined denial-of-service campaigns, electronic interference, and network intrusions targeting energy, aviation, and government systems. In late March, Unit 42 identified activity linked to a group known as Cyber Av3ngers, targeting industrial control systems used in manufacturing and utilities—specifically software from Rockwell Automation, the kind that quietly runs factories and energy grids. Researchers identified more than 5,600 internet-connected devices globally using such systems. The US Cybersecurity and Infrastructure Security Agency flagged attempts to exploit programmable logic controllers—small but critical components that automate everything from water supply systems to power grids. In March, an Iran-linked group deployed wiper malware against Stryker Corporation, a US-based medical technology firm, disrupting operations and delaying procedures. That kind of disruption translated directly into real-world consequences—postponed surgeries, interruptions in essential services.

But the bigger shift was happening outside state-backed operations. Alongside these attacks, cybersecurity firms tracked a parallel surge in financially motivated cybercrime, often piggybacking on the chaos. Unit 42 recorded more than 7,300 conflict-themed phishing URLs across nearly 1,900 domains in March alone—fake charity drives, crypto scams, spoofed telecom portals, banking sites. Attackers impersonated airlines, law enforcement, and government systems, using increasingly polished techniques to slip past detection. Much of this activity targeted everyday users, especially through mobile-first attacks. The playbook was familiar: urgency, fear, and just enough plausibility. A bank alert. A utility warning. A government notice. The US Federal Trade Commission flagged similar trends—fraudsters posing as bank officials warning of Iran-linked transactions, fake military romance scams, sham charities.

This overlap between state conflict and criminal opportunity wasn't accidental. Cybersecurity analysts noted that Iran had increasingly relied on a mix of formal state-linked cyber units and loosely affiliated hacktivist or proxy groups—a model that allowed extended operations while maintaining plausible deniability. Unit 42 identified dozens of such groups active in the current conflict, carrying out everything from denial-of-service attacks to data leaks and infrastructure probing. Some, like the Handala Hack group, paired cyberattacks with psychological operations—leaking personal data or issuing threats to amplify pressure. The World Economic Forum reported that 91 percent of large organisations were already reworking their cybersecurity strategies in response to geopolitical instability.

The risks extended far beyond the Middle East. CloudSEK noted that second-order countries—those not directly involved—were increasingly exposed. That included major economies such as India, Japan, and several European states. The risks spanned espionage, ransomware, supply chain disruptions, and disinformation. In a tightly connected global system, vulnerabilities didn't stay contained. Companies across finance, energy, and transport had been targeted. Disruptions to shipping routes, particularly through the Strait of Hormuz, were starting to ripple into global trade. In India, a March 2026 advisory by the Data Security Council warned that sectors ranging from energy and finance to IT services could face elevated cyber threats. With a large share of India's energy imports passing through the Strait of Hormuz, any cyberattack on Gulf infrastructure or shipping systems could worsen supply disruptions and hit domestic markets. The IT services sector was flagged as a potential weak link—where a breach at a single vendor could cascade across global clients. Financial institutions faced renewed exposure to ransomware and supply-chain attacks. As Sami Khoury, Senior Official for Cybersecurity at the Government of Canada, told the World Economic Forum: geographic distance offered no defence.

Unlike conventional warfare, cyber operations could linger long after fighting stopped. Alexander Leslie, a senior adviser at Recorded Future, told The New Yorker that the ceasefire didn't end cyber conflict; it changed its rhythm. Cyber operations could quietly probe systems, harvest data, and wait for the next opening. And increasingly, those openings weren't limited to states. The tools of cyberwar, once tightly held by governments, were now far more accessible. With artificial intelligence lowering technical barriers and global crises offering ready-made narratives, even relatively low-skilled actors could mount convincing attacks. The result was a threat landscape that was more crowded, more chaotic, and harder to predict. War, in this sense, was no longer just destructive. It was generative—creating new actors, new incentives, and new risks. And as the US-Iran conflict showed, those risks rarely stayed on the battlefield.