Cyber operations persist after ceasefire

A long running cyber campaign continues after the ceasefire, shaping a broader digital conflict beyond the battlefield.

Cyber War Persists Between Israel and Iran After Ceasefire

In the days after Israel launched its surprise bombing on Iran, officials received a barrage of suspicious text messages containing malicious links. Since the ceasefire, Iranian aligned groups have attempted to exploit a vulnerability in Microsoft server software to attack Israeli companies, according to the Israeli cyber threat intelligence firm ClearSky. Attacks have included a heist at the Nobitex crypto exchange and a surge in spear phishing impersonating diplomats or the prime minister’s office. On the Israeli side, authorities say the cyber arena has not paused; one official notes, “I’m still getting them.”

Iran reports more than 20,000 cyber attacks during the war, described as the most extensive such campaign in the history of the Islamic republic. Attacks disrupted Iran’s air defence systems as Israeli jets targeted the country in mid June. Analysts and former officials say the most consequential role of cyber operations was the espionage campaign that preceded the physical fighting, enabling a detailed profile of Iranian nuclear scientists and military officials and helping locate and target more than a dozen individuals in the opening moves of the offensive. The hacking group Gonjeshke Darande is said to have burned about $90 million from the Nobitex exchange by depositing funds into digital wallets without private keys, an action Nobitex denies as a tool of the regime. In parallel, Iranian linked groups conducted hack and leak operations on around 50 Israeli firms, focusing on smaller suppliers and exposing thousands of CVs of Israelis with defence experience. Some attackers also spoofed messages from Israel’s home command system telling people to avoid air raid shelters and attempted to hack security cameras to monitor missile landings. A crisis negotiator with military experience notes that while Iran’s capabilities are real, none of the attacks on Israel produced dramatic military impact.

The cyber front in this conflict is now a lasting, separate theater that could outlast any single ceasefire. The ease of attribution troubles traditional deterrence, while plausible deniability reduces political costs for both sides and expands retaliation options beyond overt military strikes. Analysts warn that as long as critical data and digital infrastructure remain exposed, civilians and private companies are exposed to spillovers and pressure from the war’s rhythm. The result could be a quiet, persistent escalation that drags in global tech firms, investors, and regional partners who rely on stable networks. International norms and cooperation will be tested as states learn how to police a space where miscalculation is less visible but potentially just as damaging.

The episode also underscores how cyber operations intersect with power politics. The same tools that enable precise prewar intelligence can be repurposed for disruption across supply chains and finance, affecting everyday life far from the front lines. As the United States and other powers watch, the challenge will be to deter a form of aggression that offers deniability and minimal immediate casualties while threatening long term strategic costs for any party involved.

Highlights

The digital shadow war tests restraint and resilience more than it does headlines.