Iran’s Pre-Planned Cyber Offensive: Six Months of Silent Preparation Before the 2026 Strikes
scsecMarch 27, 20262 Mins read 
Iran-linked cyber groups significantly ramped up their activity following the late February 2026 US and Israeli military strikes, but new analysis suggests this response was not spontaneous. Instead, it appears to have been carefully prepared months in advance.
Research from cybersecurity firm Augur Security indicates that Iranian intelligence and military-linked cyber units—particularly those associated with the Ministry of Intelligence and Security (MOIS) and the Islamic Revolutionary Guard Corps (IRGC)—began expanding and strengthening their operational infrastructure as early as six months before the strikes.
Pre-Positioned Cyber Infrastructure
Iranian cyber operations rely on a layered infrastructure designed to obscure attribution and ensure resilience. At the base level are domestic providers such as Tehran-based hosting companies. These connect to second-tier “bulletproof” hosting services in multiple countries, which are known for tolerating or ignoring malicious activity.
A third layer involves shell companies and globally distributed hosting setups. Some of these entities are registered in countries like the United States or the United Kingdom but operate across jurisdictions such as Dubai or the Netherlands. This multi-layered design makes tracking and disrupting operations far more difficult for defenders.
Signs of Preparation
Augur’s analysis found a noticeable surge in infrastructure activity among major Iranian advanced persistent threat (APT) groups in the months leading up to the February 28 strikes.
For example, the group commonly known as MuddyWater showed a spike in network allocations in September 2025, including activity tied to European hosting providers. This pattern is consistent with staging infrastructure ahead of planned cyber operations. While the connection to the later conflict is assessed with moderate confidence, the timing strongly suggests preparation for a coordinated response.
Other well-known Iranian-linked groups involved include OilRig (APT34), APT35 (Charming Kitten), APT33 (Peach Sandstorm), Cotton Sandstorm, and CyberAv3ngers. These groups are tied to either MOIS or IRGC cyber units and have a long history of espionage, disruption, and influence operations.
Expansion of Hacktivist Activity
Within 24 hours of the military strikes, Iran-aligned actors reportedly established a centralized “Electronic Operations Room” to coordinate cyber activities. This effort brought together approximately 60 hacktivist groups, enabling rapid and synchronized attacks.
Groups such as Cyber Fattah, Fatimiyoun Cyber Team, and Handala participated in this coordinated campaign. Their operations have primarily targeted government systems, financial institutions, and critical infrastructure in the United States and Israel. Secondary targets include Gulf nations perceived as supporting or facilitating the strikes.
Operational Resilience
Despite damage to Iran’s domestic internet infrastructure caused by the strikes, the country’s cyber capabilities remained largely unaffected. This is due to the distributed and international nature of its cyber infrastructure, which allows operations to continue even when local systems are disrupted.
The structure and mission of the IRGC also contribute to this resilience. Unlike the conventional Iranian military, which focuses on national defense, the IRGC operates as a broader ideological and strategic force with global reach, including dedicated cyber units.
Key Takeaway
The findings highlight a critical reality: cyber capabilities are not easily degraded through traditional military action. Iran’s ability to prepare, distribute, and sustain its cyber operations across multiple jurisdictions makes it highly resistant to disruption, even in the face of direct physical attacks.
1 Comment
Leave a Reply
Related Articles
FBI Warns of Iran-Linked Handala Hackers Spying on Windows Users via Fake Apps
The FBI has issued a warning about Iran-linked Handala Hack Group, which...
Police Shut Down 373,000 Dark Web Sites in Single-Operator CSAM Network
A massive international law enforcement operation has shut down more than 373,000...
Google Launches Advanced Flow to Make Android APK Sideloading Safer
Google has introduced a new Android feature called Advanced Flow, designed to...
Navia Breach Exposes Sensitive Data of 2.7 Million in Weeks-Long Undetected Cyberattack
Navia Benefit Solutions, Inc., a U.S.-based benefits administrator, has disclosed a data...
This is a compelling analysis highlighting how modern cyber warfare is increasingly premeditated and infrastructure-driven. The six-month buildup underscores that cyber operations are no longer reactive but strategically aligned with geopolitical events. It also reinforces a critical point: kinetic actions alone are insufficient to disrupt distributed cyber capabilities. Organizations need to prioritize proactive threat intelligence and infrastructure mapping to defend against such well-prepared adversaries.