Full Report
Insikt Group tracks the cyber, physical, and geopolitical components of the US-Israeli strikes on Iran — with continuously updated threat analysis and scenarios.
Analysis Summary
# Incident Report: Operation Epic Fury & Iranian Cyber Retaliation
## Executive Summary
A massive geopolitical and kinetic escalation occurred following coordinated US-Israeli airstrikes ("Operation Epic Fury" / "Operation Lion's Roar") against Iran, resulting in the death of Supreme Leader Ali Khamenei. In response, Iranian state-sponsored actors and hacktivist collectives have initiated retaliatory cyber operations and kinetic strikes targeting critical infrastructure, maritime shipping, and government entities across the US, Israel, and the Gulf states.
## Incident Details
- **Discovery Date:** February 28, 2026
- **Incident Date:** February 28, 2026 – Ongoing
- **Affected Organization:** Multiple (Government, Energy, Maritime, Critical Infrastructure)
- **Sector:** Defense, Energy, Maritime, Critical Infrastructure
- **Geography:** Iran, Israel, USA, and Gulf States (Bahrain, Qatar, UAE, Saudi Arabia, etc.)
## Timeline of Events
### Initial Access
- **Date/Time:** February 28, 2026
- **Vector:** Mixed (Kinetic strikes followed by coordinated cyber-activism)
- **Details:** Simultaneous air strikes against Iranian military leadership and infrastructure triggered immediate retaliatory cyber mobilization by pro-Iran groups.
### Lateral Movement
- **Details:** Iranian-aligned groups (e.g., Handala Hack Team) are known for targeting supply chain vendors to move laterally into high-value strategic targets and critical infrastructure networks.
### Data Exfiltration/Impact
- **Details:** Iranian internet connectivity dropped to 4% (blackout). Pro-Iran groups are claiming operations against regional targets; historical patterns suggest future risks of wiper malware and data theft for influence operations.
### Detection & Response
- **How it was discovered:** Real-time monitoring of kinetic military actions and sudden spikes in pro-Iran hacktivist communications.
- **Response actions taken:** Regional Geopolitical Intelligence access enabled for at-risk organizations; increased monitoring of maritime and energy sectors; deployment of pre-built threat hunting queries.
## Attack Methodology
- **Initial Access:** Exploitation of supply chain vulnerabilities and opportunistic targeting.
- **Persistence:** Utilization of established state-sponsored infrastructure.
- **Defense Evasion:** Use of hacktivist "fronts" to mask state-sponsored strategic goals.
- **Lateral Movement:** Compromising third-party vendors to reach core critical infrastructure.
- **Impact:** Wiper malware (historically "Apostle" or "Shamoon" variants), volumetric DDoS, and sophisticated influence campaigns (e.g., Emerald Divide).
## Impact Assessment
- **Financial:** High potential impact on global energy markets and maritime insurance rates due to the closure of the Strait of Hormuz.
- **Data Breach:** High risk to government and defense sectors via retaliatory exfiltration.
- **Operational:** Severe disruption to regional US military operations; total internet blackout in Iran; suspension of regional maritime transits.
- **Reputational:** High-profile hacktivist claims intended to project Iranian capability despite leadership losses.
## Indicators of Compromise
- **Behavioral indicators:**
- Spikes in traffic from known pro-Iran hacktivist infrastructure (Handala Hack Team, RipperSec, etc.).
- Emergence of "Operation Truthful Promise 4" related messaging in network scans.
- Targeting of industrial control systems (ICS) in energy and maritime sectors.
## Response Actions
- **Containment measures:** Implementation of Geopolitical Intelligence alerts for real-time situational awareness.
- **Eradication steps:** Threat hunting for established Iranian APT persistence (e.g., APT42 or MuddyWater) in Western and Israeli networks.
- **Recovery actions:** Monitoring of satellite imagery for damage assessment and continuity of regional operations.
## Lessons Learned
- **Key takeaways:** Kinetic operations against state leadership provide an immediate catalyst for asymmetrical cyber retaliation.
- **What could have been done better:** Pre-emptive hardening of maritime and regional critical infrastructure before the initiation of kinetic strikes.
## Recommendations
- **Prevention measures:**
- Increase monitoring of all remote access portals and supply chain connections.
- Defend against volumetric DDoS attacks targeting public-facing government infrastructure.
- Deploy specific hunting queries for Handala Hack Team and other identified Iranian state-aligned groups.
- Review business continuity plans for maritime shipping and energy supply chain disruptions in the Persian Gulf.