Tehran’s cyber shadow over Five Eyes: real risk or amplified noise?

A wave of cyber operations accompanied the joint U.S–Israeli strikes on Iran early Saturday, according to cybersecurity experts and observers. Several news websites were defaced, and BadeSaba, a religious calendar app with more than 5 million downloads, was hacked to display messages such as “It’s time for reckoning” and calls for armed forces to lay down their weapons and join the people.

U.S. Cyber Command also conducted offensive online operations against Iranian communications networks as part of the same campaign, with senior commanders describing space and cyber as “first movers” that helped blind and disrupt Iranian sensors and communications before and during the strikes.

In the immediate aftermath, as the kinetic conflict escalates, cyberspace has become a parallel theatre where narratives and networks are contested in real time. Tehran‑linked hackers are ramping up reconnaissance and claim‑driven cyber activity in response, although early evidence suggests the operational impact across the Five Eyes remains limited and often overstated.

For Cyber News Centre Daily Updates readers, this is less a moment for panic than a live stress test of how well Australia, its allies and their critical industries can weather a noisy, psychologically charged cyber campaign.

What’s changed for Five Eyes

Cyber intelligence firms tracking Iran and its proxies report stepped-up scanning, phishing and pre-positioning across U.S., UK, Australian, Canadian and New Zealand targets, with a clear focus on governments, critical infrastructure and multinationals with Middle East exposure. CrowdStrike and others have not yet seen large-scale, state-backed campaigns hitting Five Eyes networks, but they do see a surge in Iran-aligned and sympathetic hacktivist claims of DDoS, defacements and alleged OT interference from the Middle East to North America and Asia. Flashpoint notes pro-Iranian groups boasting about access to a Jordanian grain silo operator’s control systems, yet those claims remain unverified—typical of Tehran’s blend of real operations and psychological theatre.

Analysts at Google’s Threat Intelligence Group and others expect follow-on disruptive activity against “targets of opportunity” in critical infrastructure and global supply chains rather than precision strikes against only U.S. federal assets.

“Iranian cyber espionage has resumed after a brief lull during the initial military strikes, and hacktivist fronts with ties to the IRGC (Islamic Revolutionary Guard Corps) are making claims and threats about disruptive attacks in the region,” John Hultquist, chief analyst, Google Threat Intelligence Group, said on Sunday. (Yahoo News)

Those strategic warnings are beginning to surface in operational telemetry. Security researchers are observing early waves of DDoS and related activity aimed at critical infrastructure entities in multiple jurisdictions. A group styling itself the Cyber Islamic Resistance Axis has claimed responsibility for targeting 130 remote‑control systems at Israeli industrial‑control firm Control Applications Ltd., according to Flashpoint.

Yet the risk picture for senior decision‑makers is still defined as much by uncertainty as by impact. Recorded Future reports no confirmed Iranian‑attributed intrusions into U.S. government networks or private‑sector critical infrastructure to date, and notes that Iranian operators may be constrained by domestic internet blackouts and their reliance on proxy actors.

The combination of elevated intent, limited verified damage and incomplete visibility is creating a cyber “fog of war” that Tehran and its affiliates exploit by amplifying dramatic but often uncorroborated claims across social and fringe channels, a dynamic business leaders need to factor into both risk assessments and external communications.

Why it matters for Australia and allies

For Five Eyes—especially Australia—this emerging campaign lands at an awkward time. U.S. cyber capacity is under pressure, with CISA operating at roughly 38% staffing because of a DHS funding standoff, weakening a key hub for cross-border threat sharing and joint advisories that Australian operators rely on. Meanwhile, existing Five Eyes warnings already flag Iranian actors as persistent threats to water, energy, health, government and financial services, targeting exposed VPNs, weak identity controls and poorly segmented OT networks.

For Australian banks, exchanges, energy providers and logistics operators, the immediate risk is twofold: nuisance-level DDoS and hacktivism that erodes customer confidence, and quieter access operations laying groundwork for more serious disruption if the regional conflict worsens.

The strategic question, as one former CIA official framed it, is no longer whether an Iranian-linked event can “happen here” but how long your business could function if an overseas office or regional partner lost water, power or communications for weeks—and whether that scenario has been rehearsed.

The conflict may be thousands of miles away, but cyberspace collapses distance. The same minute a missile is launched in the Middle East, a phishing lure, DDoS packet stream or wiper payload can be triggered against a target in Sydney, Auckland or Vancouver.

That is the essence of hybrid warfare in 2026: kinetic escalation and online operations reinforcing each other, with critical infrastructure, cloud workloads and human trust as the pressure points. For Australian boards, CISOs and risk leaders, the practical question is whether you treat this as a distant regional crisis, or as a live-fire exercise in resilience—testing identity security, OT segmentation, contingency communications and your ability to operate through weeks of disruption.

Ultimately, these global conflict events are creating an extremely fluid scenario in cyberspace. CNC will endeavour to keep the analysis updated and break down the developments as they unfold.

Editor’s Note: This article has been updated to include remarks from Recorded Future & Next Gov/FCW and Yahoo News.

Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.