Palo Alto Unit 42 published a live threat brief confirming sixty hacktivist groups are now active in coordinated cyber operations, with allied foreign collectives joining the fight. An Electronic Operations Room was established within hours of the strikes to synchronize targeting across the coalition. Check Point Research confirmed that Handala Hack is routing attacks through Starlink IP ranges from inside the nationwide internet blackout, creating a detection blind spot for defenders relying on geographic IP filtering. A national CERT intercepted an OT attack on SCADA systems managing civilian food reserves — representing an escalation from traditional energy targeting to food infrastructure. Actionable guidance covers Starlink ASN blocking, OT exposure hunting, and DDoS preparation for allied foreign convergence.

Links & Resources

• https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/
• https://blog.checkpoint.com/research/what-defenders-need-to-know-about-irans-cyber-capabilities/
• https://www.infosecurity-magazine.com/news/iran-cyber-attacks-global-google/
• https://www.nextgov.com/cybersecurity/2026/03/intelligence-firms-watch-uptick-iran-cyber-activity-after-us-israel-strikes/411802/
• https://www.sentinelone.com/blog/sentinelone-intelligence-brief-iranian-cyber-activity-outlook/
• https://industrialcyber.co/industrial-cyber-attacks/us-israeli-campaign-triggers-iranian-counteroffensive-targeting-gulf-energy-critical-infrastructure/
• https://cybernews.com/editorial/iran-us-conflict-blackout-cyberattacks-misinformation/
• https://www.digit.in/features/general/elon-musks-starlink-shaping-2026-iran-us-israel-cyber-war-heres-how.html