FOLLOW US

The Tactics: How Iran Strikes

Security researchers and allied intelligence agencies have documented a consistent and evolving Iranian cyber playbook. Understanding these methods is essential for grasping the scope of the threat to American institutions.

OFFENSIVE WEAPONS

• Distributed Denial-of-Service (DDoS) attacks — overwhelming financial and government sites
• Destructive wiper malware — permanently destroys data across entire enterprise networks
• Ransomware — deployed through criminal proxies (Fox Kitten) for extortion
• Spear phishing and credential harvesting — AI-enhanced targeting of executives
• Industrial Control System (ICS) intrusions — water, power, and gas systems
• Hack-and-leak operations — stolen data published to humiliate targets
• Supply chain compromise — targeting widely used software components

PRIORITY TARGETS

• Banking and financial services institutions
• Energy grids, oil and gas infrastructure
• Water treatment and utility systems
• Hospital networks and medical device manufacturers
• Defense contractors and aerospace firms
• Telecommunications providers
• Municipal and local government networks
• Banking and financial services institutions
• Energy grids, oil and gas infrastructure
• Water treatment and utility systems
• Hospital networks and medical device manufacturers
• Defense contractors and aerospace firms
• Telecommunications providers
• Municipal and local government networks

The Pre-Positioning Threat: Already Inside

Perhaps the most alarming intelligence to emerge in recent weeks is the confirmation that Iranian threat groups were not simply waiting for conflict to begin — they were already inside American networks before the first bombs fell. Security researchers at Symantec and Carbon Black found evidence that Iranian hackers installed backdoors on the networks of several U.S. companies in late February 2026, just days before Operation Epic Fury began. The state-backed actor tracked as MuddyWater had been prepositioned on multiple U.S. networks in the weeks leading up to the bombing campaign.

The Stryker Attack: America’s Wake-Up Call

On March 11, 2026, the theoretical became terrifyingly real. The Iranian Ministry of Intelligence and Security, operating through its Handala Hack persona (also tracked as Void Manticore), launched what U.S. officials and former officials described as likely the most significant wartime cyberattack against the United States in history.

The target was Stryker Corporation — a Fortune 500 medical device manufacturer listed on the New York Stock Exchange with annual revenue of $25 billion, 56,000 employees across 75 countries, and products relied upon by 150 million patients annually. A devastating wiper attack wiped more than 200,000 devices worldwide and deleted 50 terabytes of corporate data. Stryker was forced to order its entire global workforce to disconnect from all networks. Some hospitals were temporarily forced to pause the transmission of patients’ vital-sign data. Stryker confirmed the attack in an 8-K filing with the U.S. Securities and Exchange Commission the same day.

The Soufan Center, a leading national security research organization, described the attack’s strategic intent with stark clarity: "The objective appears to be bringing the war home to American civilians in a palpable way."