Pro-Russia and Iran-linked Hackers Unite in Cyber Attacks

Pro-Russia threat actors have formed a coalition with Iran-linked hacking groups in response to the recent bombing campaign initiated by the United States and Israel against Iran. This new alliance launched operations on March 5, 2026, under the banner of the #OpIsrael campaign, targeting critical infrastructure and data exfiltration efforts, according to researchers at Flashpoint.

The coalition includes a group known as Cyber Islamic Resistance, which collaborated with NoName057(16) to execute a large-scale distributed denial-of-service attack against an Israeli defense contractor and multiple municipal governments. Flashpoint also reported that Cyber Islamic Resistance claimed responsibility for breaching an Israeli health insurance provider, providing leaked CCTV footage as evidence of their actions.

Another group, called FAD Team, has taken credit for an SQL injection attack that compromised data from various organizations. This includes a small town in Pennsylvania and educational institutions in France, Vietnam, and India, as well as a virtual U.S. Air Force group. These actions highlight a coordinated effort to disrupt systems across different sectors.

In a troubling trend, Flashpoint researchers noted that initial access brokers are offering compromised access to Iranian-linked groups on Russian cybercrime forums, including XSS and Exploit. Kathryn Raines, cyber threat intelligence team lead for the National Security Solutions team at Flashpoint, stated that such offers could enable Iranian proxies to circumvent their current internet domestic blackout and regain operational capabilities.

Research from Palo Alto Networks’ Unit 42 suggests that approximately 60 threat actors, comprising both Iran-linked and Russia-aligned groups, have been involved in various hacking activities since the onset of the bombing campaign. Notably, the Handala Hack group, associated with Iran’s Ministry of Intelligence and Security, has claimed responsibility for compromising an Israeli energy company and gas stations in Jordan.

Despite these activities, experts caution that the capacity for state-linked actors to coordinate attacks has been hampered by a significant loss of internet connectivity in Iran, which is currently operating at less than 4% of its full capacity. Consequently, many attacks attributed to state actors have been opportunistic and deviate from established patterns.

“The technical impact remains relatively limited for now, but the trend is clearly escalating,” said Gil Messing, chief of staff at Check Point Software Technologies. He noted that attack volumes have risen above normal baselines, with efforts underway to recruit hackers globally to support these operations.

U.S. officials are closely monitoring the situation for potential threats, both physical and cyber. Security leaders in critical U.S. sectors are particularly vigilant. “Health-ISAC is very focused on the current U.S.-Iran tensions and the potential cyber fallout for healthcare and public health,” said Errol Weiss, chief security officer at Health-ISAC. “We are closely monitoring the situation, but at this time we have not received any specific or credible, sector-wide cyber threat warnings tied directly to this latest incident.”

Analysts at the Foundation for Defense of Democracies, a Washington-based think tank, stated that while Iran-backed hackers are struggling to formulate a meaningful response to the bombing campaign, critical infrastructure in the U.S. remains vulnerable. They pointed out that many essential sectors are operated by small companies with limited cybersecurity resources, which could allow Iranian hackers to achieve visible successes, similar to the attacks observed in the fall of 2023 on small U.S. water systems.

As the situation evolves, the potential for increased cyber activity linked to geopolitical tensions remains a concern, underscoring the need for heightened vigilance across various sectors.