Iran’s digital proxies and hacktivists played a significant role in swaying opinions during the 12-day Iran-Israel conflict that erupted on June 13, according to a comprehensive analysis by SecurityScorecard’s STRIKE threat intelligence team.
The report focused on how the Islamic Revolutionary Guard Corps-linked operations used the Telegram messaging platform for recruitment, intimidation tactics in targeting adversaries and planned malware operations against Israeli allies.
State-Sanctioned Attacks
According to SecurityScorecard, the operation appeared scattered or disparate to an outsider, but on closer inspection, it was fast, targeted and ideologically charged. The security data and intelligence provider identified three layers of actors that drove the operations: IRGC-backed hacktivists, IRGC-aligned clusters, and state-sponsored actors.
One group called Imperial Kitten, also known as Tortoiseshell, Cuboid Sandstorm and Yellow Liderc, played a key role in the 12-day campaign, providing conflict-themed phishing lures and building a campaign infrastructure almost immediately after the start of the kinetic operations. The state-sponsored actor was joined by several others, including Al-Qassam Toast or Shark Attack Blood Bath, Mundo Multipolar and the Islamic Hacker Army group.
Coordinated Hacking
In the 20-page report’s foreword, SecurityScorecard emphasized the importance of better understanding adversaries’ strategies in the cyber domain.
“Coordinated hacking campaigns include Telegram channels as a shared hub, social engineering hooks tied to kinetic conflict themes and phishing domains spun up within hours of geopolitical shifts, suggesting deep integration between kinetic warfare and state-linked, or state-inspired, cyber operations,” the company said.
The report’s authors concluded that cyberattacks tied to kinetic conflict are persistent, coordinated and evolving threats, and defending against them requires real-time intelligence, not outdated tactics.
SecurityScorecard STRIKE, headquartered in New York, offers enterprise security services using proactive risk management and a rapid response approach.
Join us as the Potomac Officers Club hosts the 2025 GovCon International Summit, providing industry leaders a chance to share their insights on the future of government contracting. Reserve your slot today.