Iran Has Escalated Cyber Operations Against Israel Since October 7

A sustained digital campaign running alongside proxy military pressure indicates that Iran is treating cyberspace as a durable, lower-escalation instrument of conflict alongside its support for...

Since the Hamas attack on Israel on October 7, 2023, Iran has sharply escalated its cyber operations targeting Israeli government, military, and civilian infrastructure, according to the Foundation for Defense of Democracies, as reported by Sophia Politis in the Jerusalem Post on October 13, 2026 (Iran's Two-Front War on Israel).

The operations represent what analysts at the Foundation for Defense of Democracies describe as a two-front posture: Iran is simultaneously supporting armed proxy groups in the region while conducting digital intrusion and disruption campaigns against Israeli targets, according to the same Jerusalem Post report.

Iran's cyber capabilities have been documented by multiple Western intelligence agencies over the past decade. The United States Cybersecurity and Infrastructure Security Agency (CISA) has previously attributed a range of intrusion campaigns to Iranian state-linked actors, including groups associated with the Islamic Revolutionary Guard Corps (IRGC).

The October 7, 2023 Hamas attack, which Israeli government records show killed approximately 1,200 people and resulted in the abduction of around 250 hostages, triggered a prolonged Israeli military campaign in Gaza. That campaign has run in parallel with a widening regional conflict involving Iranian-backed Hezbollah in Lebanon, Houthi forces in Yemen, and various armed factions in Iraq and Syria.

Cyber operations in this context are distinct from direct military engagement. They typically include phishing campaigns, distributed denial-of-service attacks, data exfiltration from government and defense networks, and influence operations targeting public information environments. Which specific categories Iran has prioritized in its post-October 7 campaign has not been fully detailed in publicly available reporting as of this date.

Iran has formally denied directing or controlling the October 7 attack, though it publicly praised it. Israeli and American officials have stated publicly that Iran provides financing, weapons, and training to Hamas and other regional armed groups, positions Iran contests.

The dual-track approach, kinetic proxy pressure combined with cyber operations, gives Iran a degree of flexibility that direct military action does not. Cyber attacks carry lower escalation risk and are harder to attribute with the speed required for a proportional military response, a dynamic that Western defense analysts have noted across multiple conflict settings, not only the Middle East.

Public opinion data cited in a separate October 13, 2026 analysis published by RealClearWorld offers context on the broader conflict's trajectory. According to that analysis, 70 percent of Palestinians polled in the month following the October 7 attack expected Hamas to win the conflict. One year later that figure had fallen to 39 percent, and by August of an unspecified subsequent year it had fallen further, though the precise endpoint of that data series was not specified in the available source material (The End of Armed Resistance?).

Shifts in Palestinian public opinion do not directly affect Iranian state policy, but they are relevant context for assessing whether Iran's proxy and cyber strategy is producing its intended political effects within the Palestinian population it claims to support.

Israel has developed one of the most active national cybersecurity programs among Western-aligned states. Its National Cyber Directorate coordinates defensive responses across government and critical infrastructure. The directorate has publicly acknowledged repeated attempts by Iranian-linked actors to penetrate Israeli systems since the start of the current conflict, though it has not publicly quantified the number or success rate of those intrusions.

What remains unknown is the full scope of damage, if any, that Iranian cyber operations have caused to Israeli systems since October 2023. Declassified intelligence assessments or future official statements by either the Israeli National Cyber Directorate or CISA would be the most direct sources to resolve that question. The current public record establishes the existence and intensification of the campaign but does not establish its operational results.