Iran leans on hacktivist proxies in wake of Israeli, U.S. strikes

Axios

01-07-2025

Iranian state-backed hackers are borrowing from the Russian cyber playbook and sharing tools with ideologically aligned hacktivist groups in the wake of a series of military strikes, experts tell Axios.
Why it matters: Leaning on these hackers allows Iran to amplify its reach while maintaining plausible deniability and staying below the threshold of what's considered war.
Driving the news: Iran-linked hackers threatened last night to publish emails purportedly stolen from Trump allies, including White House chief of staff Susie Wiles, lawyer Lindsey Halligan and adviser Roger Stone.
CISA and the FBI released an advisory yesterday warning U.S. critical infrastructure, and particularly defense contractors, are at increased risk for potential Iran-linked cyberattacks.
The intrigue: Experts at cybersecurity firm Armis say they've observed Iranian nation-state actors providing tools and resources to pro-Iran hacktivist groups since Israel launched military strikes on June 13.
Michael Freeman, head of threat intelligence at Armis, told Axios that pro-Iran hacktivists have received "a lot of help," including access to nondescript cyber weapons and hacking techniques that could help them target Western organizations.
"Those [weapons and techniques] were being used to target more critical infrastructures within nation-states," Freeman told Axios.
These attackers appear focused on strategic cyber campaigns, including ransomware, linked to the broader regional conflict.
"They're definitely using these tools, gaining more access, being more careful — without getting caught," Freeman added.
The big picture: Iran increasingly mirrors Russia's model of relying on cyber proxies and psychological operations to project power.
"This is very Russian in nature," Alexander Leslie, a threat intelligence analyst at Recorded Future, told Axios. "Using proxies for plausible deniability is essentially the essence of how they can scale these operations and remain resilient to any kind of disruption."
Leslie added that Iran frequently leans on "pseudo-hacktivist groups" to stay just below the threshold of conventional cyber warfare.
Zoom in: A hacker tied to a well-known Russian nation-state hacking team has been sharing tools and advice in a pro-Iran hacktivist group, Freeman said.
Between the lines: Some of the most serious attacks have likely been stopped before they became public, thanks to early detection and Five Eyes intelligence-sharing, Nadir Izrael, chief technology officer at Armis, told Axios.
"The silence isn't an indication of nothing happening," Izrael said. "It's an indication of defenses holding — and a lot of people doing a lot of work to make that happen."
State of play: Activity from pro-Iran hacktivist groups has dipped since a ceasefire was announced last week, but many of the most opportunistic actors had already pivoted to targeting last week's NATO summit.
More than 100 hacktivists groups, 90 of which are linked to pro-Iranian positions, have been targeting organizations in Israel and throughout the Middle East, North Africa, Western Europe and North America since Israel's strikes last month, Leslie said.
Many of those groups resurfaced during this conflict after a long hiatus, Leslie added.
Despite broad claims of successful attacks, most of the groups' reported DDoS campaigns are unverified. "The point is to overwhelm and shape perception," Leslie said.
Threat level: Freeman warned U.S. critical infrastructure operators to take inventory of their systems and patch overlooked vulnerabilities — especially in "systems that operate systems."
"The companies who've had to deal with the Iranian groups, that really had a good understanding of their environment, were able to detect them quickly, within a few hours," he said.
What to watch: Law enforcement and private sector partners are actively working to identify and harden vulnerable industrial systems that Iranian threat actors may be targeting.