Iran cyber conflict widens after Epic Fury and Roaring Lion, but many attack claims still lack proof

The cyber side of the Iran conflict is clearly growing, but the picture is messy. After the United States and Israel launched their joint campaign on February 28 under Operation Epic Fury and Operation Roaring Lion, official statements, intelligence reporting, and security warnings all pointed to a higher risk of retaliatory cyber activity. At the same time, many of the loudest hacktivist claims spreading online still lack independent verification.

The core facts are easier to confirm than the battlefield chatter. The White House publicly confirmed Operation Epic Fury, and the IDF said it launched Operation Roaring Lion together with U.S. forces on February 28. Reuters also reported that the opening phase included cyber and space-based disruption before the broader military strikes.

Iran’s loss of connectivity is also well documented. NetBlocks data cited by multiple outlets showed national connectivity falling to about 4% of normal levels on February 28, then closer to 1% during the blackout, with restrictions entering a fourth day on March 3. That matters because the outage does two things at once: it can disrupt command, coordination, and public communication inside Iran, and it also makes outside verification much harder.

What comes next looks less like one clean state-on-state cyber campaign and more like a crowded, fast-moving digital conflict. Reuters reported cyber operations against Iranian apps and websites soon after the strikes. A U.S. intelligence assessment reported by Reuters then warned that Iran and its proxies could step up defacements and DDoS attacks. The UK’s NCSC took a more measured line, saying there is likely no significant change in the direct cyber threat to the UK right now, but there is almost certainly a heightened indirect risk for organizations with offices or supply chains in the Middle East.

That gap between confirmed risk and unverified claims is important. Public monitoring from CloudSEK and reporting that cites CyberKnow both point to a surge in hacktivist activity, including pro-Iran and pro-Russian groups, but much of that activity is self-claimed on Telegram or similar channels. In plain terms, the conflict is real, the cyber risk is rising, but some of the dramatic breach claims still sit in the “possible, not proven” bucket.

What is confirmed, and what still needs proof

Why the blackout changes the cyber fight

Iran going mostly offline does not end the cyber threat. It changes it. The blackout can slow central coordination and reduce visibility into what domestic Iranian operators are doing in real time, but it can also push activity toward proxies, foreign infrastructure, and loosely aligned hacktivist groups outside Iran. Reuters, NCSC, and CISA all point to the same broader lesson: organizations should prepare for retaliation that may be disruptive, opportunistic, and harder to attribute than a classic military cyber operation.

That is why the current risk picture looks broader than Iran alone. The NCSC warned UK organizations with regional exposure to review monitoring and external attack surface. CISA’s Iran threat overview says Iranian actors routinely target poorly secured U.S. networks and internet-connected devices, especially exposed edge systems and operational technology. Older joint U.S. advisories also show familiar tradecraft such as brute force, password spraying, weak credentials, and attacks on critical infrastructure.

What security teams should do now

Practical takeaways for defenders

• Expect noisy activity first, especially DDoS, defacement, phishing, and hack-and-leak style claims.
• Do not assume the blackout inside Iran means the threat has faded. It may simply become less visible and more distributed.
• Focus on basics that still matter most: patch exposed systems, harden authentication, segment critical systems, and rehearse incident response.
• Separate verified incidents from propaganda. In fast-moving conflicts, attackers and sympathizers often exaggerate success for psychological effect.

FAQ