In the first two weeks of the U.S. and Israeli bombing campaign against Iran, security researchers with Akamai saw a 245% spike in threat actors targeting critical businesses and institutions in North America, Europe, and parts of Asia-Pacific, another data point in the cyberthreats spreading from pro-Iranian actors.

In a report, the researchers noted that geopolitically motivated hacktivist groups are using proxy services in Russia, China, and elsewhere to launch “billions of designed-for-abuse connection attempts,” banking and financial services organizations, ecommerce businesses, and video games accounting for 80% of the target destinations of the attempts.

The financial services and ecommerce businesses combined made up more than half of the targets.

“The conflict in the Middle East that started on February 28, 2026, has sent rippling effects across travel, hospitality, and energy sectors of the global economy,” they wrote. “Even more concerning is the significant increase in cybercrime emanating from nation-state actors and ideologically motivated hacktivists, who might operate from an entirely different part of the planet to orchestrate highly sophisticated attacks.”

Akamai’s findings adding to the growing list of findings from threat intelligence analysts that indicate the cybersecurity threats that cranked up soon after the first bombs on Tehran were dropped continues to expand against not only U.S. and Israeli targets both also other countries in the Middle East and elsewhere seen as being friendly to the larger global powers.

Businesses on Alert

With no end of the war in sight, governments and businesses in these areas need to be prepared for the threat to rise, according to Sunil Gottumukkala, CEO of agentic AI security company Averlon.

“Enterprises should assume this activity will persist and focus on preparedness,” Gottumukkala said. “That means staying on top of attack surface and exposure management to reduce exploitable vulnerabilities and ensure known weaknesses cannot be used to gain initial access. It also means strengthening identity security and monitoring for credential misuse, since many of these campaigns rely on stolen credentials.”

Private Sector Under Threat

In an emailed update, Flashpoint researchers wrote about hacktivists increasingly targeting private sector organizations, pointing to not only Handala’s data-wiper attack on U.S.-based medical tech company Stryker but also another group, Fatimion Cyber Team, targeting the Lebanese MTV channel with distributed denial-of-service (DDoS) attacks and a data breach, threating to leak personal data of both MTV employees and officials with the Lebanese Ministry of Information if they don’t stop “anti-resistance” reporting.

“The cyber activity tied to this conflict is becoming increasingly decentralized and destructive. Groups like Handala and Fatimion are targeting private-sector organizations with attacks designed to erase data, disrupt services, and introduce uncertainty for both businesses and the public,” said Kathryn Raines, cyber threat intelligence team lead for the national security solutions for Flashpoint. “At the same time, we’re seeing a greater use of legitimate administrative tools in these cyber operations, making it significantly harder for traditional security controls to detect.”

That last point was made in a report in BleepingComputer, which cited an unnamed source that Handala – a hacktivist group with reported ties to the Iranian government that claimed to have erased data 200,000 hundreds of thousands of corporate devices and steal 50 TB of data – by using the wipe command on in Microsoft’s Intune cloud-based endpoint management solution to erase data from 80,000 devices during a three-hour window March 11. The attackers didn’t need to use malware; instead they compromised an admin account and created a new global admin account.

Cyber Warfare as the Great Equalizer

Analysts with Palo Alto Networks’ Unit 42 threat intelligence group, which last week wrote about the rising threat of wiper malware, detailed in a report this week how Iran’s Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS) use cyber operations as a low-cost way of equalizing the battle with its better-armed enemies and noted that the “shift from custom-built wiper malware to native administrative abuse removes a critical detection guardrail that historically protected enterprise networks.”

“Iranian cyber actors’ current tactical shift is driven less by a lack of malware development capabilities than by the strategic advantages of living-off-the-land (LotL) techniques,” they wrote. “Operations designed to cause disruption have undergone a change since 2023: Instead of relying heavily on bespoke tools, the methods now employed are part of a larger trend toward greater scale and improved evasion.”

Worries About U.S. Readiness

There also is concern about the United States government’s ability to protect the country against such cyberattacks. Matthew Ferren, an international affairs fellow in national security at the Council on Foreign Relations, a nonpartisan think tank, noted this week about the “strikingly short” – at four pages – national cybersecurity strategy that was released earlier this month.

Ferren wrote that the Trump Administration called it a high-level statement of intent that will be followed by actions, but added that “the brevity also reflects a fraying cyber apparatus that is, at best, still finding its footing and, at worst, suffering from institutional neglect.”

“This strategy arrives at a precarious moment,” he wrote. “The United States faces longstanding and intensifying cyber threats – from Chinese espionage and pre-positioning on critical infrastructure to ransomware campaigns that disrupt essential services – that demand sustained attention and investment. The president’s war of choice with Iran adds new urgency. Tehran-linked groups are already threatening cyberattacks on U.S. networks, and the White House’s ability to coordinate national cyber defenses will face an immediate test.”

Still, “the administration’s surface-level treatment of these challenges casts doubt on how seriously the administration takes the cyber threat, and whether it has the capacity to address them,” Ferren wrote. “Key cyber leadership posts remain vacant, and the agencies responsible for implementation have been disrupted by budget cuts and personnel turnover.”