On February 28th, 2026, the United States and Israel launched coordinated large-scale airstrikes against Iran under Operation Epic Fury, also referred to as Operation Roaring Lion. The operation reportedly resulted in the death of Supreme Leader Ayatollah Ali Khamenei and several senior Iranian officials. Iran and affiliated militias responded with missile and drone strikes targeting Israel and Gulf states hosting US military facilities, including Bahrain, Jordan, Kuwait, Qatar, Saudi Arabia, and the United Arab Emirates. The conflict subsequently expanded into Lebanon after Hezbollah initiated cross-border fire against Israel, marking its first direct engagement with Israel in over a year.

A wave of cyber-enabled operations also accompanied the kinetic attacks, including the hacking of multiple news websites and the BadeSaba religious calendar app to push surrender messages. Iran’s internet connectivity dropped intermittently through the morning on the day of the attack, with only minimal connectivity remaining. The attacks against communication infrastructure were reportedly to prevent coordinated counterattacks and the ability to launch drones and ballistic missiles by Iranian cyber and electronic units.

This escalation represents the most consequential direct confrontation between the US, Israel, and Iran to date. It follows months of failed nuclear diplomacy, renewed Iranian missile development, heightened US force deployments in the Gulf, and severe domestic unrest within Iran. The convergence of these factors has materially increased the risk of sustained regional conflict and broader global economic disruption.

Background of the US-Israel strikes on Iran

Nuclear diplomacy breakdown

The immediate trigger for the February 2026 strikes can be traced back to the collapse of renewed US-Iran nuclear negotiations. The strategic objectives of the operation closely resemble those pursued during the June 2025 12-Day War, when Israel targeted more than 100 sites across Iran after five rounds of nuclear talks failed to produce an agreement. That earlier campaign killed senior Iranian military leaders, including the commander-in-chief of the Islamic Revolutionary Guard Corps and the chief of staff of Iran’s armed forces, and damaged key nuclear infrastructure.

Iranian military reconstitution

In the months that followed, Iran moved to rebuild its missile capabilities and harden sensitive facilities. By September 2025, Iranian officials publicly announced efforts to restore missile capacity. Commercial satellite imagery in early 2026 indicated reinforced tunnel systems at Isfahan, hardened access points near Natanz, and additional protective construction at the Parchin complex. At the same time, diplomatic engagement stalled. Iran suspended cooperation with the International Atomic Energy Agency in July 2025, and European governments conditioned sanctions relief on the resumption of direct negotiations, full inspector access, and transparent reporting of enriched uranium stockpiles. Although talks continued intermittently into February 2026, they failed to deliver substantive progress.

Pre-strike indicators amidst nuclear talks

Rising military signaling further heightened tensions in mid-February 2026. The US repositioned air and naval assets in the region, while Iran conducted live-fire exercises and temporarily restricted parts of the Strait of Hormuz. These actions significantly narrowed diplomatic space and increased the likelihood of miscalculation.

Domestic protests in Iran

Domestic instability within Iran formed an important backdrop to the crisis. Beginning in late December 2025, widespread protests erupted in response to economic deterioration, currency collapse, and inflation exceeding 40%. The unrest expanded beyond Tehran into universities and provincial cities and became the deadliest protest movement in Iran since 2022, with reported fatalities ranging from 3,000 to 7,000. Authorities imposed internet restrictions and relied on security forces, including the Basij militia, to suppress demonstrations. Iranian officials accused the US and Israel of fomenting unrest, while US leadership publicly warned Iran against violently repressing protesters and imposed additional economic measures, including a 25% tariff on countries conducting business with Iran. Reports in late January 2026 indicated that Washington was considering targeted strikes against Iranian security infrastructure, potentially aimed at amplifying domestic pressure on the regime.

Accompanying cyber activity of the US-Israeli strike

Cyber operations played a decisive enabling role in the success of the US-Israeli strike that killed Ayatollah Khamenei and other senior officials. According to reporting, the operation was supported by years-long cyber penetration of Tehran’s traffic camera networks, which provided granular intelligence on the movement patterns and daily routines of senior officials and their security details. This persistent surveillance allowed planners to build a comprehensive behavioral and logistical intelligence picture. In parallel, Israel reportedly interfered with mobile phone tower infrastructure during the operation to disrupt real-time communications and prevent security teams from receiving warning alerts. The combination of long-term cyber-enabled surveillance and tactical disruption of communications infrastructure materially increased the precision and effectiveness of the targeted strike.

In the weeks preceding the February operation, disruptive cyber activity against Iranian targets intensified. Distributed denial-of-service (DDoS) attacks began to spike in early January, coinciding with the expansion of domestic protests and Tehran’s designation of certain facilities as key strategic assets. Activity levels receded in late January, aligning with Iranian signals indicating a willingness to pursue negotiations. However, by late February, as the US increased its military deployments in the region, disruptive cyber operations once again escalated. The pattern suggests that cyber operations were closely synchronized with both diplomatic signaling and kinetic force posture developments.

Since the February strikes, direct Iranian nation-state cyber activity appears to have declined, at least temporarily. However, multiple pro-Iranian threat actors have issued calls to action, and a wide range of hacktivist collectives are actively conducting disruptive campaigns. Several state-aligned personas and groups have claimed responsibility for operations targeting Israeli and Gulf interests. These include Handala Hack, APT Iran, Cyber Islamic Resistance, Dark Storm Team, FAD Team, Evil Markhors, Sylhet Gang, 313 Team, and DieNet. Their operations have primarily focused on critical infrastructure, government services, and financial institutions in Israel, as well as in Jordan, Saudi Arabia, Kuwait, Bahrain, and the United Arab Emirates.

The cyber domain has also drawn in actors beyond the immediate regional axis. Pro-Russian hacktivist groups, including NoName057(67) and Russian Legion, have claimed disruptive attacks against Israeli municipal authorities, political entities, telecommunications providers, and defense-related organizations. Among the targets cited are systems linked to Israel’s Iron Dome missile defense architecture. While many of these claims remain difficult to independently verify, their participation reflects the broader internationalization of the cyber component of the conflict.

Taken together, these developments underscore that the confrontation is unfolding across both kinetic and digital domains. Cyber operations are serving as both a force multiplier for precision targeting and a tool for signaling, retaliation, and alliance alignment. The continued activation of proxy and ideologically aligned cyber actors increases the risk of spillover effects on regional critical infrastructure and commercial entities, even in jurisdictions not directly involved in military operations.

Closing thoughts: The US-Israel strikes on Iran

The February 2026 operation marks a structural shift in the conflict dynamic. The reported killing of Iran’s Supreme Leader introduces significant uncertainty into the country’s leadership succession process and increases the probability of retaliatory escalation. The Islamic Revolutionary Guard Corps, now led by General Ahmad Vahidi, currently oversees military operations, with Iranian Foreign Minister Abbas Araghchi stating that the country’s military units are acting independently, based on instructions given to them in advance of the strikes.

The conflict has already expanded into multiple theaters. Iran has demonstrated its willingness to strike Israel directly and to target US-linked assets across the Gulf. Hezbollah’s engagement from Lebanon signals the activation of a broader regional axis, while additional involvement from Iraqi militias or Yemen’s Houthi movement remains plausible. While most of the observed cyber operations are currently being carried out by hacktivist groups, Iranian nation-state activity may increase in future, focusing on supply chains, critical infrastructure, vendors, or providers.

The implications for energy security are significant. Even temporary disruption to shipping in the Strait of Hormuz would threaten a substantial share of global oil flows, with immediate consequences for energy prices and inflation. Insurance costs and maritime risk premiums are likely to rise even without a full blockade. Gulf states hosting US bases face elevated security exposure and may encounter growing domestic political pressure if retaliatory strikes continue.

Looking forward, the strategic trajectory remains highly uncertain. There is a credible risk that Iran could accelerate nuclear activities if leadership concludes that diplomatic pathways are no longer viable. Conversely, sustained military pressure may degrade Iranian capabilities in the near term while increasing long-term instability. The possibility of great power involvement also warrants close attention, as Russia and China may expand diplomatic or material support to Iran in response to Western military action.

To learn how Silobreaker can help your team deliver decision-grade insights to anticipate threats and risks that they can rely on, request a demo here