While missiles fly over the Middle East, a quieter war is raging through every connected device, data centre, and bank account and it’s already closer to you than you think.
On February 28, 2026, the United States and Israel launched coordinated military strikes on Iran codenamed Roaring Lion and Operation Epic Fury. What most news cycles covered were the explosions, the missile retaliations, the airspace closures from Kuwait to the UAE. What they didn’t cover well enough was what happened inside the internet.
Within hours of those first strikes, Iran’s internet connectivity dropped to roughly 4% of normal levels. Not because of power outages but because of what security researchers described as the largest Israeli cyber operation in history, targeting Iran’s communications, state media, and military command systems simultaneously. Government digital services in Tehran, Isfahan, and Shiraz simply went dark.
That’s not a subplot. That is the story.
- 149 Hacktivist DDOS attacks in 4 Days
- 110 Organisations targeted across 16 countries
- 200K Cyberattacks per day intercepted by UAE alone
This is not just their problem. Here’s what a lot of people get wrong: they assume a war in the Middle East stays in the Middle East. But cyber operations don’t respect geography. By March 2, 2026, the UK’s National Cyber Security Centre had already issued an alert urging businesses especially those with any supply chain links to the region to immediately review their security posture.
A Wall Street Journal report around the same time noted that Iran’s state-backed hackers may be planning economically damaging attacks on private-sector companies in the US and allied nations. CrowdStrike’s head of counter adversary operations confirmed they were already seeing Iran-aligned groups conducting reconnaissance and launching denial-of-service attacks, noting these behaviours typically come before something much worse.
“Iran has a track record of using cyber operations to retaliate against perceived political slights and these activities have increasingly incorporated ransomware against civilian targets.”
The groups driving these attacks aren’t just state actors. At least 12 different hacktivist groups have been confirmed active in this wave including Keymous+, DieNet, and NoName057(16), which together account for nearly 75% of all claimed attacks. Some are ideologically motivated. Some are state-aligned. Some blur the line between both.
What’s Actually Being Targeted
Energy. Banking. Hospitals. Aviation. Telecommunications. These aren’t random targets, they’re pressure points. Disrupting a hospital’s systems during wartime creates panic. Taking down a bank’s platform erodes public trust. Knocking critical infrastructure offline forces governments to redirect attention and resources.
In the UAE alone, authorities were intercepting between 90,000 and 200,000 cyberattacks per day as of mid-February 2026 before the situation even escalated to direct military strikes. Over 70% of those attacks were linked to state-sponsored actors. One claimed attack by the Cyber Islamic Resistance Axis targeted control systems at an Israeli industrial firm, allegedly gaining access to temperature and weighing systems at a Jordanian grain facility.
⚠ Closer to home than you think
Amazon’s cloud division reported damage to a UAE data centre after objects struck the facility during the conflict. This is not hypothetical exposure — commercial digital infrastructure is already being caught in the crossfire.
And then there’s the phishing angle most people overlook. An active SMS campaign was found distributing a fake version of Israel’s emergency alert app, RedAlert. People downloaded it thinking it was a legitimate wartime update. It was surveillance malware. This is the kind of attack that doesn’t care where you live, it only cares that you clicked.
Why You Should Actually Care Right Now
You might not work for a defence contractor or live near a conflict zone. But you probably use cloud services hosted in regions now under attack. You likely bank through systems that share infrastructure with affected networks. You almost certainly work with third-party vendors who have operations or supply chains in the Gulf.
Cyber risk in 2026 is not contained. The World Economic Forum’s Global Risks Report ranked cyber infrastructure threats in the top ten risks worldwide published before this current escalation. Now that a full regional conflict has erupted, those risks are materially higher.
What makes this moment different is scale and speed. Twelve hacktivist groups, multiple nation-state actors, and opportunistic criminals are all attacking simultaneously. Some of what they’re claiming is exaggerated. Some of it is real. And distinguishing between the two is genuinely hard even for professionals.
What You Can Actually Do
This is where most security articles lose people, they either go too technical or too vague. Here’s the honest, practical version:
- Audit what you’re connected to – If your business uses vendors, cloud providers, or payment processors with Middle East operations, ask them directly about their current security posture. Supply chain attacks are the most common way regional conflicts spill into unrelated businesses.
- Turn on multi-factor authentication everywhere – The most common entry point in these attacks is compromised credentials. MFA won’t stop everything, but it blocks the most common attack vector dead.
- Be suspicious of urgent communications – Phishing ramps up dramatically during conflict periods because fear makes people act fast without thinking. Any message pushing urgency especially around apps, security updates, or financial actions deserves a second look.
- Patch your systems. Now, not next month – Threat actors hunting for soft targets actively scan for known unpatched vulnerabilities. During heightened conflict periods, the window between a vulnerability being discovered and being actively exploited shrinks dramatically.
- Have an incident response plan – Most small and mid-sized organisations don’t have one. You don’t need to be a Fortune 500 to have a basic plan for what happens if your systems go down or your data gets stolen. Write it while things are calm — not after the breach.
What’s happening in the Middle East right now is the clearest demonstration yet of something security professionals have been saying for years: kinetic warfare and cyber warfare are no longer separate things. They happen together, they reinforce each other, and they both touch civilian life.
The traditional idea that “cybersecurity is an IT problem” has never been less accurate. It’s a business continuity problem, a personal safety problem, and increasingly a geopolitical problem that lands on ordinary people’s doorsteps in the form of a drained bank account, a locked hospital record, or a power grid that stops working.
This conflict will evolve. The cyber dimension of it will evolve faster. Staying informed and staying prepared aren’t the same thing — but right now, doing both is the only reasonable response.
Is Your Business Actually Prepared?
Most organisations won’t find out their security gaps until they’re already dealing with a breach. Holocron Cyber helps businesses understand their real exposure and build a response capability before they need one — not after.
