Iran's cyber attack strategy is 'perfect weapon' against US

Tactic has high impact, says expert, as report says Tehran is broadening hacking attempts on critical American infrastructure

Iran's cyber attacks on US critical infrastructure, including water and energy systems, have intensified following American and Israeli strikes on the country. Hacking requires no military presence on US soil, making it a low-cost, high-impact tool for Iran operating under heavy international sanctions. The Iranian-linked group Handala claimed responsibility for breaching California Water Service and hacking FBI director Kash Patel's personal email and cloud services. Iranian hackers exploit basic cybersecurity weaknesses — outdated systems, weak passwords and unnecessary internet-connected devices — rather than relying on sophisticated techniques.

Iran's cyber attacks on US critical infrastructure, including water and energy systems, have intensified following American and Israeli strikes on the country.

Hacking requires no military presence on US soil, making it a low-cost, high-impact tool for Iran operating under heavy international sanctions.

The Iranian-linked group Handala claimed responsibility for breaching California Water Service and hacking FBI director Kash Patel's personal email and cloud services.

Iranian hackers exploit basic cybersecurity weaknesses — outdated systems, weak passwords and unnecessary internet-connected devices — rather than relying on sophisticated techniques.

Amid new reports that Iran has broadened cyber attacks on the US, technology experts are warning that hacking is “perfectly suited to Iran's geopolitical situation”.

A report from NBC said Iran had increased efforts in recent weeks to compromise computer systems in the US, which had the potential to affect electricity, telecoms and other critical infrastructure.

Morey Haber , chief security adviser at US cybersecurity company BeyondTrust, told The National he was not surprised by Iran's continued attempts to flex its cyber crime capabilities against the US.

Weekend Essay When does a cyber attack count as an act of war?

“Cyber is an asymmetric weapon, perfectly suited to Iran’s geopolitical position and only requires expertise,” he said. Sanctions on Iran make hacking a logical last choice for the country, he added.

“These attacks can have a significant impact on a population without requiring aircraft, missiles or personnel on American soil, while creating ambiguity around attribution and a proportional response.”

Mr Haber added that, surprisingly, Iranian attacks were not particularly sophisticated from a technical standpoint. But the hackers seem to be having significant success by taking advantage of poor cybersecurity hygiene such as antiquated systems, weak password credential processes and devices that are unnecessarily connected to the internet.

“Sometimes the easiest way through the front door is simply discovering that someone forgot to lock it,” he explained.

Yiyi Miao, chief product officer of cybersecurity firm OPSWAT also said he wasn't surprised that Iran was bolstering its various hacking attempts.

He also cautioned that just because the recent Iranian hacks against the US haven't caused anything cataclysmic, that the US shouldn't be lulled into a false sense of security.

"In critical infrastructure, you can't wait for a sophisticated attack to land and then take it seriously," Mr Miao explained.

"Even a crude attempt against unpatched, internet-facing equipment can cause real disruption, because you can't just take a water system or energy facility offline to patch it," he added.

In July, several US states acknowledged hacks on their water systems , which experts say probably originated in Iran. At the time, however, US President Donald Trump said “incompetence” by state officials was to blame.

Without mentioning Iran by name, the Critical Infrastructure Security and Resilience Agency issued a warning potential cyber attacks against critical US digital systems.

“We are seeing increased targeting of programmable logic controllers in the water and wastewater systems sector,” the agency posted on X.

It urged utility operators to follow instructions from federal authorities to minimise hacking risks.

Iran-linked Handala's attacks

Like most hacking and cyber crime activities, Iran's state- efforts often take place discreetly. However, one group has frequently boasted of its activities since US and Israeli strikes against Iran began at the end of February.

In March, Handala, which cybersecurity experts have linked to Iran, followed through on a threat to attack the FBI by hacking director Kash Patel 's personal email and cloud services.

It was later determined that Handala was behind a cyber attack against Michigan-based medical technology company Stryker, which has more than 50,000 employees around the world.

One of Handala's more concerning hacks took place in June, when the group took credit for breaching the systems of California Water Service. The hackers published 5 gigabytes worth of data from the breach as proof, but in an interesting twist, the group highlighted its restraint.

“Local sources in the US announced that as a result of this cyber intrusion, the water supply of around 20,000 customers in California was cut off,” Handala posted in a message on Telegram. It added that although it did breach Cal Water's systems, it did not cut off the water supply.

It added that the disruption occurred due to the “lack of technical knowledge among the cybersecurity experts” at the company.

“Handala did not carry out any destructive operation in this incident, despite having the capability to do so,” it said.

Did Iran cross 'red line'?

Long before the US strikes on Iran, cyber hostilities between the countries were an open secret.

A 2025 digital defence report from Microsoft indicated that Iran most frequently targeted Israel, the US , the UAE and India with attempted cyber attacks. American officials warned last year that Iran was doubling down on efforts to hack US computer systems.

FBI assistant director Brett Leatherman highlighted these concerns during a discussion hosted by the George Washington University’s Programme on Extremism in August 2025.

“If you use cyber weapons to destroy infrastructure, you’re now destroying information that a sovereign nation depends on,” Mr Leatherman said. “That tends to be a red line.”

Iran has not been shy accusing the US and Israel of trying to hack its computer infrastructure as well.

Weeks after US strikes on Iran began, US cyber director Sean Cairncross described Iran as a “perpetual bad actor” and said its efforts to compromise US digital infrastructure had increased.

“Iran has never been a good actor in this space,” Mr Cairncross said in April. “They've never stopped trying to push in this regard.”

John Fokker, vice president of threat intelligence strategy at Trellix said that other countries should also be taking notes as to how Iran is trying to hack US entities.

"That includes recent incidents involving critical infrastructure in the UK, while Trellix has also continued to monitor Iranian-linked targeting of the energy and oil and gas sectors across the Middle East," he explained.

"Cyber operations have become an extension of modern geopolitical conflict, providing states with a way to apply pressure, create disruption, and signal intent without necessarily escalating to direct military action," Mr Fokker added.

Ramadan 2027 and Eid Al Fitr holiday: Potential dates announced for the UAE

Cartoon for September 3, 2026

Iran war latest: US launches first strikes on Iran in a month

'Give back the money': Sharjah Ruler orders free education for Sudanese pupils after fees wrongly collected

UAE travel advisory: Flights delayed and cancelled at Dubai and Abu Dhabi airports