Iranian cyberattacks remain a threat despite ceasefire, US officials warn

Key Points

• Federal cybersecurity agencies, including the FBI and CISA, warn that Iranian-affiliated hackers remain a threat to critical infrastructure systems and U.S. defense contractors despite the declared ceasefire with Israel.
• Many hacking groups supportive of Tehran operate with loose state ties and may use cyberattacks as an alternative to traditional military retaliation.
• Since U.S. strikes on Iranian nuclear facilities, Tehran-backed hackers have targeted American banks, defense firms and energy companies, though they have not caused widespread disruption so far.
• The agencies’ public bulletin recommends organizations implement regular software updates and strong password management to strengthen their digital defenses.

WASHINGTON (AP) — A ceasefire between Iran and Israel has not ended the threat of cyberattacks from hacking groups supportive of Tehran, the FBI and federal cybersecurity officials warned Monday.

In a public bulletin, the authorities warned that hacking groups affiliated with or supportive of Tehran may still seek to disrupt or disable critical infrastructure systems in the U.S. such as utilities, transportation and economic hubs. Hackers may also target defense contractors or other American companies with ties to Israel, the agencies said.

“Despite a declared ceasefire and ongoing negotiations towards a permanent solution, Iranian-affiliated cyber actors and hacktivist groups may still conduct malicious cyber activity,” the agencies warned.

The warning of continued cyberthreats after a halt to conventional warfare reflects the often opaque nature of cyber conflict. Hacking groups may have only loose ties to a nation state, and may seek to retaliate as an alternative to traditional military action.

The bulletin outlined recommendations, including the use of regular software updates and strong password management systems to shore up digital defenses.

Hackers backing Tehran have targeted U.S. banks, defense contractors and energy companies following American strikes on Iranian nuclear facilities — but so far have not caused widespread disruptions.

While it lacks the technical abilities of China or Russia, Iran has long used its more limited capabilities to steal secrets, score political points or frighten opponents.

Analysts have tied some of these activities to groups working on behalf of Iran's military and intelligence agencies. But in other instances, the groups appear to act independently.