Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

What to Expect from Iran’s Digital Counterstrike #cybersecurity

4 Mar 2026 · 3 min

Watch on YouTube

2:53

In this monologue, Matthew Rosenquist analyzes the likely wave of Iranian cyberattacks that will follow a kinetic bombing campaign that decapitated Iran’s political and military leadership. He notes Iran’s reputation as one of the world’s most aggressive cyber actors and cites recent incidents where drones damaged three Amazon Cloud facilities in the United Arab Emirates and Bahrain, alongside attacks from Iran‑aligned hacking groups. Rosenquist predicts a near‑term, destructive cyber campaign focused on causing maximal damage rather than espionage or extortion. The campaign will target national critical‑infrastructure sectors—electric grids, transportation, communications, government and military networks, finance, water, and healthcare—most of which are operated by private firms. He expects attacks to be rushed, using existing tools to compromise, delete, corrupt, or “burn down” systems. While large Western nations may only see limited disruption due to the lack of highly sophisticated self‑propagating worms, smaller nations could suffer more severe impacts and may need recovery assistance. Rosenquist urges cybersecurity leaders in critical‑infrastructure organizations to harden environments, update risk assessments, and communicate recommendations to executives promptly, as the next one to two weeks will likely see Iran deploying all available cyber capabilities.

Chapters

After the United States and Israel began a bombing campaign on Iran, leading to the decapitation of its political and military leaders, the Middle East has erupted into waves of kinetic warfare. Iran has a formidable offensive cybersecurity capability and is considered one of the 4 most aggressive nations with respect to a willingness to direct cyberattacks against their adversaries. So far, we have seen drones damage 3 Amazon Cloud facilities in the United Arab Emirates and Bahrain. And cyberattacks from Iran's aligned hacking groups. Now, I expect more attacks to come in the near future. When the initial bombing occurred, two things happened that disrupted Iran's cyberattack coordination. First, the bombs disrupted communication networks. Second, their Supreme Leader and many of the Islamic Revolutionary Guard Corps and the Ministry of Intelligence and Security leaders were eliminated. I expect many attacks to occur in the next few days. Hacking crews will leverage the tools they have available and exploit the vulnerabilities they have at hand in a rushed manner. They will be pressured to act quickly to inflict as much damage as possible. The forces of these attacks will not be pursuing intelligence gathering, data breaches, ransomware, or extortion. Their goal will be simple. Do as much damage as possible. Compromise systems, delete, corrupt, and burn down anything they can. This will be a destructive campaign targeting the Western countries and any Arab nations they perceive as allies. The prioritized targets will be national critical infrastructure such as electrical grids, transportation, communications, government and military networks, finance, water, and healthcare. Most of these sectors are run by private corporations. These targets will deliver the most impact to citizens, their economy, and health. Right now is the time for critical infrastructure organizations to prepare, take extra steps to harden their environments, and reinforce their response capabilities. In the next week or two, I expect Iran to deploy everything they can from a cyber perspective. Unless they get really lucky, most attacks on large Western nations will not make a material difference. They may cause limited disruption and damage, but they likely lack the highly complex and mature destructive self-propagating worms that it would take to bring down multiple critical infrastructure sectors simultaneously. Smaller nations may not fare as well and might require recovery assistance. It is important for cybersecurity leaders to keep a keen eye on how attacks develop, update their risk assessments, and communicate their recommendations to executive leadership in a timely manner. Matthew Rosenquist.