Iranian Cyberattacks Israel: Cyber Chief Reports Threefold Spike Amid Ongoing Conflict

JERUSALEM — Hostile cyberattacks targeting Israel have surged drastically. Indeed, they have nearly tripled over the past year. This sudden spike directly follows a joint US-Israeli military offensive against Iran. Consequently, the head of Israel’s national cybersecurity agency revealed these critical details recently.

In a new interview with Die Welt , Yossi Karadi provided a sobering assessment. He serves as the Director General of Israel’s National Cyber ​​Directorate (INCD). In his briefing, he described an invisible war expanding rapidly across cyberspace. Specifically, Karadi disclosed how the wave of Iranian cyberattacks Israel is facing has rapidly expanded. He noted that Israeli authorities registered approximately 4,800 hostile incidents in June 2026 alone. This represents a staggering threefold increase. In contrast, the agency recorded roughly 1,600 incidents during June 2025.

Ultimately, the data underscores a stark reality of modern warfare. Kinetic military campaigns often fluctuate because they experience truces or temporary ceasefires. However, the digital front remains a relentless, 24/7 theater of operations.

“Some groups are very skilled,” Karadi stated, assessing the capabilities of the adversaries striking Israeli networks. “We can handle them, but we have to take them seriously. Unlike in the kinetic realm, there’s no ceasefire in cyberspace.”

Iranian Cyberattacks Israel: The Asymmetric Expansion of the Digital Front

The massive spike in digital hostility correlates directly with Middle Eastern geopolitical shifts. In fact, the situation escalated dramatically this year. A multi-domain US-Israeli military offensive began, which aimed to weaken Iran’s strategic capabilities.

Naturally, air strikes and missile exchanges dominate international headlines. However, the wave of Iranian cyberattacks Israel must defend against highlights a secondary front. State actors wage this war entirely via fiber-optic cables and computer code. Therefore, cyber warfare is no longer just a tool for espionage. Instead, it is now a core pillar of state-level retaliation.

Furthermore, according to INCD logs, these cyber campaigns operate independently of real-world negotiations. For example, Karadi noted that cyberattacks against Israel actually doubled during a brief ceasefire last year. This clearly indicates that state-backed hacking cells accelerate operations when physical weapons stand down. Thus, they project power and gather intelligence without violating a kinetic truce.

Iranian Cyberattacks Israel Target Critical Infrastructure and Main Street

Crucially, the 2026 cyber surge features a very broad targeting matrix. Iranian-aligned hacking cells do not just target military networks. Rather, the ongoing campaign of Iranian cyberattacks Israel is experiencing casts a massive net across civilian society.

To clarify, Karadi categorized the primary targets into four distinct tiers:

• Critical Infrastructure: Power grids, water facilities, transportation networks, and telecommunications hubs.
• Central Organizations: Major banks, government ministries, health institutions, and large defense contractors.
• Small-to-Medium Enterprises (SMEs): Local businesses, tech startups, and supply-chain logistics providers.
• The General Public: Public-facing web portals, personal devices, and civilian digital infrastructure.

Fortunately, Israel’s robust defensive perimeter has largely held the line at the highest level. “So far—and hopefully it stays that way—we’ve managed to fend off attacks on critical infrastructure,” Karadi remarked.

However, the spillover effect into the private sector has been severe. Smaller businesses lack multi-million-dollar cybersecurity budgets. Moreover, they rarely run dedicated Security Operations Centers (SOCs). As a result, they bear the brunt of the collateral damage.

Specifically, Karadi pointed to law practices and accounting firms as frequent victims. These organizations hold immense vaults of sensitive data and corporate financials. Yet, they often possess entry-level network defenses.

For these targets, breaches are rarely limited to data theft. In addition, Karadi revealed that vulnerable companies increasingly suffer total data-wiping attacks . Attackers utilize destructive malware to completely erase operating systems. Consequently, this leaves corporate networks permanently disabled and forces businesses into prolonged, costly recoveries.

Inside the Iranian Hacking Ecosystem Executing Cyberattacks

To achieve this, Kadi described a highly complex, multi-layered ecosystem structured by Tehran. This apparatus ensures that the momentum of Iranian cyberattacks Israel deals with remains constant. Simultaneously, it blurs the lines between military organs, freelance contractors, and volunteers. This strategy allows the Iranian state to maintain plausible deniability while maximizing damage.

In particular, the INCD visualizes this hostile network as three distinct layers:

1. The Core State Apparatus: Specialized cyber warfare units operate directly within Iran’s formal security architecture. This includes the Islamic Revolutionary Guard Corps (IRGC) Cyber-Electronic Command as well as units within the Ministry of Intelligence and Security (MOIS).
2. Paid Civilian Contractors and Ransomware Gangs: Private Iranian technology companies operate as fronts for the state. Meanwhile, Tehran also hires civilian hackers on a contractual basis. Notably, Karadi highlighted Tehran’s aggressive attempts to recruit professional cybercriminals from abroad. They specifically target global ransomware organizations to leverage pre-built intrusion pipelines.
3. Ideological Activists and Hacktivists: Finally, the outermost layer features decentralized activist groups. These ideologically motivated hackers rally around the state’s narrative. Therefore, they excel at low-level disruption, like Distributed Denial of Service (DDoS) attacks. They also run psychological operations to foster public anxiety.

The Blueprint of a Sophisticated Espionage Campaign

Importantly, the tripling of attacks in 2026 follows a highly coordinated preparation phase. In February, the INCD issued a sweeping public alert. They worked in close coordination with the Shin Bet, Israel’s internal security service. Together, they unmasked a deeply entrenched phishing and espionage campaign active since mid-2025.

This campaign successfully bypassed automated defenses by utilizing precision-engineered social engineering. For instance, Iranian operatives spent months building fake digital personas on professional networks like LinkedIn. They falsely posed as journalists, foreign academics, and diplomats.

Once these personas established rapport, they launched targeted attacks. Specifically, they aimed directly at high-profile Israeli citizens. Their targets included senior government officials, military figures, and prominent academics.

Global Coalitions and the Network Defense Strategy

Consequently, under Karadi’s leadership, the INCD has shifted toward an active defense model. International partnerships form a core component of this strategy because cyberspace knows no geographic borders. For example, a server in Europe can easily launch an exploit against a target in Tel Aviv.

Partner Nation(s)	Initiative	Strategic Objective
India	Joint Center of Excellence	Collaborative research into securing critical infrastructure and protecting databases.
Greece & Cyprus	Maritime Cyber ​​Center (MarCCE)	Protecting shipping lanes, port management, and Mediterranean maritime logistics.
Germany	Permanent Cyber ​​Liaison	Facilitating real-time sharing of threat indicators and malicious code signatures.

“The cooperation with the US is still excellent,” Karadi underscored. Indeed, the strategic cyber partnership between the INCD and US agencies like CISA has yielded critical defensive victories.

Conclusion: The Permanent State of Digital Attrition

In summary, the joint US-Israeli military campaign continues to shape the region. Meanwhile, findings from the Cyber ​​Directorate serve as a global warning. Physical battlefields may eventually cool down; however, the digital domain has entered a permanent state of high-intensity attrition.

Israel relies fundamentally on digital interconnectedness. Therefore, for this “Startup Nation,” cybersecurity is no longer just a technical IT requirement. Instead, it has graduated into a foundational pillar of national survival.

Yossi Karadi and the INCD now manage thousands of hostile incidents daily. Ultimately, this ongoing campaign proves a vital point about modern conflict. The first line of national defense is no longer found at a geographical border. Instead, it exists deep within the architecture of the network.