Publications

The Iranian Cyber Threat

Memorandum 230, February 2024

Iran was one of the first states to formulate a national cyber strategy, including development of the necessary state institutions and technological capabilities. Today, Iran is one of the more active states in the cyber realm, near the top of the second tier of global actors. Iran’s cyber attacks have demonstrated the potential to disrupt, sabotage and even destroy civil and commercial targets, critical national infrastructure and military capabilities, and its cyber espionage and information operations have been particularly extensive. Israel and the United States are Iran’s primary targets.

This study presents a comprehensive and up-to-date analysis of Iran’s cyber strategy, institutions and praxis. Its five parts present: a brief background on the cyber threat and what makes it different from other realms of conflict; Iran’s cyber strategy and the institutions and capabilities it has developed; the primary cyber attacks Iran has conducted against the US and actors in the Middle East and around the world; the Iranian cyber threat to Israel; and an assessment of the actual impact of Iran’s attacks to date, along with conclusions and policy recommendations.

Click here to download the full Memorandum

Table of Contents:

Iran was one of the first states to formulate a coherent national cyber strategy,including the establishment of the necessary state institutions and development of the requisite technological capabilities. Its interest in the cyber realm was first sparked by two primary developments: first, the effective use that the opposition made of the internet to foment and sustain the mass demonstrations following the rigged presidential elections in 2009, and second, the dramatic Stuxnet attack against Iran’s nuclear program in 2010, reportedly a joint US–Israeli operation. Ever since, Iran’s cyber capabilities have grown steadily, and it is now commonly ranked at the top of the second tier of global cyber powers...

The Iranian cyber threat is just one facet of the astonishing information revolution that has swept the world in recent decades. In just two days, the international community creates as much data as it did from the beginning of time up until 2003. In 2019 nearly half the homes around the world had a computer. In 2021 there were some 15 billion mobile phones, and more than 26 billion devices were connected to the internet in 2022.1 Each computer and phone presents a technological and societal advance but also a potential portal for malicious cyber activity. The artificial intelligence (AI) revolution is just beginning...

In the early 2010s, two primary factors led Iran to rapidly develop its heretofore limited cyber capabilities. The first was the effective use of the internet by the Iranian opposition to foment and sustain the mass demonstrations following the rigged presidential elections in 2009. The regime ultimately succeeded in suppressing the protests but also gained a healthy appreciation of the threat that the new technology posed to its stature and stability.21 The second factor was the dramatic Stuxnet attack against Iran’s nuclear program in 2010, reportedly a joint US–Israeli cyber sabotage operation. Stuxnet, the first known case of a cyberattack that caused physical damage, demonstrated Iran’s extreme vulnerability and led to a severe national shock. In response, Iran rapidly accelerated the development of its then only nascent cyber capabilities...

The following section presents the major attacks that Iran has conducted to date against states around the world, while attacks against Israel are presented in the next section...

Israel is Iran’s primary adversary in the cyber realm, as it is in all others. Before turning to the Iranian cyber threat to Israel, it is important that we begin by placing them in the broader strategic context of the overall threat that Iran poses to Israel. For decades, the Supreme Leader Khamenei and other Iranian leaders have repeatedly called for Israel’s destruction, referring to it, inter alia, as a “cancerous tumor” that must be removed. In 2014 Khamenei even publicly enunciated a nine-point plan for Israel’s destruction.

Iran’s cyber capabilities have advanced considerably since the anti-regime demonstrations in 2009 and the Stuxnet attack in 2010 first sparked its interest in the cyber realm. In the past decade, Iran has become one of the more active states in cyberwarfare, probably at, or near, the top of the second tier of global actors. The number of attacks that Iran has launched and their sophistication have grown, and it has demonstrated the potential to destroy, disrupt, distort, sabotage, or undermine critical national infrastructure, commercial interests, military capabilities, domestic politics, societal resilience, and international diplomacy. Iran’s capabilities will likely continue to improve, as a result of its own indigenous capabilities and due to Russian and Chinese assistance.

The opinions expressed in INSS publications are the authors’ alone.

Publication Series Memoranda

TopicsIran Iran: The International Arena

עברית

Related Publications

All publications

Shutterstock

The Need to Reexamine the Concept of the “Shiite Axis”

Following the collapse of the Assad regime, Hezbollah’s erosion, and increasing pressures on the Shiite militias, is there still a cohesive “Shiite axis” under Tehran’s strategic guidance?

27/05/25

Interactive Map: Iran’s Strategic Assets

Amid ongoing negotiations between Iran and the United States, we are approaching a critical juncture regarding the future of Iran’s nuclear program—caught between the possibility of a diplomatic resolution and the threat of military action (by Israel and/or the United States). This interactive map highlights Iran’s key military and nuclear facilities, along with the locations of direct attacks on Iranian territory attributed to Israel in April and October 2024. Whether the coming months bring renewed diplomatic efforts toward a nuclear agreement or a military escalation with Iran, this regularly updated map provides a valuable resource for understanding Iran’s strategic assets. These assets form a central pillar of Iran’s deterrence posture against its adversaries—chief among them, Israel—especially given the weakening of its regional proxy network—which the Islamic Republic has built over years—due to the ongoing wars in Gaza and Lebanon and the collapse of the Assad regime in Syria. The map is updated regularly and as accurately as possible, based on open-source intelligence assessments and media reports.

21/05/25

An Opportunity to Block Iranian Influence in Latin America

In contrast to previous US administrations, which largely ignored Iran’s growing presence in Latin America, the Trump administration has opened a unique window for formulating and implementing a strategy to curb Iran’s expansion

15/05/25

Publications

The Iranian Cyber Threat

Related Publications

Research

Publications

About

Media

Home

Events

Database

Team

Contact

Newsletter

עברית