Iranian Cyber Operations 2026

This report draws on US and allied government advisories, primary vendor threat-intelligence research, public reporting from established media outlets, and adversary claims observed on Telegram channels, paste sites, and other open sources. Where reporting differs across sources, the most directly attributed and most recent account has been preferred. Claims of operational impact, attribution, and casualty are treated as reported rather than as confirmed unless backed by a primary government advisory or vendor disclosure.