How Tehran’s Use of Cyber Operations in the U.S.-Iran Conflict Has Evolved

Center for Strategic and International Studies | Nikita Shah

Iranian cyber actors have executed concurrent cyberattacks against water facilities across at least six U.S. states since July 2026, marking a significant shift in Tehran’s wartime cyber posture. This offensive directly supports Iran's broader military strategy by targeting critical infrastructure, military tracking, and defense industrial supply chains across adversary homelands.

Earlier breaches of the Signalling System No. 7 protocol enabled Iranian intelligence to locate U.S. troops in the Middle East for kinetic targeting, demonstrating functional integration between cyber exploitation and physical strike capabilities. Tehran has also embedded artificial intelligence across its threat operations to expedite target reconnaissance and malware development while conducting persistent hack-and-leak campaigns against high-value military officials. Although U.S. airstrikes destroyed 100 telecommunications masts in southern Iran, Tehran maintains offensive capacity through tiered state internet architecture and satellite connections. Operating under a doctrine of calibrated escalation, Iranian offensive cyber campaigns intentionally impose psychological, cognitive, and economic friction without triggering full-scale conventional warfare.

Comment

The exploitation of Signalling System No. 7 protocols demonstrates how cross-domain intelligence fusion translates commercial cellular routing data into actionable real-time targeting for kinetic strikes. By intercepting location metadata across global telecommunications nodes, cyber operations bypass tactical electronic countermeasures to map force concentrations remotely. This convergence compresses the sensor-to-shooter loop without requiring persistent airborne ISR or physical reconnaissance assets in contested airspace. Consequently, standard operational security protocols governing military personal mobile devices represent critical vulnerabilities in theater threat matrices.

Strategic Question for Discussion

If legacy Signalling System No. 7 infrastructure remains integral to host-nation commercial networks, which operational trade-offs determine whether armed forces isolate tactical communications entirely or accept network intelligence risks in forward areas?

Share your assessment in the comments below.

To read in details click here