The Iran War Is Changing Cyber Conflict in Ways Boards Are Not Ready For

The real shift is not a new malware family. It is cyber becoming operational terrain for commercial firms, cloud regions, cameras, identity systems, and ordinary admin tooling.

Public reporting usually describes the current fighting as a U.S.-Israeli conflict with Iran that began on February 28. By March 18, it is in its third week. The strongest read from the evidence is not that some brand new cyber superweapon has appeared. It is that the war is accelerating a different model of cyber conflict, one where commercial firms are part of the target set, cyber supports kinetic operations, ordinary enterprise administration tooling is weaponized, and criminal infrastructure is folded into state operations.

What Stryker tells us

The clearest proof that this is now a commercial problem, not just a government one, is Stryker.

Look at what the filing actually says. No ransomware. No malware. Yet a Fortune 500 medical device company with global operations experienced disruption severe enough to affect order processing, manufacturing, and shipping, with restoration timelines that remained unknown days later. The attack caused roughly a week of operational disruption before Stryker reported containment and began progressive restoration. Some US hospitals reported short-term operating room scheduling delays tied to Stryker supply chain disruption, a reminder that when a medical device manufacturer goes down, the downstream harm reaches patients. Check Point Research called it “the first time Iran executed a successful full-blown disruptive attack against a major US corporation, especially against a company that plays a critical role in the healthcare supply chain.”

That pattern should concern every board. It means the old mental model, where a cyberattack means a ransom note on a screen and a negotiation with a criminal gang, does not describe what just happened. This was an operational disruption that did not fit the categories most incident response plans are built around. Retired US Army Lt. Gen. Ross Coffman put it plainly to The Register: “What we saw against Stryker, it's just the beginning.”

Reuters then reported that Greek authorities sent a high-priority advisory to six sectors. U.S. banks were already on heightened alert for Iran-related cyber risk. Within five days, one company's incident had become a multi-country, multi-sector warning.

That matters because it shows the commercial sector is no longer just collateral damage. It is being treated as operational terrain.

Cameras, cloud, and physical targeting are converging

The most important shift is cyber-physical convergence.

AP reports that since the war began, pro-Iranian hackers have tried to penetrate cameras in Middle Eastern countries to improve missile targeting. Check Point says it observed intensified targeting of Hikvision and Dahua cameras starting February 28 across Israel, Qatar, Bahrain, Kuwait, the UAE, Lebanon, and Cyprus.

Check Point Research Assessment

“Consistent with operational support and battle damage assessment for missile operations.”

Check Point Research, March 2026. Interplay between Iranian Targeting of IP Cameras and Physical Warfare in the Middle East.

This is a real strategic change. Cameras are no longer just an IoT hygiene problem. In a live conflict, they become battlefield sensing.

The same logic extends to cloud dependency. Even where the cyber portion of an incident is limited, the commercial operating model is now exposed to physical disruption, regional hosting concentration, and data residency constraints. Reuters' March 18 reporting on new UK reporting rules is a reminder that third-party disruption is no longer a niche resilience topic. More than 40 percent of cyber incidents reported to the FCA in 2025 involved a third party, including outages tied to Cloudflare and AWS.

For Fortune 1000 firms, the lesson is straightforward. Regional cloud architecture, local data residency, and third-party resilience are now part of wartime cyber planning, not just compliance architecture.

The control plane is becoming the attack plane

The biggest technical shift is not a flashy new implant. It is the control plane becoming the attack plane.

Unit 42's March 16 analysis explicitly frames the trend as a move from older MBR wipers toward identity weaponization. Its work on CVE-2026-1731 exploitation shows attackers creating domain accounts and local admin accounts, attempting SimpleHelp and AnyDesk, deploying backdoors, using tunneling infrastructure, and stealing data.

Check Point's Handala research shows the same logic inside destructive operations. The group moved laterally through RDP, manually downloaded NetBird from the official site to build internal connectivity, operated from at least five attacker-controlled machines simultaneously, and distributed multiple wiping techniques through Group Policy.

The Stryker incident brought this pattern into sharp relief. Later reporting indicated the disruption involved approximately 200,000 devices wiped via Microsoft Intune and Group Policy, exactly the identity and admin-tooling attack surface Unit 42 and Check Point had highlighted. The absence of traditional malware is the point. This was control-plane weaponization using the enterprise's own management infrastructure against itself.

That is what boards need to absorb. The attack surface is shifting away from exotic malware toward identity systems, remote administration, trusted tooling, and enterprise orchestration layers that most companies still treat as ordinary IT.

This kind of tradecraft is not glamorous. It is practical. It scales. It is often faster to execute and harder to disrupt midstream than a custom malware-heavy operation.

Intelligence Models are helping operators, not replacing them

Intelligence Model usage is present in this conflict, but the public evidence points to operator amplification, not autonomous cyber war.

Check Point says Handala's PowerShell wiper was likely developed with Intelligence Model assistance. Unit 42 says MOIS-linked activity now includes Intelligence Model-enhanced malware implants and generated code. Google has separately reported other nation-state clusters using Gemini to synthesize open-source intelligence and profile defense targets for reconnaissance and phishing preparation.

The pattern is consistent. Intelligence Models are shortening development cycles, improving lure quality, assisting code generation, and accelerating research. They are not removing the human operator from the loop.

That still matters commercially. Faster iteration means faster destructive preparation, better phishing, more polished scripts, and more scalable adaptation when defenders close one path and force attackers to try another.

Criminal infrastructure is becoming state capacity

One of the more important breakthroughs is organizational, not technical.

Check Point argues that for some MOIS-linked actors, cybercrime is no longer just camouflage. It is an operational resource. The firm specifically notes Handala's use of Rhadamanthys and describes a broader pattern in which Iranian actors increasingly use criminal tools, infrastructure, access brokers, marketplaces, and affiliate-style relationships. eSentire's MuddyWater reporting points in the same direction, with use of AnyDesk, cloud infrastructure, and shared ecosystem tooling.

Symantec now reports that Seedworm (MuddyWater) has been active on the networks of a US bank, an airport, a nonprofit, and the Israeli operations of a US software company since February 2026, with activity continuing into recent days. That is not a theoretical threat. That is presence on American commercial infrastructure during an active conflict.

The DOJ domain seizure affidavit added another dimension. FBI investigators found that Handala used its infrastructure not only for hack-and-leak operations but also to send death threats to Iranian dissidents and journalists in the United States and to offer bounties to Mexican cartel contacts for violence against targets. That collapses another boundary: the line between cyber operations, transnational repression, and physical violence. Handala separately claimed impact on approximately 200,000 devices in the Stryker incident. Independent verification of that figure remains limited, consistent with Unit 42's standing warning that hacktivist groups frequently exaggerate their reach.

That means attribution gets messier at the same moment operational capability grows. For boards and CISOs, this is a serious problem. The old distinction between state actor, proxy, affiliate, access broker, ransomware brand, and ordinary cybercrime is becoming less useful in live conflict conditions.

The better question is operational. What can the adversary do with the ecosystem available to them, and how fast can they put it to work against your commercial environment?

The conflict is also acting like a lure engine

Proofpoint says it observed a rise in campaigns from actors aligned with China, Belarus, Pakistan, Hamas, and Iran since the war began. These campaigns used compromised government accounts, conflict-themed subjects, Google Drive delivery, password-protected archives, and cloud-themed credential theft. One campaign linked to a Google Drive URL hosting a password-protected archive disguised as conflict imagery.

This is another important shift. A live war becomes a distribution engine for espionage, credential theft, and social engineering well beyond the immediate battlefield parties. That means every enterprise should treat conflict-themed email tied to Iran, Gulf infrastructure, shipping disruption, or strike reporting as high suspicion, even if the sender appears adjacent to government or media.

The skeptic's view still matters

There is an important devil's-advocate point here.

Not every public claim maps to real strategic effect. Nextgov quoted CrowdStrike saying it had not observed large-scale state-sponsored campaigns in the early phase, and quoted Google's John Hultquist saying Iran has historically had mixed results with disruptive cyberattacks and frequently fabricates or exaggerates effects to boost psychological impact. Unit 42 likewise warns that hacktivist groups often exaggerate their reach and says rapid scoping is necessary to prevent public panic. CISA acting director Nick Andersen said at a conference on March 19 that there had not been an uptick in cyber threats since the war started.

That skeptical view is useful. It keeps defenders from mistaking Telegram theater for strategic reality.

But it sits uneasily next to the evidence. Stryker experienced a week of global operational disruption from an attack with no ransomware and no malware. Seedworm is on the networks of a US bank and an airport. The DOJ just confirmed MOIS attribution for the Handala campaign. The skeptical framing does not cancel the threat. It refines it.

The evidence does not support cyber Pearl Harbor rhetoric. It does support selective, high-consequence, uneven disruption against commercial targets, including real enterprise outages, targeting of camera infrastructure for kinetic support, identity-centric intrusion paths, and destructive operations built from ordinary tools.

What this means for cyber insurance

There is a coverage question here that CFOs and general counsel should not ignore.

Many cyber insurance policies are structured around specific attack types: ransomware, data exfiltration, business email compromise. Stryker's incident, with no indication of ransomware or malware yet full operational disruption, may sit in a gray zone between traditional policy triggers. Conflict-linked cyber events also risk triggering war exclusion clauses that insurers have been tightening since the NotPetya litigation. Organizations should be reviewing their cyber coverage now, not after an incident, to understand whether their policies cover destructive outages that do not fit neatly into existing categories and whether conflict-related attribution could affect claim eligibility.

What Fortune 1000 boards and CISOs should do now

The bottom line

The breakthrough here is operational, not purely technical.

Cameras are becoming ISR assets. Cloud and third-party concentration are becoming wartime resilience constraints. Identity systems and remote administration layers are becoming primary attack terrain. Intelligence Models are shortening operator cycles. Criminal ecosystems are expanding state reach and deniability.

For Fortune 1000 defense programs, that means the center of gravity is no longer just malware detection. It is resilience, control-plane hardening, supplier risk engineering, and cyber-physical integration.

If a board is still treating this as a malware-signature problem, it is behind the threat.