Iran’s Cyber War Goes Mainstream: Bomb-Shelter Spyware, Stryker Wiped, and 5,800 Attacks

By Sara Voss · March 29, 2026

Key Insight: Since the Iran War began February 28, 2026, nearly 50 Iran-linked hacker groups have conducted 5,800 tracked attacks — including a documented first: spyware delivery synced to the exact minute of missile strikes. This isn’t just hacking. It’s the most sophisticated cyber-physical war campaign in recorded history.

Day Zero: When the Bombs Dropped, the Spyware Launched

On February 28, 2026 — the same day the Iran War officially began — Iranian threat actors launched a cyberattack campaign of unprecedented physical coordination. As missile strikes targeted civilian infrastructure, SMS messages flooded Iranian civilians’ phones, appearing to link to official bomb-shelter locator services. They didn’t. They delivered spyware granting full device access: contacts, microphone, camera, and location.

Researchers at Check Point Research confirmed the attack was “synced to the same minute” as inbound missile strikes — exploiting the chaos of incoming fire to maximize installation rates before victims could verify links. This is a documented first in cyber-physical warfare: attacks timed at the second of kinetic events.

Cyber operations began the same day kinetic strikes started — February 28, 2026.

Stryker Corporation: Employees Watched Their Computers Die in Real Time

In one of the most dramatic corporate breaches of the conflict, Stryker Corporation — the Michigan-based medical device manufacturer — became a high-profile victim of the Iran-linked Handala group. Employees reported watching files disappear and screens go dark in real time as a destructive wiper malware propagated across the network.

Stryker offices were shut down from March 11–17 as the company scrambled to contain the breach. Reuters confirmed containment on March 17. Handala, which claimed responsibility publicly, has been linked by DigiCert to Iranian state infrastructure. The attack appears motivated not by ransom but by disruption — consistent with the broader war-support cyber doctrine.

Separately, APT Iran — a different group — claimed it stole 375 terabytes of data from Lockheed Martin. The claim has not been independently verified, but the Halcyon threat intelligence team notes the volume is “within the plausible range” for a long-term persistent access operation.

Healthcare Targeted for Maximum Disruption

Iran-linked groups have deliberately targeted the U.S. healthcare sector — not for financial ransom, but for disruption. A second healthcare company was hit with destructive ransomware in the weeks following the war’s outbreak. Cyber analysts at Halcyon noted the pattern represents a strategic shift: healthcare networks are being targeted because downtime has immediate life-safety implications.

Additionally, the Dutch Ministry of Finance was breached on March 19 — discovered via a third-party alert, not internal detection. The breach highlights the risk of over-reliance on internal telemetry in a high-tempo adversary environment. The Netherlands breach also demonstrates geographic expansion: Iran-linked operations are no longer confined to U.S. and Israeli targets.

AI-Powered Attacks: 100 Million Views and FBI Director Kash Patel Hacked

AI is being weaponized to automate attack volume and generate disinformation at scale. One deepfake video depicting sunken U.S. warships accumulated over 100 million views across social platforms before removal — demonstrating the asymmetric amplification AI provides to adversarial actors.

In a particularly audacious operation, a pro-Iran group hacked into the social accounts of FBI Director Kash Patel, posting old photographs, his personal resume, and private documents. The operation appears designed to undermine public confidence in U.S. law enforcement’s ability to protect its own officials — a psychological warfare component layered atop the technical attack.

Scale context: DigiCert tracked ~5,800 cyberattacks from approximately 50 Iran-linked groups targeting the U.S., Israel, Bahrain, Kuwait, and Qatar. Fortune‘s March 29 investigation confirmed the campaign represents the broadest coordinated nation-state cyber offensive ever documented against Western targets in a single month.

Sara’s CISO Emergency Checklist: Iran Threat Landscape

Given the unprecedented scope of operations, CISOs should immediately audit the following:

1. Third-party detection coverage — The Dutch Ministry of Finance breach was caught by a third party, not internal tools. Audit your external threat monitoring gap.
2. Wiper-specific backups — Stryker’s destructive wipe shows ransomware isn’t always the goal. Immutable, offline backups are non-negotiable.
3. SMS phishing training — The bomb-shelter attack used SMS. Update phishing awareness to explicitly include SMS links during high-alert news cycles.
4. Executive account hardening — Kash Patel’s breach demonstrates VIPs are targets. Mandate hardware security keys for all senior accounts.
5. Healthcare OT/IT segmentation — If you’re in health services, assume you’re a priority target for disruption ops, not ransomware. Segment clinical systems now.
6. AI deepfake response protocol — Establish a verified communications channel that’s pre-authenticated with employees before a crisis hits.

Timeline: Iran Cyber Events Feb 28 – March 29, 2026

Frequently Asked Questions

Related Reading on Networkcraft

• → Security & Privacy Coverage at Networkcraft
• → Latest Tech & Security News — Networkcraft Home
• → How the Iran War Is Reshaping Defense Tech VC — Startups & Money

Stay Ahead of the Threat

Sara Voss covers cybersecurity, surveillance, and digital warfare every week. Subscribe to get her analysis before the news cycle does.

Subscribe to Networkcraft