# Iranian Cyber Campaign Synchronizes Cloud Attacks with Missile Strikes Against Israeli Infrastructure
## A coordinated password-spraying assault on 300+ organizations reveals escalating fusion of kinetic and digital warfare
A sustained cyberattack campaign attributed to Iranian state-sponsored actors has targeted more than 300 Israeli organizations and an additional 25 in the United Arab Emirates through deliberate password-spraying operations against Microsoft 365 cloud environments. The assault, unveiled by Check Point Research, unfolded across three distinct waves beginning in early March 2026 and continues to evolve. What distinguishes this campaign from routine cyber espionage is a stark and troubling pattern: the municipal governments selected for targeting correspond directly with Israeli cities struck by Iranian missiles during the identical timeframe, suggesting the attackers are deliberately coordinating digital disruption with kinetic military operations.
## The Threat
This campaign represents a maturing approach to hybrid warfare. Attackers systematically distributed common or weak password guesses across hundreds of organizational accounts simultaneously—a technique far more effective than traditional brute-force methods that trigger rapid lockout protections. By casting a wide net with a small set of likely credentials, threat actors dramatically increase their probability of gaining valid access to at least one user account within each targeted organization.
The sophistication lies not in the password-spraying itself, but in the operational security measures surrounding it. Initial reconnaissance and credential testing occurred through frequently-rotated Tor exit nodes, designed to evade IP-based blocking. When valid credentials were obtained, attackers pivoted to commercial VPN services—Windscribe and NordVPN specifically—with exit infrastructure physically located within Israel. This geographic spoofing bypasses both IP-restriction policies and the raised suspicions that typically accompany foreign login attempts to sensitive systems.
## Background and Context
The blurring line between cyber operations and conventional military action has become the defining characteristic of modern regional conflict. State actors increasingly view cloud infrastructure as a legitimate target set equivalent to physical assets. For Iranian security planners, targeting municipal governments presents a particular strategic advantage: these entities coordinate emergency response mechanisms—damage assessment, civilian shelter coordination, medical resource deployment, and public communications—that become critical during and after kinetic strikes.
The assessment of Iranian attribution rests on several pillars. The targeting priorities align precisely with Iranian strategic interests: Israeli local government, alongside organizations within satellite communications, aviation, energy, and maritime sectors. The infrastructure supporting the attacks—particularly autonomous systems previously identified in other suspected Iranian cyber operations—provides corroborating technical evidence. The operational tradecraft itself mirrors known patterns from Gray Sandstorm (formerly tracked as DEV-0343), an IRGC-affiliated group with documented expertise in password-spraying campaigns targeting defense and critical infrastructure sectors.
## Technical Details
The campaign employed a methodical three-phase approach:
Phase One: Reconnaissance and Initial Access
Phase Two: Credential Validation and Pivot
Phase Three: Persistence and Exploitation
Infrastructure analysis connected the campaign to AS35758 (Rachamim Aviel Twito), an autonomous system that has appeared in multiple previous suspected Iranian cyber operations, providing a technical thread linking this activity to established Iranian operational infrastructure.
## Targeting Scope and Correlation
The breadth of this campaign extends beyond Israeli municipal government, though that sector bore the heaviest concentration of targeting attempts.
| Sector | Targeted Organizations |
|--------|------------------------|
| Technology | 63 |
| Transportation & Logistics | 32 |
| Healthcare | 28 |
| Manufacturing | 28 |
| Other sectors | 150+ |
What renders this campaign strategically significant is the documented correlation between attacked municipalities and Iranian missile strike targets. Municipal governments in Israel bear responsibility for coordinating damage assessment, emergency shelter provisioning, medical resource allocation, and public situational awareness during missile strikes. Compromising the cloud infrastructure that supports these communications functions could measurably degrade emergency response coordination during critical periods.
Beyond the immediate Israeli and Emirati targets, Check Point documented limited but noteworthy activity directed at organizations in Europe, the United States, the United Kingdom, and Saudi Arabia. This wider targeting envelope suggests either intelligence-gathering operations or establishment of persistent access for future campaigns.
## Strategic Implications
This campaign demonstrates the operationalization of hybrid warfare—the conscious integration of cyber and kinetic operations within a unified strategic framework. Rather than treating cloud intrusions and missile strikes as separate domains, Iranian planners appear to view them as complementary elements of a coordinated offensive.
The targeting methodology also reflects organizational learning. Iranian cyber operations have evolved substantially from early, relatively crude attacks. Modern Iranian campaigns now incorporate commercial infrastructure (VPNs, cloud services) to evade detection, demonstrate understanding of enterprise security architectures (legacy User-Agent strings, geographic restrictions), and maintain persistence through stolen credentials rather than relying on malware-based footholds that are easier to detect and remediate.
## Defense Recommendations
Organizations within high-risk sectors should prioritize:
## HackWire Analysis
This campaign illustrates a troubling evolution in state-sponsored cyber operations: the systematic alignment of digital intrusions with kinetic military action. While password spraying remains a relatively unsophisticated technique, its effectiveness scales with organizational size and complacency around credential hygiene. The attackers demonstrate operational maturity—rotating infrastructure, leveraging commercial VPN services for obfuscation, timing attacks to coordinate with military operations—that reflects state-level resources and strategic planning.
For defenders, the lesson is unambiguous: cloud environments now require the same assumption of active adversarial targeting as traditional on-premises infrastructure. The days of treating Microsoft 365 as inherently secure simply because it is cloud-hosted are definitively over.