No Ceasefire on the Internet: A Prolonged Cyber Confrontation Between Israel and Iran
Despite the ceasefire agreement ending the war, the confrontation between Israel and Iran continues in a battlefield far removed from missiles and fighter jets: the Internet and cyberspace.
Yossi Karadi, Director General of Israel’s National Cyber Directorate, said in an interview with the German newspaper Die Welt, that the number of cyberattacks launched by Iran against Israel has increased sharply since the outbreak of the U.S.-Israeli war against Tehran earlier this year.
Karadi told the newspaper that the Israeli authorities had “recorded approximately 1,600 hostile cyber incidents in June 2025 during Israel’s military operations against Iran.”
He stated that the figure rose during the same month in 2026 to around 4,800 incidents, despite the ceasefire remaining in effect.
Karadi added: “Some groups possess highly advanced capabilities. We are able to deal with them, but we must take them very seriously. Unlike conventional military warfare, there is no ceasefire in cyberspace.”
He noted that the attacks targeted systems used by Israel’s critical infrastructure, major institutions, small and medium-sized enterprises, as well as private individuals.
He also said that law firms and accounting firms were among the smaller organizations that had come under attack.
He continued: “So far, we have succeeded in repelling attacks against our critical infrastructure, and we hope we will continue to be able to do so.”
He added that, in most cases, the attacks resulted in the wiping of computer systems belonging to companies that were relatively easy to penetrate, without mentioning any specific names.
“A Multi-Layered Hacking Structure”
Speaking about the organizational structure of Iranian hackers, Karadi explained: “It can be viewed as a multi-layered system. Cyberattack groups operating within Iran’s security establishment and the Islamic Revolutionary Guard Corps constitute the core of this structure.”
He continued: “They are supported by civilians who engage in hacking either out of ideological conviction or in exchange for payment. Another layer consists of activists seeking to harm Israel by attempting to influence public opinion through their cyber campaigns.”
According to the same source, Tehran also seeks to recruit cyber groups from abroad. In some cases, these groups are extortion gangs known as “malware groups,” which typically infiltrate corporate computer systems and then demand ransom payments in exchange for restoring access to those systems.
