Google's Threat Intelligence Group issued an alert on March 2, 2026, stating that Iranian state-affiliated actors and aligned hacktivist collectives have launched a coordinated cyber campaign targeting entities in Israel, Gulf Cooperation Council countries, and locations in Europe and North America. The activity correlates with the start of joint U.S.-Israeli military operations — designated Operation Roaring Lion (U.S.-led) and Operation Epic Fury (Israeli-led) — both initiated on February 28, 2026.

Between February 28 and March 1, CloudSEK documented more than 150 hacktivist-claimed incidents across public channels — primarily DDoS attacks, website defacements, and data-exfiltration operations against government, financial, aviation, telecommunications, and critical-infrastructure sectors. Google also identified increased scanning and reconnaissance from known Iranian-linked IP ranges targeting energy, finance, and transportation sectors in the region and beyond.

No confirmed successful intrusions into critical operational technology systems have been publicly disclosed as of March 2, 2026.

Situation Summary: 150+ hacktivist incidents in 72 hrs • DDoS peaks at 1.2 Tbps (Cloudflare) • Google, Mandiant, Cloudflare & Microsoft all issued alerts • No confirmed OT/SCADA compromise as of March 2, 2026 • Tied to Operations Roaring Lion & Epic Fury (Feb 28, 2026).

Timeline of Reported Cyber Activity

Cyber activity escalated immediately following the first reported military strikes on February 28, 2026:

{timeline.map((item) => (

{item.date} — {item.source}

{item.event}

))}

Key Tactics Observed in the Campaign

The majority of activity follows patterns previously associated with Iranian state actors and affiliated hacktivist groups:

DDoS attacks — Volumetric floods targeting government portals and financial exchanges, with peaks exceeding 1.2 Tbps in isolated cases (Cloudflare Radar, Feb 28–Mar 1)
Website defacements — Replacement of homepages with political messaging on regional airline, bank, and ministry sites (Zone-H archive, Mar 1)
Data-exfiltration claims — Public releases of alleged stolen documents from energy and telecom firms; authenticity remains unverified in most instances
Reconnaissance scans — Increased port scanning and vulnerability probing from Iranian ASNs against OT/SCADA environments in Gulf states (Google Threat Intelligence indicators)

Affected Sectors and Geographic Scope

CloudSEK's March 1 report broke down the claim distribution by both geography and sector. Israel accounted for the largest share of targeted entities, while government and finance were the most frequently hit verticals.

Geographic Distribution

{geo.map((g) => (

{g.label} {g.pct}

))}

Sectors Targeted

{sectors.map((s) => (

{s.label} {s.pct}

))}

Notable targets included regional stock exchanges, national airlines, central banks, port authorities, and power grid operators across the affected regions.

Google and Industry Threat Assessments

Four major cybersecurity firms published or updated threat intelligence briefs between March 1–2, 2026:

{assessments.map((a) => (

{a.icon} {a.firm}

{a.finding}

))}

Google's alert specifically highlighted elevated activity from groups previously linked to Iran's Islamic Revolutionary Guard Corps (IRGC) cyber units, the use of commodity tools for initial access combined with custom wipers in select operations, and — crucially — no evidence of successful OT compromise at time of publication.

Broader Context: Historical Comparisons

The current campaign volume significantly exceeds prior escalation periods tied to Iran-related tensions:

{[ { period: '2020', context: 'U.S.–Iran tensions post-Soleimani', volume: '~200 incidents total', highlight: false }, { period: '2024', context: 'Regional flare-ups (avg weekly)', volume: '80–120 claims/week', highlight: false }, { period: 'Feb 28–Mar 1, 2026', context: 'Operations Roaring Lion & Epic Fury', volume: '150+ in 72 hours', highlight: true }, ].map((row, i) => ( ))}

Period	Context	Volume
{row.period}	{row.context}	{row.volume}

The 150+ incidents in 72 hours exceeds the prior weekly average from similar escalation periods in 2024, suggesting a more coordinated and rapid mobilization of hacktivist infrastructure — though elevated claiming volume does not necessarily equate to elevated real-world impact.

Related Coverage — Google & Tech Security

{[ { href: '/google', label: '🔵 Google 2026 Hub', desc: 'Gemini, AI Search & Alphabet strategy' }, { href: '/google/agentic-vision', label: '🤖 Google Agentic Vision', desc: "Google's AI agent roadmap" }, { href: '/google/waymo', label: '🚗 Waymo Coverage', desc: 'Autonomous vehicle updates' }, { href: '/tech', label: '💻 Tech News Hub', desc: 'All technology coverage on ObjectWire' }, ].map((link) => ( {link.label} {link.desc} ))}

“When state-backed hackers claim 150 incidents in three days but critical systems stay online, the real impact often measures in press releases rather than blackouts.”