Shadow Networks: How Iran’s Cyber Army Laid Its Traps Before the Missiles Flew

In the dark recesses of the internet, the first shots of modern warfare are fired not with bombs, but with code. As US and Israeli missiles streaked toward Iranian targets on February 28, 2026, an invisible war was already well underway-one that had been meticulously prepared for months. While the world watched explosions on television, Iranian cyber operatives unleashed a barrage of digital attacks, their infrastructure primed and waiting.

Fast Facts

• Iranian government-linked hackers ramped up infrastructure activity for at least six months before the February 2026 strikes.
• Over 60 Iran-affiliated hacktivist groups coordinated attacks on American, Israeli, and Gulf state targets within days of the conflict’s escalation.
• Threat actors used multi-layered hosting networks-including shell companies and bulletproof hosts-to obscure their origins and evade takedown.
• Major groups like MuddyWater, OilRig, and Handala played key roles in pre-staging attacks and carrying out cyber operations.
• An “Electronic Operations Room” was established within 24 hours to coordinate hacktivist responses.

According to a recent study by Augur Security, Iranian state cyber units-linked to the Ministry of Intelligence and Security (MOIS) and the Islamic Revolutionary Guard Corps (IRGC)-dramatically increased their digital footprint in the months leading up to what Western militaries dubbed Operation Epic Fury. This wasn’t a spontaneous response. Instead, it was the culmination of a methodical buildup: new servers, new domains, and layers of shell companies stretching from Tehran to Wyoming to Dubai.

The infrastructure, analysts found, was anything but straightforward. First, Iranian ISPs like Sefroyek Pardaz Engineering provided the base. Next came bulletproof hosting providers-firms notorious for ignoring abuse complaints-such as Moldova’s ALEXHOST and the US-registered, Wyoming-based RouterHosting LLC. From there, further shell companies like Cloudblast (registered in the US, operated from Dubai, routed via the Netherlands) and UltaHost (with both US and UK registrations) added more layers of obfuscation, making attribution and takedown efforts a legal and logistical nightmare.

One group, MuddyWater, saw a burst of network activity in mid-September 2025, with its servers scattered across Russia, Estonia, and the UK-classic signs of pre-operational staging. Other familiar names from Iran’s cyber playbook-OilRig (APT34), Charming Kitten (APT35), and the wiper-centric Handala-joined the fray, each leveraging the new infrastructure to launch attacks or exfiltrate data.

When the kinetic strikes hit Iran, the digital counterstrikes followed almost instantly. Within a day, an “Electronic Operations Room” was coordinating more than 60 hacktivist groups, targeting not just Israel and the US, but also Gulf states seen as complicit. The focus: government, financial, and critical infrastructure systems. Despite damage to Iran’s own internet from the bombings, its cyber units-separate from the conventional military and fiercely loyal to the revolution-remained largely unscathed and operational.

The lesson is stark: in the age of hybrid conflict, bombs may break buildings, but cyber armies-if well-prepared-can weather the storm and strike back from the shadows.

Reflecting on the Digital Battlefield

Iran’s preemptive cyber preparations reveal the shifting landscape of modern conflict, where virtual infrastructure is as vital as physical defenses. As global tensions rise, the world’s digital frontlines are already bristling with silent arsenals, waiting for the next trigger.

WIKICROOK

• APT (Advanced Persistent Threat): An Advanced Persistent Threat (APT) is a long-term, targeted cyberattack by skilled groups, often state-backed, aiming to steal data or disrupt operations.
• Bulletproof Hosting: Bulletproof hosting is a web hosting service that ignores abuse reports, letting criminals host illegal or malicious content with little risk of takedown.
• Shell Company: A shell company is a business entity with no real operations or assets, often used to hide money flows or obscure the true owners of assets.
• ICANN: ICANN manages the global domain name system, allocates IP addresses, and accredits registrars to ensure internet stability and security.
• Wiper Operation: A wiper operation is a cyber attack that permanently deletes data from targeted systems, aiming to disrupt operations and cause significant data loss.