Microsoft Report: Iran Targeted Israel in 39% of Cyberattacks

A new report from Microsoft reveals that Iran directed 39% of its cyberattacks towards Israel in the second half of 2026. This places Israel as the primary target for Iranian cyber threats, significantly ahead of the United States (up to 23%) and the United Arab Emirates (up to 9%). The report, which covers incidents between July 2025 and June 2026, indicates that Iran expanded its targets and integrated cyber activities with military and influence operations to amplify its strategic messages.

During this period, regional conflicts led to an increase in disruptive and destructive cyber activities, including data deletion and attacks on operational technologies. Microsoft noted that Iranian actors also continued efforts to gain long-term access to systems for espionage and future disruption. Ransomware attacks against Israel saw a 21% increase compared to the previous year, potentially reflecting Iran's use of ransomware as part of a hybrid warfare strategy.

The report highlights that Iranian activity continues to focus on sectors with intelligence and strategic value. Research and academia constituted 28% of targets, followed by information technology (12%), transportation (11%), government bodies (8%), and research institutes and NGOs (8%). Iranian actors exploit known security vulnerabilities, weak authentication, and internet-exposed systems, with credential theft and phishing remaining primary access methods.

Microsoft observed a convergence in the tactics of various Iranian attack groups, increasing their operational scope and impact. Digital identity remains a key vulnerability, with over 99% of initial cloud intrusion attempts relying on password spraying. The report emphasizes that cyber defense must extend beyond malware blocking to continuous identity protection, strong authentication, anomaly monitoring, and rapid threat response.

Yossi Kardi, Head of the National Cyber Directorate, stated that Israel is engaged in an intense cyber battle and is at the forefront of global threats. He stressed that Israel's ability to maintain functional continuity under such threats is a result of an integrated national defense system involving various government bodies, the economy, the cyber industry, and global companies. Kardi added that the cyber arena operates 24/7 without a ceasefire, and the increasing use of artificial intelligence accelerates attack speed and expands their scope, necessitating continuous development of advanced capabilities and national resilience.