Iran's Cyberattacks Primarily Target Israel, Microsoft Report Reveals

Israel was the main target of cyberattacks attributed to Iranian actors during the period studied by Microsoft, accounting for 39% of recorded incidents, according to the tech giant's annual Digital Defense Report released Thursday. The United States followed with 23% of attacks, and the United Arab Emirates with 9%. The report, covering July 2025 to June 2026, indicates an evolution in the methods used by groups linked to Tehran. Alongside espionage, there's an increasing focus on actions designed to disrupt or destroy systems, including data erasure and attacks on operational technologies. Microsoft also noted a growing combination of cyberattacks, military operations, and influence campaigns. Ransomware attacks against Israel specifically rose by 21% compared to the previous year. Microsoft suggests this shift might indicate Iran's use of ransomware as a hybrid warfare tool with political objectives. Iranian groups are also aiming to maintain long-term access to infiltrated systems for espionage and to prepare for future disruption operations. The research and higher education sectors were the primary targets of Iranian activity, facing 28% of the recorded attacks. Other targeted sectors included information technology (12%), transportation (11%), government organizations (8%), and research institutes and NGOs (8%). Attackers continue to exploit known security vulnerabilities, weak authentication mechanisms, and internet-exposed infrastructure to gain system access. Credential theft and phishing remain prevalent methods. Over 99% of initial observed intrusions into cloud environments utilized "Password Spray" attacks, which involve testing common passwords across numerous accounts. Yossi Karadi, Director of the Israeli National Cybersecurity System, stated that Israel is "on the front line of global threats." He added, "In cyberspace, you may not see missiles in the sky, but there is no ceasefire. The battle takes place 24 hours a day, seven days a week." Karadi also highlighted that the increasing use of artificial intelligence is accelerating the pace and scale of attacks, necessitating constant evolution of defense systems.