Iran Tripled Cyberattacks on Israel After the Ceasefire

Iranian cyberattacks on Israel tripled to about 4,800 hostile incidents in June 2026, Israel’s cyber chief said, up from about 1,600 in June 2025.

Brig. Gen. (res.) Yossi Karadi, director general of the Israel National Cyber Directorate, said critical systems had held so far. Law practices, accounting firms and other easier networks often had their computers wiped.

Hostile Incidents Tripled Between Two Junes

Karadi gave the two June counts in a June 29 interview, tying the jump to the 2026 U.S.-Israeli campaign against Iran. Both months sat inside open fighting, which is why the year-on-year rise is a measure of tempo, not a quiet interval gone bad.

THE JUNE COUNT AND THE YEAR BEHIND IT

The 1,600 and the 3,650 are not the same pile. Karadi’s figure is the Iran-tied hostile load he chose to put on the record. The 3,650 is every report that hit the 119 center during the 12-day war, a peak the directorate said ran 75% above the monthly average for the rest of 2025.

For the full year, the INCD issued about 2,480 alerts, 2.5 times the 2024 total, and 2,304 of those were proactive notices to organizations already in the crosshairs. Phishing made up 52% of the 26,500 reports. Influence and psychological operations were 13%, account breaches on mail, social and cloud were 11%, and system intrusions were 9%.

A Ceasefire on the Ground Left the Network Open

Karadi’s line about cyberspace was not color. Israeli planners already have a name for pressure that continues between declared rounds, and Iranian-aligned operators treated the lull the same way, as cover rather than a stop.

FROM THE 12-DAY WAR TO THE OCTOBER TALLY

1. June 2025: Israel and Iran fight a 12-day war. The INCD logs 3,650 reports that month, and Karadi later counts about 1,600 hostile incidents.
2. January 27, 2026: Karadi speaks at Cybertech in Tel Aviv after warning that month that a faster cyber war is already close.
3. 2026 U.S.-Israeli campaign: A second kinetic round opens against Iran. Karadi later says the Iranian cyber load jumps with it.
4. May 2026: Incident responders document a destructive break-in at an Israeli food plant, with refrigeration controllers rewritten and a disk wiper staged on the business network.
5. June 29, 2026: Karadi puts the 4,800 figure on the record and says there is no ceasefire in cyberspace.
6. October 1, 2026: Microsoft publishes its Digital Defense Report for July 1, 2025 through June 30, 2026, ranking Israel second worldwide.

During the June 2025 fighting, IRGC-linked hacker collectives in the 12-day war moved in step with the air campaign, mixing phishing, leaks, propaganda and malware rather than waiting for a separate digital phase. The pattern did not cool when the explosions did.

Why Law Firms Are Easier to Wipe Than the Grid

Karadi said attacks went after critical infrastructure, large central organizations, small and medium firms, and the public. He named law practices and accounting firms among the smaller ones hit, and he said companies that were easier to break into often had their systems deleted. He did not name those companies.

WHERE THE DAMAGE ACTUALLY LANDED

• The grid and other critical kit: Karadi said Israel had fended off those attacks so far, and he added that he hoped that record holds.
• Law and accounting offices: He listed both as smaller targets, the kind of firm that holds client files and is rarely built like a power company.
• Cloud clients: The 2025 INCD year review includes the deletion of servers that belonged to cloud computing customers.
• A hospital: The same review cites an attempt to disrupt Shamir Medical Center on Yom Kippur.
• A food plant: Attackers rewrote refrigeration controllers, pinned valves open, and wrecked compressors while a wiper sat on the Windows side.
• Journalists: In mid-August 2026, the Shin Bet and the INCD warned that suspected Iranian intelligence operatives were approaching reporters on WhatsApp and Telegram with fake interview offers meant to steal logins.

That split is the second war. Israel already forces a high bar on bodies it designates as critical. Hospitals, professional offices and plants sit outside that fence, and that is where a wipe finishes the job. In May 2026, Profero’s responders described industrial refrigeration sabotage under a ceasefire at a food plant: setpoints and safety limits were changed, motorized valves were switched to manual and held open, three compressors were destroyed, and a Go-based implant staged as a Microsoft update waited for a command to overwrite disks. Recovery on the newer controller meant tracing the panel from the schematic and rebuilding the program, work that ran for days.

Microsoft Now Ranks Israel Second Worldwide

On October 1, 2026, Microsoft’s Digital Defense Report put Israel at 7.6 percent of global cyber activity for the year that ran from July 1, 2025 through June 30, 2026, second only to the United States at 25.5%. Ukraine was at 4.8% and Taiwan at 3.9%. The June 4,800 figure was not a one-month spike that then faded. It sat inside a year in which Israel absorbed a larger share of the world’s measured attacks than every country except one.

WHAT MICROSOFT COUNTED IN THAT YEAR

• Iran’s aim: Israel took 39% of operations Microsoft tied to Iranian actors, ahead of the United States at 23% and the UAE at 9%, with Egypt and India at 6% each.
• Ransomware: Incidents against Israeli organizations rose 21% year on year, even as Microsoft’s global ransomware count fell about 3%.
• Sectors under Iranian ops: Research and academic targets were 28%, information technology 12%, transportation 11%, and government bodies 8%.
• The front door: More than 99% of the initial cloud intrusion attempts Microsoft observed used password spraying, testing common passwords across large batches of accounts.

Karadi, asked about those findings, said Israel was on the front line of global threats and that operational continuity under that load should not be taken for granted. He said the fight runs 24 hours a day, seven days a week, and that growing use of artificial intelligence speeds attacks and widens their reach. Microsoft’s own report, drawing on more than 165 trillion security signals a day, describes nation-state work blending with crime shops, including ransomware used for political ends rather than only for payouts.

What Iran’s Multi-Layered Cyber Machine Looks Like

Karadi called Iran’s apparatus a multi-layered system. At the core, he said, the Iranian military and the Islamic Revolutionary Guard Corps each run full cyber warfare divisions. Below that sit civilians and activists who hack out of conviction or who are paid to do it. “Some groups are very skilled,” he said. “We can handle them, but we have to take them seriously.”

Unlike in the kinetic realm, there’s no ceasefire in cyberspace.

Yossi Karadi, director general, Israel National Cyber Directorate

He also treated digital propaganda as part of the same war, including Lego-style AI animation videos pushed on official Iranian accounts. The cartoons are not a side hobby. They are the public half of a machine that also deletes disks. Karadi said the hacking groups are coordinating more closely than before, sharing intelligence, infrastructure and techniques, and that Tehran has brought in ransomware gangs and hackers outside Iran to thicken the roster.

That mix matches what private responders have been pulling off live networks. Profero ties a persona calling itself Cyber Isnaad Front to Aria Sepehr Ayandehsazan, the IRGC-linked successor to Emennet Pasargad, and says the public leak site is the marketing while the intrusions do the harm. Gambit Threat Intelligence, looking at a late March and early April 2026 campaign claimed by a persona named Ababil of Minab, found exfiltration in the United States, Israel, Saudi Arabia and Turkey, plus destruction of backups and recovery systems at a subset of victims, on infrastructure it says overlaps a cluster the INCD has already tied to Iran’s Ministry of Intelligence. The point of hitting backups is simple. A firm that can restore from last night’s copy is annoyed. A firm that cannot restore is closed.

Karadi’s Cloud, AI and Quantum Plan Runs to 2030

Karadi said he is building a multi-year plan with three main focuses, and that he wants it operational by 2030.

THE THREE STACKS ON THE CALENDAR

• Cloud security: The layer where password spraying and stolen logins now start so many of the intrusions Microsoft is counting.
• Cyber and AI: The same tools that Karadi says are already speeding attacks, used on the defense side before the next jump in volume.
• Quantum computing: A later bet on cryptography and processing, years after law offices and plant floors have already been wiped.

The directorate’s 2025 review had already put his no-ceasefire warning in writing. “Every organization, system, and citizen is a potential target for attacks aimed at disrupting operational continuity and national resilience,” Karadi said then. The 4,800 figure is what that sentence looks like as a monthly count. The 2030 date is the earliest he would call the new stack ready.

Until then the grid can keep holding while a bookkeeper’s server, a lawyer’s file store, or a cold room’s controller takes the blow that never shows up as a missile. In one plant the first alarm was not a cyber dashboard. It was a temperature reading, and the people who knew how to fix the machines found that someone had already changed the passwords and opened the valves.