ConflictClarifier

מעקב משבר איראן-המפרץ 2026
CC
Main
Live Data
Analytics
Tools
Reference
Events Archive
strikeApr 30, 2026

War Without Endpoints: Why Cyber Attacks Will Outlast the Iran Ceasefire

Summary

A sustained ceasefire isn’t likely to translate onto the digital battlefield. In 2026, conflict doesn’t pause just because the shooting does. It shifts. It burrows deeper into the systems most people never see but rely on constantly: the networks, infrastructure, and industrial controls that keep modern life functioning. If anything, a pause in open hostilities between the United States, Israel, and Iran could mark a transition into a more ambiguous and sustained phase of confrontation. The pace may feel slower. The visibility may drop, but the underlying activity rarely does. Cyber operations set the tone early in this conflict. Before missiles flew, networks were already under pressure. Iranian command and control systems were disrupted, communications were degraded, and situational awareness was narrowed at critical moments. The effect was immediate, but the longer-term consequence is more revealing. Systems can be rebuilt. Access, once established, is much harder to root out. Iran has long operated with that reality in mind. Its cyber posture is not built around a single centralized command structure. It functions more like an ecosystem: a mix of formal military units, established Iranian advanced persistent threat groups, and a rotating cast of loosely aligned actors who share tools, tactics, and occasionally objectives. That structure is resilient by design. It does not hinge on formal declarations or diplomatic timelines. Recent reports regarding the CyberAv3ngers group illustrate how far that model has evolved. What began as surface level disruption has developed into something far more capable. Targeting industrial control systems requires patience and technical familiarity with the machinery that runs water facilities, energy distribution, and municipal services. Gaining access to programmable logic controllers is not about spectacle. It is about positioning — the kind of positioning that can be used later, when timing matters more than visibility. The spread of those techniques adds another layer of complexity. Capabilities are no longer confined to a single group. They circulate. They get reused, modified, and redeployed. Disrupting one actor does not remove the underlying method. It simply forces it to reappear somewhere else, often with fewer fingerprints. That dynamic aligns closely with how advanced persistent threats operate. These groups do not move quickly unless they have to. They take their time, mapping environments, collecting credentials, and blending into normal activity. Access can sit dormant for months — in some cases, for years. By the time anything noticeable happens, the groundwork is already complete. Iran-affiliated groups have shown a consistent preference for that kind of approach. Their targets tend to be strategic rather than opportunistic: energy companies, logistics providers, telecom networks, defense contractors — the kinds of organizations that form the backbone of economic and operational continuity. A ceasefire does not interrupt that process. It simply changes the backdrop. The visible conflict cools, but whatever access has been established remains in place. Monitoring continues. Data collection continues. Decisions about when to act can be deferred without losing advantage. Alongside these more structured operations sits a different kind of activity that is harder to predict and even harder to contain. The surge in general hacktivism groups over the past several years eventually introduced a level of noise to this conflict that complicates everything. Some of these groups operate with limited sophistication. Others show signs of coordination and shared tooling. All of them benefit from a degree of separation that makes attribution difficult. Their motivations vary. Some are ideological. Some are opportunistic. Some blur the line between the two. What they have in common is a lack of constraint. Diplomatic agreements do not apply to them. A ceasefire does not carry much weight in a decentralized network of actors communicating across encrypted channels and operating from multiple jurisdictions. That creates a persistent layer of low-level disruption: website outages, denial of service attacks, phishing campaigns, probing attempts against exposed systems. None of it necessarily decisive on its own, but collectively it forces constant attention and response. It stretches defensive resources and introduces uncertainty into already complex environments. The broader geopolitical context only adds to that pressure. The patterns playing out in this conflict have echoes in the Ukrainian-Russia War, where cyber operations have been used alongside conventional military actions by both countries to target infrastructure and erode resilience over time. There, repeated attacks on energy systems and communications networks demonstrated how sustained pressure can wear down capacity without relying on a single major event. China’s approach operates on a different cadence but intersects in important ways. Its focus has been on longterm access, embedding within telecommunications networks through backdoors, cloud environments, and supply chains. That access does not need to be activated immediately to be valuable. In a period of heightened global tension, the opportunity to expand that footprint without drawing attention becomes more attractive. For organizations trying to defend against these overlapping threats, the environment becomes crowded quickly: different actors, different objectives, shared techniques, and limited clarity about who is responsible for endpoint security. The technical challenges are matched by the strategic ones. Most breaches still begin with familiar entry points: a well-crafted email that fits neatly into an existing workflow, a login page that looks just close enough to the real thing, or a piece of software that appears harmless during installation. These methods persist because they continue to work. In a geopolitical context, their impact extends beyond the initial compromise. A single set of credentials can open the door to something much larger. Access to one system can provide visibility into others. Over time, those small footholds can connect. The result is rarely immediate disruption. More often, it is a gradual accumulation of access and influence across systems that were never designed with this level of persistent threat in mind. So when the conversation turns to ceasefires and deescalation, it is worth paying attention to what is not changing. The underlying activity continues. The incentives remain. The infrastructure being targeted does not become less critical. The surface may look calmer. Underneath, very little stands still. Editor's Note: President Trump is leading America into the "Golden Age" as Democrats try desperately to stop it. Help us continue to report on President Trump's successes. Join PJ Media VIP and use promo code FIGHT to receive 60% off your membership.

Actors involved

Iran

Sources

  • Julio RiveraBy Julio Rivera

    A sustained ceasefire isn’t likely to translate onto the digital battlefield. In 2026, conflict doesn’t pause just because the shooting does. It shifts. It burrows deeper into the systems most people never see but rely on constantly: the networks, infrastructure, and industrial c…

See this event through different lenses

Compare how Western, Iranian, Israeli, Global South, and Pro-Peace perspectives frame this event.

Compare Perspectives

Community Notes

Community Notes

Loading notes...

Related events

strikeUnverifiedUSIsraelIran

US and Iran trade strikes as tensions escalate amid renewed conflict

○ 1 source

US and Iran trade strikes as tensions escalate amid renewed conflict - US Central Command has struck three Iranian oil tankers, including one near the Kharg Island export hub, after Iran's Islamic Revolutionary Guard Corps fired ballistic missiles at two US Navy vessels.

- Admiral Brad Cooper declared that the US would exact a higher economic cost for attacks on its ships, confirming that no American personnel were harmed during the strike. - Iran's Revolutionary Guard retaliated by threatening further attacks on US military ships, claiming to have targeted three US-linked vessels and three tankers navigating unauthorised routes in the Strait of Hormuz.

- The Iranian Red Crescent has requested an International Criminal Court investigation into a suspected US strike on an Iranian wedding that left at least five people dead, accusing Washington of war crimes. - The recent exchanges represent a dangerous deepening of the wider conflict between the US, Israel, and Iran, which has flared repeatedly since initial strikes in February.

Location: Iran
Dan Haygarth
strikeUnverifiedUSIsraelIran

Iran retaliates after US strikes oil tankers

○ 1 source

Iran said its forces attacked a US naval drone trying to enter the Strait of Hormuz, hours after targeting ships in retaliation for American strikes on three oil tankers. The latest round of clashes, which began with US raids last week, comes amid a deadlock in their six-month war.

Iran has maintained its stranglehold on the strategic Strait of Hormuz while Washington continues a counter-blockade of Iranian ports. Washington is also seeking to choke Iran's economy, rolling out sanctions on entities with financial links to the Islamic republic in a bid to force it into submission.

The Islamic Revolutionary Guard Corps, the ideological arm of Iran's military, said today that it "attacked an American military unmanned surface vessel" attempting to enter the strait, according to a statement carried by state television. Hours earlier, the IRGC said its naval forces "targeted three oil tankers on the unauthorised route of the Strait of Hormuz and three vessels affiliated with the child-killing America in other areas".

It warned ships not to attempt to transit by unapproved routes. Yesterday, US Central Command (CENTCOM), which oversees American military operations in the region, said it struck tankers linked to the Iranian Guards, accusing the most powerful arm of the Iranian military of unsuccessfully firing at American warships.

"Following Iran's failed attacks, CENTCOM permanently disabled the IRGC crude oil carriers M/T Downy off the coast of Kharg Island and M/T Stark 1 near Jask," it said. "American forces also completely destroyed the unladen crude oil carrier M/T Kylo ...

in the Gulf of Oman, striking the vessel in multiple critical locations to render it inoperable after the crew was directed to abandon ship," he said. Video posted by CENTCOM showed large fireballs and billowing flames after projectiles slammed into the ships.

The three vessels were "part of a multibillion-dollar shadow network that funds the IRGC and its regional proxies", it said. 'Higher economic cost' The IRGC meanwhile claimed the two American warships they targeted had been "forced to retreat" after "suffering damage", but CENTCOM said those ships successfully evaded Iranian attacks.

CENTCOM commander Admiral Brad Cooper said after the operation: "If you shoot at two of our ships, we will impose an even higher economic cost - taking out three of yours." The Iranian foreign ministry hit out at Washington over the strikes on oil tankers, calling them "illegal and aggressive actions".

A correspondent for Iranian state TV in Jask in the southern province of Hormozgan said one of the tankers was empty and the second was carrying oil. The crews were transported to shore on lifeboats, they said. Another state TV correspondent on Kharg Island said the attack there caused no casualties.

Iran's Khatam-al Anbiya central military command warned that if the US continued its attacks, then Tehran's retaliation against US warships would be "more severe than before, and there is a possibility of their expansion". The administration of US President Donald Trump has tried to downplay the significance of the six-month conflict, which has proven increasingly unpopular at home as midterm elections near.

US Vice President JD Vance went so far as to say that he "wouldn't call it a war". Mr Trump reiterated that view on Friday, calling the war "small potatoes" for Washington. Iran's Security Chief Mohsen Rezaei warned this week that the Islamic republic had adopted a "new strategy" against Washington that "will shatter your foundations".

The US has been trying to step up pressure on Tehran in a bid to wrestle control of the Hormuz strait, through which one-fifth of world oil supplies previously flowed. A fragile ceasefire between the two sides collapsed in July after attacks on commercial ships in the strategic waterway.

Mr Trump has in recent weeks repeatedly threatened to claim sovereignty over the strait, even posting a map showing it as "new US territory". Mr Vance has insisted the US will not reopen talks with Iran until it ends attacks on commercial shipping in Hormuz.

CurrentsAPI
strikeUnverifiedUSIsraelIranUN

Iran claims strike on US ship in Strait of Hormuz as fighting escalates

○ 1 source

CAIRO (AP) — Iran said Sunday it struck an unmanned U.S. vessel trying to enter the Strait of Hormuz, the latest salvo in a new flare-up of fighting between the two countries. The U.S. did not immediately confirm the purported attack, which came a day after the U.

S. military said forces struck three Iranian oil tankers in response to a missile attack on Navy warships. The war began with U.S. and Israeli attacks on Iran on Feb. 28. But since a ceasefire agreement was announced in June, on-and-off fighting has persisted with both sides trying to inflict military and economic pain as negotiations have collapsed.

Strikes come about a week after fighting resumed The U.S. and Iran resumed attacks last week, following a month of relative calm, with the Strait of Hormuz and Iranian communities along it again being targeted. At least five people were killed earlier in the week during a U.

S. bombardment of southern Iran. The Trump administration appears to have adopted a dual-prong approach to the conflict, responding militarily to attacks on the strait while going after foreign financial institutions that handle Iran’s money.

But Tehran's hard-line new senior leaders have signaled the willingness to dig in after weathering decades of sanctions. Iran has found ways over the years to circumvent sanctions, and now the U.S. blockade, and get its oil to buyers to help ease growing economic pressures.

That relies in part on a shadow fleet transporting its oil. Meanwhile, Iran's nuclear program, the issue that contributed to the outbreak of the war, was meant to be addressed in negotiations that fell apart soon after the U.S. and Iran signed a memorandum of understanding in mid-June.

Diplomats say the U.S., Britain, France and Germany seek to refer Iran to the U.N. Security Council for failure to comply with its nuclear nonproliferation obligations. Instead, Tehran's new leverage focuses on the Strait of Hormuz that is crucial to global oil and natural gas shipments and was seen as an international waterway before the war began.

___ Magdy reported from Cairo and Frankel reported from Jerusalem.

SAMY MAGDY and JULIA FRANKEL, Associated Press
strikeUnverifiedUSIran

Iran attacks naval drone near Hormuz after US strikes 3 oil tankers

○ 1 source

Iran attacks naval drone near Hormuz after US strikes 3 oil tankers The latest round of clashes, which began with US raids last week, comes amid a deadlock in the six-month war Iran said on Sunday that its forces attacked a US naval drone trying to enter the Strait of Hormuz, hours after targeting ships in retaliation for American strikes on three oil tankers.

The latest round of clashes, which began with US raids last week, comes amid a deadlock in their six-month war. Iran has maintained its stranglehold on the strategic Strait of Hormuz while Washington continues a counter-blockade of Iranian ports. Washington is also seeking to choke Iran’s economy, rolling out sanctions on entities with financial links to the Islamic Republic in a bid to force it into submission.

The Islamic Revolutionary Guard Corps, the ideological arm of Iran’s military, said on Sunday it “attacked an American military unmanned surface vessel” attempting to enter the strait, according to a statement carried by state television. Hours earlier, the IRGC said its naval forces “targeted three oil tankers on the unauthorised route of the Strait of Hormuz and three vessels affiliated with the child-killing America in other areas”.

Location: Iran
Agence France-Presse