strikeMar 18, 2026

Every Fortune 500 CEO's nightmare: the Iran War and the Pandora's Box of AI cyber warfare | Fortune

Summary

When U.S. and Israeli forces launched a sweeping air and sea campaign against Iran’s military infrastructure in late Feb. 2026, the missiles weren’t the only weapons that flew. Within hours, more than 60 Iranian-aligned cyber groups mobilized, according to Palo Alto Networks’ Unit 42, armed with AI-assisted reconnaissance tools and a mandate to strike back where it hurts most: America’s corporate nervous system. Within hours, cybersecurity agencies in the UK and Canada both warned about heightened threat levels, followed by similar warnings from Europol and the Department of Homeland Security. For Fortune 500 CEOs, the message couldn’t be clearer—or more unsettling. The Iran war has blown open a Pandora’s box of AI-powered cyber warfare, and no firewall, no matter how expensive, was built for what’s coming next. A new attack template Iran’s cyber playbook has already claimed its first major corporate victim. Iranian-aligned hackers disrupted operations at U.S. medical technology giant Stryker, as first reported by the Wall Street Journal and confirmed by the company—a sobering signal that the private sector is squarely in the crosshairs. According to threat intelligence firm Flashpoint, the Iranian-aligned hackers executed a sophisticated “no-malware” attack on Stryker—not through traditional malicious code, but by weaponizing Microsoft Intune, a legitimate cloud-based endpoint management service, to remotely wipe devices across the company’s network. The attack has sent a chill through every corporate IT department in America: the tools used to manage your own infrastructure can now be turned against you. The more chilling template, analysts warn, isn’t the conventional data breach—it’s a coordinated campaign designed to destroy institutional trust from the inside out. Iran’s state-backed hacking groups, including Void Manticore aka Handala, have already deployed ransomware-style attacks, distributed denial-of-service operations, and “wiper” attacks engineered to permanently erase data from corporate servers. These aren’t smash-and-grab operations. They are psychological warfare at enterprise scale. According to Flashpoint, the Handala Hack Team claimed responsibility for breaching a Mossad “secret treasury,” allegedly leaking 50,000 confidential emails. In a chilling escalation, the group also claimed to have identified the precise geographic coordinates of a target through cyber reconnaissance—and that a kinetic missile strike followed. Cyber and physical warfare, in other words, are no longer separate domains. “Aggressive and creative resistance is baked into the ethos of the Iranian security apparatus,” Brian Carbaugh, co-founder and CEO of AI-based security firm Andesite and a former director of the CIA’s elite Special Activities Center, previously told Fortune. “For business leaders and those protecting businesses and making decisions at a very high level, they need to be prepared for this to continue on for some time and for the conflict to take a number of different courses of direction and swerve around the road.” AI as the great equalizer—and the great threat multiplier What separates this conflict from previous cyber flashpoints is the role of artificial intelligence (AI) on both sides of the battlefield. U.S. and Israeli forces have used AI platforms from Palantir and the Pentagon’s Maven Smart System to execute more than 15,000 strikes since the war began—over 1,000 per day—with remarkable precision, according to security columnist Shimon Sherman of the Jewish News Syndicate. AI has compressed the military “kill chain” from days to minutes, he added. (Iran, for it’s part, has used its firepower to target data centers in the UAE). But cybersecurity firm CloudSek argued in a blog post that the same compression is now available to Iran’s proxies—and to any hacker group with a laptop and access to an AI reconnaissance pipeline. AI tools have sharply lowered the barrier to identifying and exploiting exposed industrial control systems, default credentials, and internet-facing corporate infrastructure across America. Threat groups with no prior industrial control systems background are now, effectively, sophisticated actors overnight. Flashpoint said the 313 Team, an Iranian-aligned Cyber Islamic Resistance group, claimed a complete shutdown of the official British Army website—a clear signal that state-adjacent institutions and critical government infrastructure are primary targets. The defender is already behind What makes the current threat environment uniquely dangerous for corporate America is the simultaneous convergence of physical and cyber disruption. On March 17 alone, a drone strike on the Fujairah oil hub in the UAE halted refining operations; a Kuwaiti-flagged LNG tanker was damaged by drone debris near the Strait of Hormuz; and the U.S. Embassy in Baghdad suffered its heaviest attack since the war began. These are not abstract geopolitical events—they are direct shocks to the energy supply chains that power global commerce. “The conflict has entered a stage where the economic and operational impacts are becoming much more visible,” said Josh Lefkowitz, CEO of Flashpoint, in a statement issued Wednesday. “We’re seeing disruption at major transportation hubs, pressure on global shipping routes, and cyber activity targeting private companies already creating ripple effects across supply chains, travel, and day-to-day commercial operations. For organizations connected to the region, the risk environment now includes simultaneous physical disruption and cyber activity.” The timing couldn’t be worse for corporate America. The Cybersecurity and Infrastructure Security Agency (CISA)—the federal government’s primary cyber defense body—is hobbled by furloughs, a leadership reshuffle, and the lingering effects of a partial government shutdown. The cavalry, in other words, is understaffed and reorganizing. Meanwhile, Iran’s own command structure has been decimated by allied strikes—including the elimination of Ali Larijani and Gholamreza Soleimani, commander of the Basij paramilitary unit—which, paradoxically, makes the threat more dangerous, not less. “The Iranian leadership vacuum is likely going to lead to more unpredictable, decentralized proxy attacks,” Kathryn Raines, a former NSA expert who is now a threat intel team lead at Flashpoint, told Fortune‘s Amanda Gerut. Decentralized means harder to anticipate, harder to attribute, and harder to stop. President Trump has also accused Iran of weaponizing AI for disinformation, allegedly collaborating with media outlets to shape narratives around the conflict. Corporate reputations—not just networks—are now targets. The boardroom imperative Every Fortune 500 CEO sitting in a board meeting this week faces the same stark reality: the Iran war has permanently altered the cyber threat landscape. AI hasn’t just made attacks faster—it has made them cheaper, stealthier, and accessible to a sprawling ecosystem of state proxies and opportunistic hacktivists who share the same AI-assisted toolkit. The Pandora’s box is open. The question isn’t whether the next major attack on a U.S. corporation is coming—it’s whether the C-suite will be ready when it does. Additional reporting contributed by Amanda Gerut.

Actors involved

USIsraelIranProxy

Sources

Nick LichtenbergBy Nick Lichtenberg
When U.S. and Israeli forces launched a sweeping air and sea campaign against Iran’s military infrastructure in late Feb. 2026, the missiles weren’t the only weapons that flew. Within hours, more than 60 Iranian-aligned cyber groups mobilized, according to Palo Alto Networks’ Uni…

See this event through different lenses

Compare how Western, Iranian, Israeli, Global South, and Pro-Peace perspectives frame this event.

Compare Perspectives

Community Notes

Loading notes...

Related events

Jul 21, 2026strikeUnverifiedUSIranProxy

IEA says Mideast fighting increases energy concerns

○ 1 source

PARIS: The head of the International Energy Agency said on Tuesday (Jul 21) that renewed fighting in the Mideast increases concerns over energy supplies but that the market still has cushions to absorb the impact. "The escalation in hostilities affecting the Strait of Hormuz and energy infrastructure in the region increases security of supply concerns and uncertainty over the market outlook," IEA Executive Director Fatih Birol said in a statement.

"For the moment, crude oil markets continue to benefit from several cushioning factors," he added, pointing to increased exports from several countries and Saudi and United Arab Emirates oil reaching markets by alternative routes. However, Saudi Arabia's main alternative route of using a pipeline to load tankers in the Red Sea port of Yanbu is under threat as Iran's Yemeni allies, the Houthis, declared they would blockade Saudi Arabia's ports.

Oil markets have for months feared that the Houthis would return to attacking shipping in the Red Sea and Gulf of Aden - as they did during the Gaza war - cutting off yet more crude from global markets. The initial market reaction to the announcement by the Houthis was restrained, however, as Iran indicated that mediation efforts were still underway, calming investor jitters.

"Threats to the Bab el-Mandeb Strait, which has become increasingly important as a route to bypass the Strait of Hormuz, exacerbate these concerns further," said Birol, referring to the narrow passage between the Red Sea and Gulf of Aden. The IEA, in addition to advising its industrialised nation members, also helps them coordinate the release of their strategic oil reserves in reaction to market disruptions.

Birol noted that ongoing government releases from these reserves have provided considerable relief to markets, and that nations continue to hold ample reserves. However, he warned "there is no room for complacency on oil security" and pointed to a drawdown of available commercial inventories, with low refining activity contributing to a tighter supplies of refined oil products like petrol and diesel than for crude oil.

Birol noted that additional supplies of liquefied natural gas from the United States and Canada have offset about 70 per cent of lost supply via the Strait of Hormuz. However, further delays in resuming Gulf exports "will be felt by all LNG importers, including Europe as it looks to refill its gas storage for next winter", he warned.

CurrentsAPI

Jul 21, 2026strikeUnverifiedUSIsraelIranProxyEURussiaChina

Futures Jump As Chipmakers Surge After Japan , Korea Bounce

○ 1 source

US stock futures rose, with Nasdaq futures gaining 1.4% and S&P futures up 0.5% as of 7:20 a.m. ET, led by semiconductor stocks after gains in Japan and South Korea. A report indicated TSMC plans price increases, while overnight events included a Houthi-imposed blockade on Saudi Arabia amid tensions involving Iran.

Trading showed higher commodity prices, a steeper yield curve, and a flat dollar, with upcoming data releases including the ADP weekly employment change and Philadelphia Fed non-manufacturing index.

Location: Arak

Tyler Durden

Jul 21, 2026strikeUnverifiedUSIranProxy

US-Iran Fighting Enters 10th Day As Tanker Hit In Hormuz, Houthis Threaten Red Sea Chokepoint

○ 1 source

Reports indicate ongoing US-Iran tensions into a tenth day, including a tanker strike in the Strait of Hormuz and Houthi threats to Red Sea shipping. US Central Command conducted strikes on Iranian command, missile, and air defense sites, while Reuters reported mediator proposals for a 10-day ceasefire and statements from both sides outlining conditions for halting attacks.

Bloomberg data showed Hormuz transits reduced to six vessels as of Tuesday morning.

Location: Red Sea

Tyler Durden

Jul 21, 2026strikeUnverifiedUSIsraelIranProxy

US strikes Iran for 10th consecutive night as Tehran strikes tanker in the Strait of Hormuz

○ 1 source

DUBAI, United Arab Emirates (AP) — Iran attacked a tanker in the Strait of Hormuz early Tuesday, forcing its crew to abandon the ship, while the United States conducted yet another round of airstrikes targeting the Islamic Republic as they struggle over control of the key waterway.

The 10 consecutive nights of U.S. airstrikes haven’t compelled Tehran to loosen its grip on the strait, through which about a fifth of all crude oil and natural gas traded once passed in peacetime. Even as the U.S. and Iran inch closer to all-out war again, Iran’s interior minister traveled to Pakistan, a key mediator in the conflict, for talks.

However, it remains unclear just what new deal could be reached to end the fighting. The interim deal signed last month that was meant to end the fighting has crumbled. Shipping through the Strait of Hormuz has largely stalled. And as fighting intensifies, both sides have targeted civilian infrastructure relied on by millions of people.

“Iran and groups supportive of Iran may target other U.S. interests overseas or at locations associated with the United States and Americans throughout the world,” the U.S. State Department said in a new warning to Americans. The escalation has pushed oil prices higher in recent weeks.

Benchmark Brent crude traded Tuesday above $88 a barrel and regular gasoline in the U.S. climbed to an average of $4 a gallon, keeping pressure on Americans’ wallets ahead of midterm elections this fall. Meanwhile, the U.S. military identified two soldiers who were killed in Jordan in attacks that left a third person missing.

Separately, the military confirmed another death in Iraq on Saturday during the “controlled detonation” of a downed Iranian drone. President Donald Trump took to social media on Monday to warn that “Every time Iran kills an American Soldier they will pay for that killing many times over!

” Trump was planning to attend a ceremony on Tuesday evening at Dover Air Force Base, where at least one service member’s remains were due to arrive. US strikes come as ships attacked The U.S. military’s Central Command said Tuesday it targeted “Iranian military command centers, maritime capabilities, missile and drone launch sites and air defense systems.

” It released more footage of bombings that targeted sites in Iran. “American forces remain postured and prepared to hold Iran accountable for unwarranted aggression toward civilian mariners seeking to freely and openly transit the strait,” the command said.

Iranian state media reported that explosions were heard in Fars, Hormozgan, Ilam, Kerman and Sistan and Baluchistan provinces. However, traffic through the strait has slowed to a crawl during the latest violence. Lloyd's List Intelligence said only three ships transited the strait on Sunday.

The British military’s United Kingdom Maritime Trade Operations center said a tanker came under attack early Tuesday in the strait off Oman, forcing the crew to abandon the vessel. Iran’s paramilitary Revolutionary Guard claimed the attack, as well as two other attacks on ships Monday in the waterway.

The route around Oman has been the one the U.S. military has encouraged ships to travel to avoid Iran’s control. The UKMTO separately reported Tuesday that another previously unknown attack on a ship took place early the previous day. Tehran also hit U.

S.-allied countries throughout the Middle East. Jordan military's said Tuesday that Iran targeted it with five drones and three missiles, all of which were shot down. Bahrain sounded its missile alert sirens Tuesday afternoon as another Iranian barrage targeted the island kingdom, which is home to the U.

S. Navy's 5th Fleet. Nearly 100 US injuries since early July The Pentagon’s chief spokesperson said nearly 100 U.S. service members have been injured since the U.S. restarted strikes on July 7, and 96% of them have returned to duty.

“The vast majority of injuries experienced were minor concussions,” Sean Parnell posted Monday on X in response to a New York Times report that the Pentagon has withheld information about troop injuries from Iranian strikes. He denied that the Pentagon was hiding data about injuries.

However, the Defense Casualty Analysis System, the military’s clearinghouse for reporting deaths and injuries in conflict, has not been updated as of Monday night with the latest attacks. Yemen rebels threaten attacks on other Mideast waterway Yemen’s Houthi rebels announced a maritime embargo against Saudi Arabia on Monday.

The Houthis, who are backed by Iran, said they would block shipping between the Red Sea and the Gulf of Aden by targeting the Bab el-Mandeb, a maritime chokepoint like the Strait of Hormuz, in response to an attack on Sanaa International Airport last week that they blamed on Saudi Arabia.

With the Strait of Hormuz blocked, Saudi Arabia has been relying on a pipeline to the Red Sea to get millions of barrels of oil out to market. The Houthis earlier demonstrated their ability to disrupt shipping there when they targeted ships for months over the Israel-Hamas war in Gaza, with over 100 vessels attacked.

Saudi Arabia’s military said it would keep the waterway open. “All Houthi threats against transiting vessels will be dealt with swiftly and firmly, as such threats are a blatant violation of international law and fall under acts of maritime piracy,” said Maj.

Gen, Turki al-Malki, a Saudi military spokesman. A glimmer of hope for diplomacy Pakistan has intensified diplomatic efforts in recent days to resuscitate the interim deal. Iranian Interior Minister Eskandar Momeni arrived in Islamabad on Monday for two days of talks with Prime Minister Shehbaz Sharif and others.

On Sunday, U.S. Secretary of State Marco Rubio told reporters that the U.S. is still open to negotiating with Iran but that “it has to be real.” “If the door opens to diplomacy — if the guys that want to do something productive for Iran win and take control of that system, or take control of the negotiations — that’ll be a very positive development,” Rubio said.

“That’s not where we are tonight, unfortunately.” Iranian authorities on Sunday said at least 50 people have been killed and 517 wounded in the latest rounds of U.S. strikes. Since the war began on Feb. 28, 17 U.S. service members have been killed.

JON GAMBRELL, Associated Press