As the conflict in the Middle East continues to intensify there are warnings that Iran is likely to move to cyber warfare as the stakes continue to rise.

Cyber risk analytics company CyberCube has warned the United States and Israel’s military strikes against Iran raise the odds of retaliatory activity in cyberspace.

It added to date there has been no confirmed specific counter-cyberattack by Iran or affiliated groups that directly ties back to the operation. However, security community commentary has warned that Iran-aligned actors could carry out cyber operations, including ransomware, against US or allied targets in retaliation.

It comes as the conflict has intensified with Iran’s missile and drone attacks encompassing new nations which house USA military bases and the sinking of an Iranian warship off the coast of Sri Lanka by an American submarine.

Hopes of an early end to the conflict have diminished with military experts saying they believe the resilience of the Iranian regime significantly greater than had been envisaged.

CyberCube has analysed a portfolio of approximately 1,000 large-sized US companies, segmenting them into risk tiers based on their exposure to threat groups known as APT33, MuddyWater, and Fox Kitten – three of the most active and well-documented Iranian state-aligned groups targeting U.S. enterprises and critical infrastructure.

CyberCube’s analysis has been conducted through Portfolio Threat Actor Intelligence (PTI), which harnesses AI to map the behaviour of cyber threat actors and the technologies they most frequently target. It has identified 12% of large-sized U.S. firms with revenues over $1 billion across seven critical industries – Banking, Financials, Energy & Utilities, Oil & Gas, Healthcare, Telecommunications, and the Public sector – as facing the highest likelihood of being targeted by Iranian cyber threat actors. Among them are 28 U.S. health organizations and 13 U.S. energy and utilities companies.

The analysis added: “For cyber insurers, this is a moment to move beyond routine portfolio risk monitoring and towards adopting a proactive posture across underwriting and exposure management operations to account for heightened risk from specific Iranian cyber threat actors.

William Altman, CyberCube’s director of cyber threat intelligence services said: “Insurance carriers should anchor expectations in Iran’s observed cyber playbook. US government guidance has repeatedly warned that Iranian government-affiliated cyber threat actors target poorly secured networks and internet-connected devices, and that heightened vigilance is warranted for U.S. critical infrastructure and entities of interest.”

He added This could include organisations in the Defence Industrial Base, government, banking and financial services, healthcare, telecommunications, and energy and utilities.

It added: “Taken together, the risk is not simply espionage or ransomware in isolation, but a hybrid model in which access operations, criminal monetization, and strategic objectives can intersect. For (re)insurers, the implication is that espionage and extortion are not cleanly separable risk categories when it comes to Iranian cyber threat actors. The same credential theft or vulnerability can support intelligence objectives one day and monetization or destruction the next, especially during periods of armed conflict.

“With the increased AI capabilities available today, state-aligned threat actors, including those linked to Iran, are reported to be using commercial AI models such as Google’s Gemini to support various parts of their cyber operations. According to Google’s Threat Intelligence Group, adversaries tied to Iran have leveraged these tools for target profiling, social engineering lure creation, translation, and other operational tasks alongside peers from China, Russia, and North Korea, reflecting how accessible AI functionality can be integrated into existing workflows rather than introducing fundamentally new techniques.5 In today’s environment, strong identity controls, disciplined patch management, and robust security hygiene remain critical defensive priorities to combat AI-driven threats.”

CyberCube’s analysis has been conducted through Portfolio Threat Actor Intelligence (PTI), which harnesses AI to map the behaviour of cyber threat actors and the technologies they most frequently target.