As Israel battles Iran on the ground, the seas and in the skies, it is also facing a parallel and increasingly aggressive campaign in cyberspace, with cyberattacks emerging as a major front in the broader war effort.
Speaking at a Tuesday press conference, National Cyber Directorate Director General Yossi Karadi described a troubling digital battlefield unfolding alongside Operation Roaring Lion.
False evacuation message appears on station screen in suspected cyberattack on Israel Railways
“Operation Roaring Lion is an exceptionally just war, but it is being fought on two parallel fronts, against Iran and against cybercrime,” he said, offering a rare glimpse into the scale of threats Israel has faced in recent months.
The world’s third most targeted country
According to Karadi, Israel is now the third most targeted country in the world for cyberattacks. Data shows a sharp rise since the start of the war in computer network attacks, known as CNA, aimed at disrupting, damaging and destroying infrastructure.
He also highlighted major global cyber incidents in recent months. Among them was a ransomware attack on automotive giant Jaguar Land Rover that caused more than £3 billion in cumulative damage. The scale, he noted, exceeds high-profile attacks on companies such as MGM and Colonial Pipeline in the U.S., the latter of which led to fuel shortages along the East Coast.
In addition, three major European airports, including Heathrow in London and Brussels, were targeted in the second half of 2025. The healthcare sector has also been hit, with roughly 3,000 dialysis machines attacked worldwide. Israeli officials say they are detecting similar attempts targeting Israel’s healthcare system.
Iranian cyber efforts
Karadi identified Iran as the central force behind cyber operations targeting Israel and the West. Tehran operates more than 20 organized attack groups, alongside hundreds of smaller teams with varying levels of sophistication. One of the most prominent groups is Handala, which is linked to Iran’s Ministry of Intelligence. The group is known for what Karadi described as populist tactics.
“Handala amplifies events to generate fear,” he said. “They often recycle old material to create psychological terror. Iran and Hezbollah cooperate closely in this arena.” He added that Iran’s strategic objective is to create a “digital victory photo” in sectors such as energy and finance, compensating for limited achievements on the physical battlefield.
Just days earlier, the FBI announced it had seized and taken down four key domains used by Handala. The move followed one of the most damaging cyberattacks on the civilian medical sector in recent years, in which the group breached a U.S.-based medical device company Stryker.
One of the most alarming vulnerabilities highlighted in the briefing was the ease of hacking security cameras. Karadi described them as “a very high-quality intelligence-gathering tool,” noting that weak protections in both organizations and private homes make them relatively easy targets.
The National Cyber Directorate said it had blocked about 50 major cyber incidents involving compromised security cameras that could have escalated into much broader attacks.
To illustrate the risks, intelligence officials recently acknowledged in conversations with foreign media that a significant portion of the detailed intelligence Israel developed in Iran, which enabled targeted killings of senior figures, including Supreme Leader Ali Khamenei, stemmed from extensive access to Tehran’s network of security and traffic cameras.
Karadi also warned that attackers’ use of artificial intelligence has significantly enhanced the effectiveness of cyber operations, improving intelligence collection and enabling highly precise social engineering attacks against individuals in security and academic roles.
He concluded by urging the swift advancement of a comprehensive cyber law, warning that the lack of mandatory reporting requirements and binding security standards for civilian organizations poses a national security risk. “If such a law had existed, many incidents could have been prevented,” he said.