The Mystery of Iranian Hackers' Silence After the US Attack

Amid US and Israeli attacks, the manoeuvres of Iran-born hacker groups suddenly fell quiet. Many attributed the silence purely to the severing of the national internet, which restricted their room to manoeuvre. However, a new report titled ‘Decoding the Strategic Quiet of Iranian Cyber Groups’, released by cybersecurity firm Shieldworkz, reveals a different reality. The absence of Iranian cyber attacks appears to be a direct consequence of the US military operation, Operation Epic Fury, which inflicted substantial damage. According to Shieldworkz’s report, Epic Fury has delivered a heavy blow to the heart of Iran’s digital defence. The operation disrupted the chain of command, damaged operational infrastructure, and eliminated several senior leaders overseeing cyber operations. The cutting of 96 percent of domestic internet connections further compounded the impact of Israeli forces’ attacks. They possess functional autonomy, multi-layered leadership structures, and operation manuals stored offline. These hackers had anticipated internet outages and integrated them into their operation defence models. Evidence shows passive traces from Iranian hackers, such as credential theft and VPN gaps in critical Middle East infrastructure since early 2025, remain embedded and not fully erased. Currently, the planted intrusion tools are dormant. However, the system endures, occasionally emitting signals, and is like a ‘time bomb’ ready to be exploited should the Iranian APT group end its silence. In fact, not all elements of Iranian threat actors were destroyed by the onslaught. Shieldworkz’s report notes that remnants of affiliated groups operating outside Iran’s borders are reportedly still intact. This is evidenced by periodic waves of reconnaissance attacks by Iranian affiliates that have been recorded globally to date. Here are the current operational statuses of them: