Israel was top target of Iranian cyberattacks, Microsoft report says
Israel accounted for 39% of recorded incidents attributed to Iranian actors, as Microsoft warns of a growing shift toward disruptive and destructive operations
Israel was the leading target of cyberattacks attributed to Iranian actors between July 2025 and June 2026, accounting for 39% of recorded incidents, according to Microsoft’s annual Digital Defense Report, published Thursday.
The United States was the second-most targeted country, with 23% of incidents, followed by the United Arab Emirates with 9%.
The report describes a shift in the tactics of groups linked to Tehran. Alongside espionage, these groups are increasingly conducting operations designed to disrupt or destroy systems, including wiping data and targeting the technology used to run industrial and other physical infrastructure.
Microsoft also points to closer coordination between cyberattacks, military operations and influence campaigns.
Ransomware attacks targeting Israel rose 21% compared with the previous year. Microsoft said the increase may reflect Iran’s use of ransomware to advance political objectives as part of a broader hybrid warfare strategy.
Iranian groups are also seeking to retain access to compromised systems over extended periods, allowing them to gather intelligence and prepare for possible future disruption.
Research and higher education were the sectors most frequently targeted by Iranian actors, accounting for 28% of reported attacks. Information technology followed at 12%, transport at 11%, government agencies at 8%, and research institutes and nongovernmental organizations at 8%.
Attackers continued to exploit known software vulnerabilities, weak authentication and systems exposed to the internet. Phishing and stolen login credentials remained key methods of gaining access.
More than 99% of the initial intrusion attempts Microsoft observed in cloud environments used “password spraying,” a technique in which attackers test commonly used passwords across large numbers of accounts.
Israel National Cyber Directorate chief Yossi Karadi said the findings placed Israel “on the front line of global threats.”
“In cyberspace, you may not see missiles in the sky, but there is no ceasefire. The battle takes place 24 hours a day, seven days a week,” he said.
Karadi also warned that the growing use of artificial intelligence was accelerating attacks and expanding their scale, requiring cyber defenses to adapt continuously.