What the Iran Conflict Changes for a US Threat Model

An Iran-linked group wiped an American medical technology company’s devices eleven days after the United States and Israel began striking Iran. The war changed who is willing to attack a mid-size company. It did not change how they get in: exposed systems, weak identities, an unpatched edge device.

Each escalation moves the advice by a few degrees. It does not move the work: find what is exposed to the internet, close it, make administrative authority expensive to use, and prove you can restore from backup. That list was right in June 2025. It is right today.

The timeline below comes from the Congressional Research Service, joint federal advisories, a Justice Department seizure action, and the insurance market’s own material on war exclusions, each with a date attached. Where the situation is still moving I say which day I am writing from. Treat any sentence about this war as perishable.

The conflict, on the record

The current round has two phases. The first lasted twelve days. Israel opened a major operation against Iran on 13 June 2025, the United States struck three nuclear facilities on 22 June, and hostilities stopped on 24 June in what the president called the twelve-day war (CRS, R48887).

Six days after that ceasefire, a joint federal fact sheet still warned that Iranian-affiliated actors “may still conduct malicious cyber activity” despite the declared ceasefire and ongoing negotiations (CISA, FBI, DC3, and NSA, 30 June 2025). A ceasefire bounds the shooting. It does not bound the phishing.

On 28 February 2026, after a winter of protests and a US force buildup, American and Israeli forces began Operation Epic Fury and Operation Roaring Lion. Ali Khamenei was killed the same day. His son Mojtaba was selected to succeed him on 8 March. The Congressional Research Service’s 26 March 2026 report describes a regional conflict that had largely halted maritime traffic through the Strait of Hormuz and had produced no settlement. As of publication that has not changed. Plan for a war with no front line and no end date.

What changed

The first change is the target list. On 19 March 2026 the Justice Department seized four domains it described as part of the Iranian Ministry of Intelligence and Security’s hacking and psychological operations. The department’s account says the Handala persona published the names and personal data of roughly 190 people associated with the Israeli Defense Force, and claimed credit for the 11 March destructive attack on a US-based multinational medical technology firm. One email quoted in the release offered $250,000 for the killing of two named targets (DOJ, 19 March 2026). The selection logic is visible: the audience for the attack is political, so the victim gets chosen for visibility. A regional manufacturer with a recognizable name and a two-person IT team makes a better headline than a defense contractor with a mature security program.

The second change is the pressure point. A joint federal advisory published on 7 April 2026 describes Iranian-affiliated actors reaching internet-exposed programmable logic controllers in water and wastewater, energy, and local government facilities. They used the manufacturer’s own programming software to pull project files, modify the logic, and alter what operators saw on their displays. In one case the modified file kept the downstream function running while overriding the instructions that maintain safe operating parameters, and the changes disabled shutdown and alarm logic (CISA AA26-097A). The ports named in the advisory are the tell: 44818, 2222, 102, 502, and 22, the last reached through Dropbear SSH installed on victim cellular modems. The intrusion method was a scan that found a controller with a routable address.

The third change is noise. A crowd of personas is claiming credit for disruption, defacement, and data theft, and some of those claims are inflated. The Justice Department treats the leak sites as psychological operations rather than simple publications (DOJ, 19 March 2026). So treat a public claim as unverified, and treat the absence of one the same way. That is a communications problem before it is a technical one, and most incident plans do not have a verification step.

What did not change

The exposed appliance is still the cheapest way in. An exploit that is already public costs the attacker nothing, and the operator who has not patched it pays the whole ladder: the scan, the payload, and the extortion. A war does not make an unpatched edge device more attractive than it was last year. It shortens the odds that the person who finds it is a criminal rather than a state team.

A 2024 joint advisory remains the best description of the identity half. Since October 2023, Iranian actors had been using password spraying and MFA push bombing against Microsoft 365, Azure, Citrix, and Okta, then registering their own devices against compromised accounts to keep access. They sold the resulting access on criminal forums (CISA AA24-290A). The state actor is often the landlord, not the tenant. The person encrypting your files may be a buyer who paid for a password your helpdesk reset on a Friday.

Nothing in the 2026 advisory asks for a capability you did not already need. Remove inbound exposure and put controllers in run mode. Use phishing-resistant authentication for administrators, patch internet-facing systems, and keep logs you actually read. Hold an offline backup. Tell your service providers what is happening. The war added a deadline to that list. It did not add an item.

That is the argument, and it is why I am suspicious of the genre this article belongs to. The threat floor does not move because a foreign ministry is angry.

The Stryker attack was a permissions failure

CISA published an alert on 18 March 2026 about the 11 March attack on Stryker Corporation, a medical technology firm, noting that it affected the company’s Microsoft environment and that similar activity could target other organizations’ endpoint management systems (CISA, 18 March 2026). The recommendations in that alert are the interesting part: least-privilege role design, phishing-resistant MFA for administrators, and multi-admin approval for high-impact actions such as device wipes.

Lockton’s April 2026 explainer on war exclusions sets out the intrusion path in more detail: adversary-in-the-middle phishing to steal tokens, access to the Intune portal, then a bulk-wipe action (Lockton, 13 April 2026). No malware was required. The destructive capability was already installed, licensed, and pointed at every managed device in the company, and one phishable session token stood between an attacker and the wipe button.

A 40-person company running Intune with a helpdesk admin and push-based MFA carries the same three weaknesses. It is the permission problem I described in the piece on AI agents, arriving through a different door: authority granted once, never narrowed, never watched.

Where a small organization is exposed

Each row pairs an exposure class with the behaviour federal reporting describes, the control that addresses it, and the document where the behaviour is recorded. The controls are drawn from the same advisories, not invented here.

Exposure class	What the actor does with it	Control that addresses it	Evidence
Internet-facing PLC, HMI, or cellular modem (water, HVAC, small plant)	Downloads a modified project file, overrides safe-operating logic, disables shutdown and alarm functions, alters operator displays	Remove inbound exposure, broker through a jump host, place controllers in run mode, validate logic against a known-good copy	CISA AA26-097A, 7 April 2026
Endpoint management console (Intune, MDM)	Steals an administrator token by phishing, then turns your own wipe command against every managed device	Phishing-resistant MFA for administrators, multi-admin approval on wipes and deletions, and no standing global administrator accounts	CISA alert, 18 March 2026; DOJ, 19 March 2026
VPN, RDP, or Citrix with password-only or push-only authentication	Password spraying and MFA push bombing, then re-registering MFA to hold the account	Phishing-resistant MFA, number matching, alerting on MFA registration changes	CISA AA24-290A, 16 October 2024
Public website and brand	DDoS, defacement, hack-and-leak, and claims of compromise larger than what occurred	DDoS filtering, a claim-verification procedure, and a communications owner	DOJ, 19 March 2026
Vendor and MSP remote access	Uses the maintenance path you granted, at the privilege you granted, to reach you through their infrastructure	Named accounts, session logging, prompt offboarding, contract terms on incident notification	CISA AA26-097A, 7 April 2026
Backups reachable from the domain	Deletes or encrypts the copy you were counting on before you notice the intrusion	One offline copy, a quarterly restore test, and a recorded recovery time	CISA AA24-290A, 16 October 2024 (access kept after compromise)

The clause in your policy

Most cyber policies contain a war exclusion, and the version in widest use follows model language the Lloyd’s Market Association published in 2021. Lockton’s explainer sets out how it works. The exclusion is most likely to apply when an attack is made by a party to an armed conflict against an opposing party and is meaningfully connected to that conflict. A second trigger covers large-scale nation-state attacks outside a physical conflict. A formal declaration of war is generally not required, and the insurer carries the burden of proving the exclusion applies. The same explainer says hacktivist attacks and opportunistic war-themed crime should not fall under it.

Coverage is already being argued. Insurance Business reported on 23 March 2026 that the Stryker loss is among the cases testing war-exclusion wordings. The most widely adopted clause, LMA5567, does not blanket-exclude state-linked incidents; it applies a threshold test tied to whether an operation causes major detrimental impact on a state’s essential services. The same report notes that Marsh has flagged non-concurrency, with some clients facing five or more different exclusion wordings in a single tower of coverage (Insurance Business, 23 March 2026).

That means the answer for your company may be decided in a coverage dispute rather than by your policy wording. I would not plan around an assumption. Ask your broker, in writing, which exclusion your policy carries, how the carrier has applied it to state-attributed events, and whether business interruption and DDoS sublimits survive an attribution fight.

Insurance sits behind that work, not in place of it. A policy pays after the argument. The controls determine whether there is a loss to argue about.

What this means for operators

The control set is unchanged. The review interval is not. A war that has run for six weeks is a condition rather than an incident, and conditions belong in the annual plan with an owner, not in a fire drill that ends when the news cycle does.

Two questions per asset will find most of your exposure. Can this be reached from the internet? Who can destroy it with a single command? The first is answered by a scan and an asset inventory that includes the devices nobody bought through IT: the cellular modem on the pump house, the building management controller, the print server, the UPS management card. The second is answered by listing which accounts hold global administrator or device-management roles, and checking how those accounts authenticate.

Vendor concentration deserves its own line. The April advisory tells asset owners to notify service providers about the campaign, specifically because remote monitoring and maintenance paths are how many small operators reach their own equipment. For a 40-person firm, the managed service provider is the defense, the evidence source, and the single point of failure at the same time. Ask yours which of your internet-facing addresses they monitor, and get a list rather than a sentence.

Then write the escalation triggers down, because a plan without triggers is a document. Mine would include a federal advisory naming your sector, a company of your size and sector publicly hit, a claim naming your organization, outbound traffic from an OT segment to a hosting provider, and a new MFA device registered against an administrator account. Each trigger should name who decides, what they decide, and what happens in the first hour. The first-72-hours piece covers the sequence once a trigger fires.

What to do

1. Inventory what answers from the internet, including the devices nobody owns. Scan your own address space on 443, 22, 3389, 44818, 102, and 502, then reconcile the results against your asset list. Anything that appears in the scan and not on the list is the finding.
2. Remove inbound exposure from OT and building systems. Broker access through a jump host, put controllers in run position, change default credentials on cellular modems, and update their firmware. The test is simple: no controller answers a scan from the public internet. How you get there depends on what the plant needs to keep running, and that conversation belongs with the people who operate it, not only with IT. The advisory’s port list is a starting point, not a boundary.
3. Make destructive authority a two-person action. No standing global administrator accounts. Multi-admin approval on device wipes, mass configuration changes, and deletions. Phishing-resistant authenticators for anyone who can reach an endpoint management console.
4. Hunt the identity patterns the federal advisories published. Password spray against single sign-on, MFA push bombing, MFA registration from an unfamiliar device, impossible travel, dormant accounts waking up. Turn on alerting for new MFA device registration this week; it is the cheapest detection in the list.
5. Patch internet-facing systems on a written clock, ranked by exploitation. Use the CISA Known Exploited Vulnerabilities catalog rather than severity scores, set a deadline in days for anything on it, and enroll in CISA’s free scanning so that someone else’s scan is not the first one.
6. Test one restore and time it. Keep one copy offline and out of reach of the domain. Prove recovery before you need it, and write down how long it took.
7. Rehearse the escalation, not just the breach. Pick one trigger, walk the first hour with the people who can authorize spending, and include the case where your OT vendor cannot be reached because they are handling their own incident.
8. Ask your broker for the exclusion wording in writing. Get the clause, the carrier’s position on state-attributed events, and the sublimits for business interruption and DDoS before renewal, not after a claim.

The decision for this quarter is whether the war counts as a project or a condition. If it is a project, name the end date and accept that your exposure returns when the attention does. If it is a condition, give it an owner, put a quarterly review on the calendar, and hold those two questions against every asset you add. The cybersecurity archive has the working detail for the rest.

Sources

1. U.S. Conflict with Iran — Congressional Research Service, R48887, 2026-03-26.
2. Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure — CISA, FBI, NSA, EPA, DOE, CNMF, and Treasury, AA26-097A, 2026-04-07.
3. CISA Urges Endpoint Management System Hardening After Cyberattack Against US Organization — CISA, 2026-03-18.
4. Justice Department Disrupts Iranian Cyber Enabled Psychological Operations — U.S. Department of Justice, 2026-03-19.
5. Iranian Cyber Actors’ Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations — CISA, FBI, NSA, and international partners, AA24-290A, 2024-10-16.
6. Cyber insurance war exclusions, explained — Lockton, 2026-04-13.
7. Iranian Cyber Actors May Target Vulnerable U.S. Networks and Entities of Interest — CISA, FBI, DC3, and NSA joint fact sheet, 2025-06-30.
8. Stryker cyberattack tests insurers’ war exclusion boundaries — Insurance Business, 2026-03-23.
9. Known Exploited Vulnerabilities Catalog — CISA, accessed 2026-04-14.