How Iranian hackers pose a threat to US critical infrastructure

Summary

Michigan may be more than 6,000 miles away from the war in Iran, but, virtually speaking, it’s well within striking distance. An Iran-linked group calling itself Handala claimed responsibility for a cyberattack on Portage, Michigan-based medical device maker Stryker Corp., carried out on March 11, 2026. Handala said the attack was in retaliation for events related to the conflict in Iran. The cyberattack affected Stryker’s internal Microsoft software system, disrupting the company’s order processing, manufacturing and shipping. As a scholar who researches cyber conflict, I’ve found that in periods of geopolitical tension such as the current U.S./Israel-Iran war, cyber operations often sit right next to missiles and airstrikes as a tool that states and state-linked groups use to inflict damage, probe weaknesses and signal resolve to their enemies. The Stryker case is notable because it shows how quickly a regional conflict can translate into disruption for organizations far from the battlefield. It also illustrates the vulnerabilities of U.S. organizations, including those involved in critical infrastructure. Modern critical infrastructure does not only involve the obvious big targets like power plants or water utilities. It also relies on suppliers and service providers that sit one or two links upstream – such as managed information technology providers, cloud and data center operators and specialized parts suppliers – that keep everything from hospitals to transit systems running. This is one reason U.S. officials emphasize critical infrastructure as a whole-of-society problem, not a niche government issue. The Cybersecurity and Infrastructure Security Agency’s “Shields Up” guidance is written for exactly this reality: a world where geopolitical shocks can threaten organizations that did not think they were part of the battlefield. Cyber operations are often about options When people imagine cyber warfare, many often picture dramatic outcomes. The lights go out. The water turns toxic. The trains stop. Those scenarios are real risks. But they are not the only objective, and often not the main one. The real strategic value is access. Cyber access is like a set of keys. If you can get into a network quietly, stay there and learn how it works, you create options for later. You can steal information, map dependencies and position yourself to cause disruption. You can keep the option to strike in your pocket, so that in a crisis, you can cause or credibly threaten to cause harm. That is why U.S. agencies took the China-linked Volt Typhoon group’s hacking activity so seriously. In joint advisories, U.S. officials described a campaign that compromised the information technology systems of organizations across multiple critical infrastructure sectors and used so-called living-off-the-land techniques that can blend into normal administrative activity. This is an important point. A lot of state-linked cyber activity is not designed to create immediate, visible chaos. It is designed to build leverage. How state-sponsored cyberattacks typically work Most state-backed cyber operations, including those carried out by the United States, follow a common sequence. First, the attackers gain initial access through techniques such as phishing, exploiting known vulnerabilities or abusing weak remote access. Once inside, attackers try to learn where the valuable data and sensitive systems are. They seek higher privileges and move laterally, often using legitimate administrative tools to blend in. That stealthy maneuvering is one reason campaigns like Volt Typhoon raised alarms. Defenders can have a hard time distinguishing an intruder from a normal administrator in a busy environment, especially when the intruder is deliberately trying to make their actions look like ordinary activity. The attackers then establish persistence, meaning they can sustain their access. If the goal is leverage, the attackers want to survive defenders’ cleanup efforts after they discover they’ve been hacked. That can mean gaining multiple footholds, altering authentication settings or gaining access via third parties. Finally, they choose the effects they want to have. Consider the “Shamoon” attack in 2012 in Saudi Arabia. After gaining access, the attackers used malware to wipe data on thousands of computers at oil giant Saudi Aramco, disrupting business operations. But not every intrusion ends in destruction. Sometimes it ends with data theft, where the prize is information rather than causing downtime. An example is the 2015 breach of the U.S. Office of Personnel Management, in which attackers stole sensitive personnel data. Other times, the point is disruption designed to send a message such as the cyberattack on Sony Pictures in 2014, when hackers sought to keep the company from releasing the comedy film “The Interview.” What defenses does the US have? The U.S. has a growing defense ecosystem, but it is not a single shield you can switch on. The Cybersecurity and Infrastructure Security Agency encourages organizations to heighten their cybersecurity vigilance during periods of elevated geopolitical risk. The agency, along with the FBI, the National Security Agency and international partners, also publishes advisories with indicators and recommended mitigations when they see active campaigns. Because critical infrastructure is mostly privately owned, federal defense also depends on partnership. For instance, the Cybersecurity and Infrastructure Security Agency’s Joint Cyber Defense Collaborative is designed to support coordinated public-private planning and information sharing around major cyber risks. Congress has also pushed the private sector toward reporting incidents more quickly. The Cyber Incident Reporting for Critical Infrastructure Act of 2022 sets reporting timelines that include reporting cyber incidents within 72 hours and ransomware payments within 24 hours after payment. The Cybersecurity and Infrastructure Security Agency has been implementing these requirements through ongoing rulemaking. These are meaningful steps, but they do not erase the basic constraints: uneven resources, uneven incentives and the reality that many targets sit outside direct federal control. Lessons from the Stryker hack The Stryker episode is a reminder that cyber operations are now a routine tool that state-linked actors can use to project power during international crises. They can aim at theft, disruption or signaling. Sometimes they hit government networks, and other times they hit private companies that sit inside essential supply chains. Either way, the consequences can be felt far from the conflict itself. In cyber conflict, the quiet part – gaining access, establishing persistence and preparing for deployment – typically comes first. The visible disruption often gets headlines, but it is the hidden positioning that sets the stage for offensive cyber operations in a crisis. Wars today are not only fought with missiles and airstrikes you can see in the sky. They are also fought with what you cannot see moving through computer networks.