Iran's cyber doctrine is explicitly asymmetric. Tehran cannot match US and Israeli conventional military power. It can, however, inflict costs on civilian and economic infrastructure in the United States, Israel, and allied Gulf states through cyber operations that carry a much lower threshold for escalation than kinetic attacks. This "below the threshold" strategy — attacking real targets in ways that remain just short of triggering military responses — has been central to IRGC doctrine since at least 2010, when the Stuxnet worm (a joint US-Israeli operation, notably) destroyed Iranian centrifuges and demonstrated that cyber weapons could cause physical destruction. Iran drew the correct lesson from Stuxnet and built its own capability.

The IRGC's Cyber Command and the Ministry of Intelligence and Security (MOIS) each maintain separate cyber units with different specializations. MOIS-affiliated groups like MuddyWater (also tracked as Seedworm) specialize in long-term persistence — getting into networks quietly and staying there, building access over months, waiting. IRGC-affiliated groups like CyberAv3ngers specialize in disruptive attacks on operational technology — the industrial control systems that run critical infrastructure. The 2023 CyberAv3ngers attacks on Unitronics programmable logic controllers in US water systems — documented by CISA and the FBI — demonstrated that Iran was already testing its reach into US civilian infrastructure two years before the current conflict began. Those attacks were practice runs. The current environment is the live exercise.

The key tactical advantage Iran possesses as of March 13 is pre-positioned access. MuddyWater's intrusions into US networks — a US bank, a US airport, a US software company with Israeli operations, and non-profit organizations — began in early February 2026, before the first strike on Iran. The Dindoor backdoor discovered on these networks was planted weeks in advance. This is the standard playbook for a sophisticated state actor: pre-position access during the tension period before conflict, then use that access for intelligence collection, disruption, or destruction once hostilities begin. The question facing US network defenders is not whether MuddyWater and its affiliated groups have access to sensitive US networks. They demonstrably do. The question is what that access will be used for, and when.

The Iranian cyber ecosystem is not a monolithic state operation. It is a layered ecosystem of state-sponsored APTs (Advanced Persistent Threats — sophisticated hacking groups with long-term access to targets), affiliated hacktivist collectives that operate with varying degrees of Iranian direction, and opportunistic third-party actors (including Russian hackers) who have joined the campaign for their own interests. This layering creates a strategic advantage for Tehran: it allows Iran to claim plausible deniability for the most aggressive operations ("those are independent hacktivists, not state actors") while still benefiting from the disruption they cause. The organizational structure also means that destroying Iran's own internet connectivity — which the US/Israeli strikes effectively did, reducing Iran's connectivity to 1–4% — does not halt the broader campaign. The hacktivist collectives are organized on Telegram and operate globally, outside Iran's borders.

The most authoritative statement of near-term US cyber risk came from the AP, citing security researchers and published March 12, 2026: "Going forward, US defense contractors, government vendors and businesses that work with Israel are likely targets, as is critical infrastructure such as hospitals, ports, water plants, power stations and railways." This is not a theoretical projection — it is a compilation of what Iran-affiliated hackers have already announced as targets in their own Telegram channels and on public social media platforms. SITE Intelligence Group documented one user writing: "The datacenters need to be taken out. They host the brains of USA's military communication and targeting systems." This is a strategic communication that is simultaneously a threat statement and a targeting intelligence signal.

The water sector is historically the most exposed. The 2023 CISA advisory documented IRGC-affiliated actors compromising Unitronics Vision Series PLCs — the programmable logic controllers that run water and wastewater systems in hundreds of US municipalities. The attackers renamed devices to forestall owner access, reset software versions, disabled upload/download functions, and changed default ports. They did not destroy anything. They demonstrated they could. The implication is clear: Iran has already mapped significant portions of US water infrastructure OT systems, established the attack pathways, and chosen not to use them destructively — until now, when the strategic calculus has changed entirely.

The financial sector is on its own elevated alert. US banks issued heightened security warnings internally within hours of the February 28 strikes. DieNet has claimed DDoS attacks against financial institutions. More concerning than DDoS — which causes temporary outages but not lasting damage — is the risk that MuddyWater's pre-positioned access inside at least one confirmed US bank could be used for more sophisticated operations: fund transfer fraud, data destruction, or the kind of destructive wiper attack that Handala used against Stryker on March 12. A wiper attack on a major financial institution would not just disrupt banking operations — it would destroy records, triggering a financial system integrity crisis that is qualitatively different from any prior cyber incident.

The critical institutional context is the FBI CI-12 hollowing. CNN reported on March 3 that Director Kash Patel fired approximately a dozen agents and staff from CI-12 — the counterintelligence unit specifically tasked with tracking Iranian threats on US soil — in the days immediately before the strikes on Iran. The stated reason was that the fired agents had been involved in the Trump classified documents investigation at Mar-a-Lago. The operational consequence is that the unit most skilled in tracking Iranian cyber operations, mapping their networks, and disrupting their pre-positioned access was degraded at precisely the moment it was most needed. The DOJ's National Security Division has lost more than half its employees to firings and resignations since January 2025. Senior officials overseeing counterintelligence and international terrorism have been pushed out.

The intersection of the Iran war's cyber dimension with the deliberate dismantling of US counterintelligence capacity is the most structurally dangerous feature of the current threat environment. Iran's cyber capability is real, escalating, and pre-positioned. The institutions that exist to detect, track, and disrupt Iranian cyber operations inside the United States have been systematically weakened over the past 14 months — not by Iran, but by the same administration that ordered the strikes that triggered the cyber retaliation.

The CI-12 firings are the most documented instance. The DOJ National Security Division — which prosecutes terrorism and foreign intelligence cases — has lost more than half its staff. CISA, the agency responsible for protecting civilian critical infrastructure from cyber threats, has been the subject of budget reduction discussions throughout 2025. The DHS, responsible for coordinating whole-of-government domestic security, was partially shut down in a budget standoff and is operating under constraints that "raise resource concerns" (cited in multiple intelligence community assessments). The FBI's Joint Terrorism Task Forces — the primary field-level mechanism for detecting and disrupting foreign-directed threats in major US cities — depend on the same senior counterintelligence officers who have been pushed out.

The compounding risk is straightforward: MuddyWater has access to networks it planted backdoors in before the war. Handala has already used wiper malware against a US corporation. Iranian-linked groups have publicly stated their intent to attack US power stations, water plants, ports, and hospitals. And the institutional capacity to detect and disrupt those attacks before they cause physical harm has been substantially reduced. This is the cyber equivalent of opening a front door that used to be guarded, at the same moment the adversary has published their intent to walk through it. The next significant cyber incident affecting US critical infrastructure is not a hypothetical risk to be monitored. It is an expected event whose timing and severity are the only open variables.