Iranian Cyber Offensive — April 2026 Threat Intelligence Report

Iranian state-linked threat actors have unleashed a wave of highly coordinated cyberattacks—shifting from custom malware to large-scale identity compromise, targeting critical infrastructure, cloud environments, and operational technology across the U.S., Israel, and Gulf states—while leveraging AI and blockchain to accelerate and harden their offensive campaigns.