Expansion of Cyber Cooperation Between Iran and Hezbollah; A Threat to Regional Security

In recent years, the Islamic Republic of Iran and Hezbollah of Lebanon have engaged in extensive cooperation in the cyber domain, raising international concerns. From cyber attacks on the critical infrastructure of various countries to training and supplying cyber equipment for Hezbollah, the Iranian government is expanding its influence in this area. The news website Khabar Online published details of the cooperation between the Iranian government and Hezbollah in cyberspace from an individual named "Sajjad Abedi." According to Khabar Online, with the cyber pact between the Iranian government and Hezbollah, "Lebanese representatives will share highly valuable cyber infrastructure with their allies in Tehran." Previously, the National Interest magazine reported that after the Stuxnet malware attack in 2010 on Iran's nuclear facilities, Tehran has focused on developing its cyber operations, making Hezbollah a key part of this strategy. In January 2021, Hezbollah's cyber unit, known as Cedar APT, attacked telecommunications companies and internet service providers in the USA, UK, Israel, Egypt, Saudi Arabia, UAE, Jordan, and Palestine. This attack aimed to collect sensitive information and access the internal networks of some key companies. Reports indicate that Hezbollah-affiliated hackers managed to infiltrate communication networks in the USA and extract important data. Following the Stuxnet attack, the Iranian government increased its cybersecurity budget by 1200% over a two-year period. According to the author of the note published in Khabar Online, this action is "part of Iran's broader strategy to counter American and Israeli influence in the region" through cyber warfare. Analysts believe that by supporting groups like Hezbollah, the Iranian government is attempting to create a network of cyber proxy actors in the Middle East. In November 2023, a cyber attack led by the Iranian government and Hezbollah targeted the "Ziv" medical center in the city of "Safed" in Israel. Reports indicate that this attack successfully infiltrated the hospital's information systems and stole patient data. Israeli officials stated that this attack was part of Iran's broader strategy to target civilian infrastructure in Israel. In December 2024, the Israeli National Cyber Directorate warned of an increase in phishing attacks by Iranian hackers. These hackers impersonated the American cybersecurity company F5, sending malware-laden emails to IT officials in Israel. A report released in December 2024 indicated that the Israeli Mossad infiltrated the supply chain of Hezbollah's communication equipment, equipping the group's pagers and walkie-talkies with explosives. This operation, which had been planned for over a decade, resulted in the explosion of these devices and weakened Hezbollah's communication capabilities. Security analysts stated that this operation is part of Israel's strategy to counter the cyber development of the Islamic Republic and its proxy groups in the region. Despite the increase in cyber cooperation between the Islamic Republic and Hezbollah, the lack of clear international laws regarding cyber attacks has complicated the definition of state responsibility in such attacks. Experts believe there is no definitive solution to prevent cyber attacks, and these threats can challenge national security. The U.S. Defense Intelligence Agency stated in 2021 that the Iranian government, due to its military and cyber capabilities, is considered one of the main security challenges for the U.S. and its allies in the region. This report emphasized that by increasing its cyber capabilities, the Iranian government has expanded its influence in the region and equipped its proxy actors like Hezbollah with advanced cyber tools. The cyber cooperation between the Iranian government and Hezbollah has significantly grown in recent years. From extensive cyber attacks against the critical infrastructure of Middle Eastern and Western countries to training and equipping proxy groups with advanced digital technologies, this alliance has become one of the world's main security concerns. With the increase in these threats, Israel and Western countries are seeking to develop new strategies to counter these attacks. Meanwhile, Saudi Arabia and the UAE have also warned that the cyber activities of the Iranian government and Hezbollah pose a serious threat to regional security.