←Back to Intelligence Feed

On Saturday, June 21, United States military forces struck three of Iran’s key nuclear facilities: Natanz, Isfahan, and Fordow. At this time, there are no specific or credible threats to New Jersey from Iran; however, the situation remains highly fluid following the recent airstrikes on Iranian nuclear facilities, which have further escalated regional tensions. The strikes, which reportedly targeted enrichment and military-related infrastructure, are likely to provoke retaliatory action by Iran or its proxies, including cyberattacks. Iranian government-backed threat actors and affiliated hacktivist groups have a history of targeting U.S. entities in response to geopolitical developments. Potential cyber targets include critical infrastructure such as water and energy utilities, transportation systems, healthcare networks, and financial institutions. Iranian cyber threat actors have previously conducted a range of operations including phishing campaigns, distributed denial-of-service (DDoS) attacks, website defacements, ransomware deployment, cyberespionage, and destructive attacks involving wiper malware. These activities can disrupt business operations, damage infrastructure, and sow public uncertainty. The overt nature of the current conflict increases the likelihood of more aggressive and visible cyberattacks as part of a broader strategic response by the Iran government. While the simultaneous conflict with Israel may temporarily strain Iran’s capabilities, it also raises the stakes for asymmetric operations such as cyberattacks, which require fewer resources and offer plausible deniability. Recommended Precautions and Vigilance: While the NJCCIC has not identified any specific or credible cyber threats to New Jersey's public or private sector cyber infrastructure at this time, we are advising all members to review and reinforce their cybersecurity posture, including taking the following actions:

• Review Incident Response Plans: Ensure your organization's incident response plan is up to date, tested, and understood by all relevant personnel. Confirm communication channels with internal and external stakeholders (e.g., law enforcement, NJCCIC).
• Enhance Network Monitoring: Increase vigilance over network traffic for anomalous behavior, unusual login attempts, and suspicious activity, especially on critical systems and external-facing assets.
• Patch and Update Systems: Immediately apply all critical security patches and updates to operating systems, software, and firmware, prioritizing internet-facing systems and those within critical infrastructure.
• Strengthen Authentication: Enforce Multi-Factor Authentication (MFA) for all accounts, particularly those for remote access, privileged accounts, and critical business applications. Review and tighten access controls, adhering to the principle of least privilege.
• External Connectivity: Scrutinize and secure all external connections to your network. Disable or restrict access to unnecessary services, ports, and protocols.
• Back up Critical Data: Ensure all critical data is regularly backed up offline or in a segregated environment and that recovery procedures are tested.
• Conduct Employee Awareness Training: Remind employees about the heightened risk of phishing, social engineering, and misinformation campaigns. Emphasize vigilance against suspicious emails, links, and attachments.

The NJCCIC is closely monitoring the evolving cyber threat landscape and will provide further updates as new intelligence becomes available. We encourage all members to report any suspicious cyber activity or confirmed incidents to the NJCCIC immediately.