Iran-Related Cyber & Telecommunications Risk Advisory: Communications Sector Situation Update and Critical Infrastructure Defensive Actions

This advisory synthesizes publicly available open-source intelligence, U.S. government cybersecurity advisories, vendor threat intelligence, and press reporting to assess Iran-related cyber risks to the communications sector and critical infrastructure following the U.S.–Israeli strikes of February 28, 2026. It covers the current threat outlook — including credential-access operations, destructive malware (wiper) risk, DDoS campaigns, and hacktivist coalition activity — with a focus on telecommunications-specific risk vectors and operational technology considerations. The advisory provides recommended immediate defensive actions for communications-sector operators and critical infrastructure organizations, a consolidated open-source intelligence summary table, vendor threat assessments from CrowdStrike, SentinelOne, Palo Alto Unit 42, Check Point, Sophos X-Ops, Google Threat Intelligence Group, and UK NCSC, and a reference index of relevant CISA advisories and hardening guidance. Prepared independently by the author as an analytical contribution to communications-sector situational awareness and the broader critical infrastructure defense community. Christopher Braccia https://orcid.org/0009-0003-7867-2923