The lead U.S. cyber agency is stretched thin as Iran hacking threat escalates

As tensions escalate in the Middle East, cybersecurity experts are increasingly alerting U.S. businesses and infrastructure about potential online assaults orchestrated by Iran. Pavel Gurvich, CEO of the cybersecurity firm Tenzai, emphasized the urgency of the situation, stating, "From a timing perspective, it's now or never." He suggested that Iran might be biding its time, readying its capabilities to strike during a precarious moment. In light of recent U.S. and Israeli military actions over the weekend, Iran has intensified its retaliatory efforts, targeting U.S. bases and embassies in key locations such as Tel Aviv, Doha, and Dubai. This rising cyber threat from Iran poses a significant risk to the U.S. at a time when the Cybersecurity and Infrastructure Security Agency (CISA) is struggling with a partial government shutdown, employee furloughs, and a management shake-up that could impede its response capability. U.S. Secretary of Homeland Security Kristi Noem recently stated that the Department of Homeland Security (DHS) is collaborating with federal intelligence and law enforcement agencies to monitor and mitigate potential threats. However, DHS has reportedly seen a reduction of nearly a third of its workforce since the Trump administration began, and Madhu Gottumukkala, the interim director, was reassigned last week after facing internal conflicts and scrutiny. CISA's website remains outdated, with the last update recorded on February 17, indicating that the agency is not actively managed due to funding issues. Following this lapse, DHS announced the cancellation of crucial cybersecurity assessments and other training programs. Noem warned that the ongoing shutdown could exacerbate vulnerabilities in key areas, leading to heightened risks in the future. Lawmakers have expressed concern over the nation's preparedness as the shutdown continues. House Appropriations Committee Chairman Tom Cole highlighted that CISA personnel are already "stretched thin" and that a prolonged shutdown would compromise the security of critical infrastructure and healthcare facilities. Despite the challenges, cybersecurity experts believe that Iranian-linked groups will persist in their operations using proxies and VPNs. Adam Meyers, the head of counter-adversary operations at CrowdStrike, noted a notable increase in reports of network disruptions attributed to these groups, with potential targets including financial sectors and critical infrastructure. John Hultquist, chief analyst at Google's Threat Intelligence Group, acknowledged that while Iran tends to exaggerate its cyber capabilities, the threats they pose should not be dismissed lightly. JPMorgan Chase CEO Jamie Dimon also voiced concerns about the potential for increased cyberattacks, particularly against banks. He remarked, "We always try to prepare for that," emphasizing that cyber threats rank among the highest risks faced by financial institutions. Iran's history of breaching U.S. targets, including its claim of hacking emails related to Donald Trump's campaign in 2024 and orchestrating significant denial-of-service attacks on major banks in 2012 and 2013, underscores the seriousness of this situation. Hultquist warned that the pattern of cyber threats from Iran is likely to continue, with targets including the U.S., Israel, and Gulf Cooperation Council countries, focusing on critical infrastructure and opportunities for disruption.