Iran’s cyber activity against Israel surged in 2026, Israel’s top cyber official said, pointing to a broader shift in how Iranian-backed operations are organized and deployed.

Yossi Karadi, director-general of Israel’s National Cyber Directorate, said Iranian state-aligned actors have become more organized and more coordinated in recent months. He described Iranian groups as increasingly sharing tools and information with one another, enabling them to operate more efficiently and carry out cyber activity at higher scale. Karadi also said Iran has incorporated artificial intelligence to improve the quality of disinformation and recruitment messages used in influence operations directed at Israelis.

Karadi’s remarks tied the acceleration to what Israel has characterized as sustained preparation for “high-scale cyber war,” arguing that Iranian cyber capability has not been underestimated. He said Iranian messaging campaigns have included deceptive content designed to disrupt public behavior and also solicit intelligence-sharing from individuals in Israel.

He further argued that cyber operations are resistant to conventional deterrence and ceasefire frameworks. In his view, there is “no ceasefire in cyber,” since cyber activity can be denied or attributed differently than physical strikes.

The official also said Iran’s cyber campaign has fluctuated in intensity based on the wider kinetic conflict environment. When Israeli attacks intensified and access to key cyber infrastructure became harder, hacking activity tended to decrease; when strikes slowed, Iranian groups had more room to reorganize and collaborate again.

Karadi added that Israel continues to seek technological parity with threat actors, including by pressing major AI labs for controlled access to advanced models used to generate or refine content for cyber-enabled influence operations.