The United States and Israel’s military strikes against Iran raise the odds of retaliatory activity in cyberspace, according to analysis by CyberCube, the leading provider of cyber risk analytics.
To date, there has been no confirmed specific counter-cyberattack by Iran or affiliated groups that directly ties back to the operation. However, security community commentary has warned that Iran-aligned actors could carry out cyber operations, including ransomware, against U.S. or allied targets in retaliation.
In a blog published online — How Cyber (Re)Insurers Should React as the Iran War Unfolds — CyberCube has analyzed a portfolio of approximately 1,000 large-sized U.S. companies, segmenting them into risk tiers based on their exposure to threat groups known as APT33, MuddyWater, and Fox Kitten - three of the most active and well-documented Iranian state-aligned groups targeting U.S. enterprises and critical infrastructure.
CyberCube’s analysis has been conducted through Portfolio Threat Actor Intelligence (PTI), which harnesses AI to map the behavior of cyber threat actors and the technologies they most frequently target. It has identified 12% of large-sized U.S. firms with revenues over $1 billion across seven critical industries – Banking, Financials, Energy & Utilities, Oil & Gas, Healthcare, Telecommunications, and the Public sector — as facing the highest likelihood of being targeted by Iranian cyber threat actors. Among them are 28 U.S. health organizations and 13 U.S. energy and utilities companies.
William Altman, CyberCube’s Director of Cyber Threat Intelligence Services and blog author, said: “Insurance carriers should anchor expectations in Iran’s observed cyber playbook. U.S. government guidance has repeatedly warned that Iranian government-affiliated cyber threat actors target poorly secured networks and internet-connected devices, and that heightened vigilance is warranted for U.S. critical infrastructure and entities of interest.”
CyberCube is advising cyber insurers to move beyond routine portfolio risk monitoring and toward adopting a proactive posture across underwriting and exposure management operations to account for heightened risk from specific Iranian cyber threat actors.
PTI is included as part of the CyberCube’s Concierge Threat Intelligence service — a first-of-its-kind offering designed specifically for the unique needs of cyber (re)insurers, built by experts in cyber threat intelligence, risk, and (re)insurance.
CyberCube will discuss the use of AI in the Middle Eastern conflict in its forthcoming webinar “AI Risk Landscape: Implications for Cyber (Re)Insurance” on Thursday, March 26, 2026, at 4:00pm GMT | 12:00pm EDT
About CyberCube
CyberCube is the leading provider of software-as-a-service cyber risk analytics to quantify cyber risk in financial terms. CyberCube leverages data, analytics, artificial intelligence, and human resources to serve insurance institutions globally. The CyberCube platform was established in 2015 within Symantec and has operated as a standalone company since 2018. With offices in San Francisco, New York, Chicago, London, and Tallinn, Estonia, the team is committed to helping organizations and society build resilience to cyber risk. For more information, please visit www.cybcube.com or email info@cybcube.com.
Media contact: Yvette Essen, Head of Communications & Market Engagement, yvettee@cybcube.com