“In the nuclear realm, a single image of a warhead can deter an adversary. In cyberspace, the same image can neutralise the weapon and remove it from the equation.”
No sound now rises above the roar of aircraft, the thunder of missiles, and clouds of dust from Tehran to Tel Aviv, passing through the Gulf states. On the morning of Saturday, 28 February 2026, US President Donald Trump announced the start of “major combat operations” in Iran. The US Department of Defence, the Pentagon, named the campaign “Epic Wrath”, while Israel announced a parallel operation it called “Roar of the Lion”.
The announcement of the two operations coincided with explosions in Tehran, Isfahan, Qom, Kermanshah and Karaj, targeting Iranian command and control centres and several senior Iranian leaders, foremost among them Supreme Leader Ali Khamenei. Iran responded by launching missiles towards Israel and US bases in the Gulf region, as well as airports and other critical targets.
Yet as missiles fell from every direction, something else, far less noisy, was unfolding at the same time. Iranian official and semi-official news agencies, including IRNA, ISNA and Mehr, were hit by large-scale cyberattacks that halted their services. The cyber targeting expanded to other major Iranian institutions. NetBlocks confirmed that internet connectivity in Iran fell sharply to just 4 per cent of normal levels. Meanwhile, the Mossad launched a Persian-language Telegram channel to address Iranians directly while their official channels were down.
Cyberwar Running in Parallel to Air Strikes
The cyber campaign moved alongside the military campaign. The attacks on Iranian news agencies were not separate from the air strikes, but part of a single operation aimed at striking the Iranian system not only by targeting its military and security institutions, but by disrupting its ability to communicate with the public and control the media narrative from the first moments of the operation.
This scene, the article argues, was not improvised and did not emerge from nowhere. It had been signalled in advance.
On 19 February, the Royal United Services Institute (RUSI), one of Britain’s most established defence research centres, published a lengthy analysis titled “Control, Alternative, Influence: Prospects for US Cyber Operations in Iran”. The analysis laid out a detailed map of what US Cyber Command could target in an assault on Iran: early warning radars, ground-based air defence systems, command and control networks, logistics systems, and even internal communications used by Iran’s Islamic Revolutionary Guard Corps.
Researcher Prerana Joshi wrote that “the question is no longer whether offensive cyber operations will participate, but how they will participate? And in support of what objective?” In mid January, reports said Pentagon planners presented Trump with “cyber operations and psychological campaigns” that could be executed “in conjunction with conventional military force or as standalone options”.
The Old Rules of Cyber Conflict
The article frames this as a new and developing approach. Across its short history, cyberwar relied on concealment because its power lies in the adversary not knowing what you can do, when, or how. Stuxnet, discovered in 2010 in Iranian centrifuges, was denied by the United States and Israel for years. In 2019, reports leaked to the press about US Cyber Command targeting IRGC missile platforms, with no formal confirmation. Even when Cyber Command disabled Iranian air defence systems during “Operation Midnight Hammer” in June 2025, its role reportedly remained secret for eight months.
But in the weeks before the American and Israeli strikes, events followed a very different scenario. Perhaps for the first time in the history of cyber conflict, the US administration deliberately revealed offensive capabilities, published target lists in public, and did so before the war began.
The article then returns to the logic behind secrecy. When a state reveals its capabilities, it risks losing them. When you penetrate an enemy network, your strength lies in the enemy not knowing you are inside. Once discovered, the adversary patches the vulnerability, changes the architecture, and resets the battlefield.
That is why, the article argues, a single image can deter in the nuclear arena, but can disable in cyberspace.
Stuxnet is presented as the founding paradox. Researchers at Symantec wrote in 2013 that the malware operated secretly inside Iranian centrifuges since around 2007. It went undetected for roughly three years until cybersecurity researchers identified it in 2010 after it spread beyond its original target.
At the time, the United States and Israel denied involvement. The first detailed public account came from journalist David Sanger in The New York Times in 2012, framed as leaks from former officials rather than an official admission. To this day, the article says, there has been no explicit US government acknowledgement of developing Stuxnet. The operation’s strategic effect, it argues, came not from public disclosure but from remaining hidden as long as possible.
From Silent Operations to Declared Doctrine
With the growth of cyber threats, the US Department of Defence created US Cyber Command in 2009 as a subordinate command under Strategic Command. Its original role was defensive, but it shifted over time towards offence. In August 2017, during Trump’s first term, the administration elevated Cyber Command to a unified independent command, on par with Central Command and Indo Pacific Command.
In 2018, the United States announced a “Defend Forward” strategy, meaning a shift from reaction to initiative by intercepting threats inside an adversary’s networks before they reach American systems. Yet operations remained largely in the shadows. The structure changed, and doctrine evolved, but concealment remained the official rule.
Operation Midnight Hammer
In June 2019, Iran shot down a US reconnaissance drone over the Strait of Hormuz. The United States responded with a cyberattack that disabled command and control systems for IRGC missile platforms, according to reports at the time. There was no formal statement. The story reached the public through leaks to US media after the fact, alongside expert analysis suggesting that access to such systems likely required physical presence or third party access through supply chains. The cyberattack was presented as an alternative to a conventional strike that Trump reportedly cancelled at the last moment. Even then, official confirmation was absent.
Then came “Operation Midnight Hammer” in June 2025, when the United States struck Iran’s nuclear facilities in Natanz, Isfahan and Fordow. What was not known at the time, the article says, is that Cyber Command disabled Iranian air defence systems to secure the flight path of attacking aircraft. Recorded Future News later described the operation as “one of the most complex operations conducted by Cyber Command against Iran in its sixteen year history”, stating that the attackers found what it called an “Achilles heel” in highly complex closed military systems.
Even this remained secret for eight months, and was not published until 4 February 2026, when the American outlet reported it as an exclusive, citing unnamed US officials, while withholding details “at the request of sources”. Up to June 2025, the article argues, even the most complex cyber operations still followed the old rules: silent execution and no response to questions of direct responsibility. What changed between June 2025 and February 2026?
Cyberwar as Public Messaging
The article points to an earlier episode. On 3 January 2026, the lights in Caracas suddenly went out. “Operation Absolute Resolve” had reportedly just begun, described as a US raid to arrest Venezuelan President Nicolas Maduro and his wife. Electricity was cut, air defence radars were disrupted, and radio communications stopped.
Trump then publicly claimed, at a press conference, that “the lights of Caracas were largely switched off thanks to a certain expertise we possess”, referring to cyber operations. Chairman of the Joint Chiefs General Dan Caine said Cyber Command, Space Command and other bodies “began arranging multiple effects” on Venezuela as helicopters moved in to open a corridor for special forces.
A later CyberScoop investigation reported significant physical damage across multiple substations, suggesting the outage was likely a combination of cyber action and kinetic operations on the ground. But the core point remained, the article argues: the administration chose to publicly attribute the effect to cyber capabilities, and the signal may have been deliberate.
Weeks later, on 28 January, General William Hartman, acting commander of Cyber Command and director of the National Security Agency, appeared before the Senate Armed Services subcommittee on cyber security and broke with the rules that had governed the field for over a decade. He said offensive cyber operations were carried out in a “sustained and repeatable manner” and would be “at the forefront” of military operations. This was not a media leak, but a doctrine statement made in an open session.
Two weeks earlier, a related shift appeared in the House Homeland Security subcommittee on cyber security, which held a hearing titled “Defence Through Offence”. Witnesses included representatives from CrowdStrike, the Center for Strategic and International Studies, and the McCrary Institute at Auburn University. Frank Cilluffo argued the United States would remain “tied down” unless it fully integrated cyber weapons into its military doctrine. Reports suggested an upcoming national cyber strategy would include a dedicated pillar for offensive operations and private sector partnerships.
On the same day, committee chair Andy Ogles wrote: “The truth is uncomfortable but inevitable: we are already in a cyber war. The question is whether we intend to shape it or remain purely reactive.” In a matter of weeks, the article says, what had not happened in sixteen years occurred: a president boasting of cyber capability on camera, generals declaring an offensive doctrine in open hearings, and experts urging full integration of cyber weapons into military doctrine.
The most telling moment, the article continues, came from Cyber Command itself when Recorded Future News published its 4 February exclusive about the cyber role in “Operation Midnight Hammer”. The command issued a formal statement that did not deny or evade, but said: “US Cyber Command is proud to support Operation Midnight Hammer, and is fully equipped to execute the orders of the commander in chief and the Secretary of Defense at any time and any place.”
Compared with earlier episodes such as Stuxnet, where official denial dominated, and 2019, when the administration remained silent, this was a declarative message. The shift was not in capability, the article argues, but in the institutional decision to reveal it. Cyber power moved from classified intelligence files into open congressional records and official statements, from a tool operating in the shadows to a doctrine announced under the lights. Military institutions, it adds, do not change doctrine without cause.
Timing That Was Not Accidental
The article then points to a key date. On 3 February 2026, IRGC boats attempted to intercept an American oil tanker in the Strait of Hormuz. A US F 35 fighter jet shot down an Iranian Shahed drone that approached the aircraft carrier USS Abraham Lincoln. This was described as the first direct confrontation between the two forces since the crisis began. Less than 24 hours later, Recorded Future News published its exclusive detailing the earlier breach of Iranian air defences during June 2025.
The report had been kept quiet for eight months, but emerged during the same week the two sides exchanged fire in the strait. The information was presented as controlled, with unnamed officials speaking to a cyber security journalist and details withheld “at the request of sources due to national security concerns”. The pattern of timing and information management, the article says, suggests coordinated disclosure, even if proving that definitively is not possible.
The message to Tehran may not require explanation. Washington was signalling that it had been inside Iran’s air defence systems months earlier and could do it again.
Ten days later, on 14 February, Reuters reported the US military was preparing for “extended operations lasting weeks” and that the navy sent its largest and newest aircraft carrier, USS Gerald Ford, to the region. American air deployments reached their highest level since the 2003 invasion of Iraq. On 19 February, RUSI published its analysis laying out cyber targeting maps for Iran.
Placed side by side, the article argues, these dates show a sequence: a confrontation in the strait, disclosure of a prior breach, reports of imminent strikes, and analysis explaining how Iranian systems could be disabled cybernetically. The disclosures, it suggests, functioned as calibrated pressure on Iranian decision making at moments when Tehran needed to assess its options.
Beyond Deterrence
The concept of cyber deterrence, the article notes, was traditionally framed in the opposite logic to nuclear deterrence. Nuclear deterrence works because each side knows what the other possesses. In cyberspace, deterrence works through uncertainty, because you do not know what the other side can do, so you assume the worst. Ambiguity was the core strategy.
Jacquelyn Schneider, a Hoover Institution researcher at Stanford University and a reserve officer in US Cyber Command, is cited as having studied cyber deterrence through war game simulations and concluding: “I do not think cyberattacks are an effective deterrent, neither to deter other cyberattacks nor to deter conventional or nuclear attacks.” The reason, according to her research, is that cyber effects are “long term and usually not first order”, meaning the public does not view cyber threats with the same seriousness as conventional military threats.
If that is true, the article asks, why would the US administration invest so much effort in publicly advertising cyber capabilities that did not deter anyone? The likely answer, it argues, is that public cyber signalling served other purposes: reassuring allies, strengthening congressional justification for budgets, and preparing American public opinion for what followed in the current attacks on Iran.
In that sense, the signals were not deterrence in the classic sense, but preparation for the operational theatre.
Even if such public messaging did not deter, the article suggests it could still undermine an adversary’s confidence in its own defensive systems. RUSI’s analysis posed a question pointing to this dimension: if US Cyber Command can theoretically disable these systems, what is the lasting psychological impact on current and future Iranian efforts at self sufficiency within the IRGC?
In other words, once you know your adversary previously penetrated your air defences and publicly signalled it, every system you build afterwards carries an embedded doubt: is it truly secure, or are they inside it too?
This platform runs on funding from the Ummah.
