Microsoft Report Claims Iran Is Main Source of Cyberattacks on Israel

After the United States, Israel accounts for 7.6% of global cyber threat activity and ranks second, while Iran has been named the main source of state-linked attacks. According to Microsoft's annual Cyber Defense Report, Israel's share of cyberattack incidents between July […] Microsoft Report Claims Iran Is Main Source of Cyberattacks on Israel First Time In

After the United States, Israel accounted for 7.6 percent of global cyber threat activity, ranking second, while Iran was accused of being the main source of attacks attributed to governments.

According to calcalistech, according to Microsoft's annual cyber defense report, Israel ranked second in the world in terms of the number of cyber attacks between July 2025 and June 2026, and before that only the United States was the target of more attacks.

Accordingly, Israel accounted for 7.6% of all measured cyber threat activities in the world. This share was 25.5% for America, 4.8% for Ukraine and 3.9% for Taiwan. Israel also has the highest number of targeted attacks among Middle East and African countries.

Published for the seventh consecutive year, the report is based on security data observed between July 2025 and June 2026. This data comes from Microsoft systems and processes more than 165 trillion security signals per day.

According to Microsoft, artificial intelligence continues to change the cyber threat landscape. Artificial intelligence allows attackers to run broader campaigns, design highly persuasive and personalized phishing attacks, and automate processes that previously required significant human resources. At the same time, the proliferation of artificial intelligence tools and automated AI agents has created a broader attack surface and requires organizations to protect the identity and access levels of automated systems as well.

This report claims that Iran is the main government agent supporting cyber attacks against Israel. Israel has been the target of 39% of all activities attributed to threat actors related to Tehran. After Israel, America with 23%, UAE with 9%, Egypt with 6% and India with 6% are ranked next.

Microsoft also claims that during periods of increased regional tension and escalation of military conflicts, cyber actors affiliated with the Iranian government have implemented multi-layered campaigns against Israel and neighboring countries in the region, and at the same time, they have significantly expanded their activities against American interests. More than ever, these campaigns have combined cyber attacks, military operations in the field, infiltration and external influence operations to create the greatest possible operational and psychological impact.

Along with spying and data collection, Microsoft has seen a noticeable shift toward disruptive and malicious capabilities, including the use of data-cleansing tools and operational technology (OT) disruption. Iranian actors are still trying to gain continuous and sustainable access to research and academic institutions, IT and telecommunications service providers, critical infrastructure, government institutions, defense supply chains, non-governmental organizations and political opposition communities. This effort is both to collect information and to create the necessary access for the possible implementation of disruptive operations in the future.

Another part of the US company's report alleged that Iranian threat groups rely heavily on exploiting known software vulnerabilities, weak authentication protocols and Internet-connected systems that are not updated. Identity theft and phishing attacks are still the main primary access methods. Post-intrusion attackers also often use cloud infrastructure, such as Microsoft Azure, to maintain access and lateral movement across the network.

Microsoft has also emphasized the increasing convergence of tactics used by different Iranian threat groups; A process that allows these groups to carry out their operations on a larger scale and increase the potential impact of attacks.

Ransomware attacks against Israeli organizations have also increased significantly. The volume of ransomware cases observed in Israel has increased by 21% compared to last year, and Israel's share of affected activities worldwide has increased from 19% to 23%.

This increase occurred while the total number of registered ransomware cases in the world decreased by 3% and reached 8,521 cases from 8,749 cases. Microsoft assesses that the continuation of this focus indicates the integration of ransomware in Iran's hybrid warfare strategy. Modern ransomware incidents are no longer limited to single endpoint intrusions, but have evolved into complex operations that include identity theft, network intrusion, exploitation of vulnerabilities, and takeover of corporate domains.

Globally, threat actors are going undetected longer in victims' networks, but government-sponsored groups are relying more and more on the access they've already gained.

Microsoft specifically emphasizes increasing threats from open source software supply chain threats, abuse of network edge equipment, such as firewalls and routers, and the use of artificial intelligence as a throughput enhancer.

To deal with evolving threats, Microsoft recommends that organizations prioritize strong identity protection, mandatory multi-factor authentication (MFA), continuous anomaly monitoring, and rapid intrusion response, along with robust data backup and recovery protocols and public-private security partnerships.