On February 28, the United States and Israel launched coordinated strikes across Iran under Operation Epic Fury (also referenced in reporting as Operation Lion’s Roar). The opening phase focused on decapitating senior Iranian leadership while degrading missile infrastructure, launch systems, and air defenses. In the hours that followed, Iran initiated large-scale retaliation — expanding the conflict beyond Iranian territory and into a region-wide exchange that touched multiple Gulf states and allied military assets.
Since those initial strikes, the conflict has rapidly widened and accelerated. What began as a concentrated campaign against leadership and missile capabilities has developed into a sustained regional war with an expanding set of targets, including economic and logistical infrastructure. Simultaneously, cyber operations and psychological messaging have been used alongside kinetic action, creating a hybrid operating environment in which disruption is shaped as much by information control and infrastructure compromise as it is by missiles and airstrikes.
Flashpoint analysts are tracking the conflict across physical, cyber, and geopolitical domains. The timeline and sections below summarize key developments and risk indicators observed from February 28 through May 4.
Latest Update: Escalation Across Maritime, Cyber, and Economic Domains (Last 24–48 Hours)
The conflict has entered a phase of direct maritime and economic confrontation, with both kinetic and cyber activity intensifying in parallel.
Following the collapse of diplomatic efforts, the United States has formally initiated a naval blockade of Iranian ports, while Iran has responded by deploying midget submarines and reportedly mining key transit routes in the Strait of Hormuz. These developments signal a shift from pressure on infrastructure to direct control over regional shipping and energy flows.
At the same time, cyber operations have escalated beyond disruption into claims of large-scale destructive activity targeting industrial and government systems across the Gulf. While some of these claims remain unverified, the volume and nature of activity indicate a sustained effort to degrade both public-sector and commercial infrastructure.
Timeline of Key Developments
~06:00 UTC
CENTCOM announces the commencement of “Project Freedom” to secure maritime transit through the Strait of Hormuz.
~08:30 UTC
The IRGC Navy declares a new operational control sector in the Strait, warning that vessels failing to coordinate transit will be “stopped with force”.
10:15 UTC
Iran launches a barrage of four cruise missiles toward the UAE; three are intercepted by UAE air defenses while one falls into the sea.
11:00 UTC
A drone strike targets an ADNOC oil tanker in the Gulf.
13:45 UTC
The South Korean Ministry of Foreign Affairs confirms a South Korean vessel was struck in its engine room while transiting the Strait.
15:30 UTC
Handala Hack announces “Operation Premature Death,” releasing the names and ranks of 400 US Navy officers.
17:00 UTC
IRGC releases footage purportedly showing strikes on US vessels; CENTCOM dismisses these claims as false.
What This Means
This phase of the conflict reflects a shift toward combined economic and operational pressure:
- Maritime control is now central: The blockade and countermeasures in the Strait of Hormuz introduce sustained risk to global shipping, energy transport, and supply chains.
- Cyber operations are aligning with physical objectives: Activity targeting industrial systems and government infrastructure suggests an intent to create downstream operational disruption, not just visibility or signaling.
- Private-sector exposure continues to expand: Western-linked infrastructure—particularly in energy, logistics, and cloud environments—remains within scope of both kinetic and cyber targeting.
Immediate Outlook (Next 48–72 Hours)
Further escalation is highly likely.
Iranian retaliatory activity may target US or Israeli assets in the near term, while continued pressure on maritime routes is expected to sustain volatility in global energy markets. At the same time, divergence among Western partners may create additional operational uncertainty, particularly for organizations relying on regional stability for logistics, infrastructure, or personnel movement.
How the Conflict Evolved
Since the opening strikes on February 28, the conflict has progressed through a series of rapid shifts—each expanding both the scope of targeting and the systems under pressure. What began as a tightly scoped military operation has developed into a sustained, multi-domain conflict affecting regional infrastructure, global markets, and private-sector operations.
This evolution is best understood not as a linear escalation, but as a sequence of overlapping phases that introduced new targets, new tactics, and new forms of risk.
Phase 1: Decapitation and Immediate Regional Spillover
(February 28)
The conflict began with a coordinated US–Israeli campaign targeting senior Iranian leadership and missile infrastructure. The objective was clear: degrade Iran’s ability to project force through its ballistic and air defense systems.
That containment window was brief.
Within hours, Iran launched retaliatory strikes across the Gulf, targeting US and allied military installations in Kuwait, Qatar, and Bahrain. Civilian and commercial systems were immediately affected, including flight disruptions in Dubai and early instability in maritime routes near the Strait of Hormuz.
From the outset, the conflict was regional—not bilateral—and it unfolded across military, commercial, and civilian environments simultaneously.
Phase 2: Regional Expansion and Civilian Exposure
(March 1–3)
Within the first 72 hours, the battlespace widened significantly.
Air operations extended directly over Tehran, signaling degradation of Iranian defensive capabilities. At the same time, new fronts emerged, including Hezbollah activity along Israel’s northern border. Targeting patterns began to shift, with incidents affecting civilian-adjacent infrastructure such as hotels, diplomatic sites, and transit hubs.
This period also marked the early alignment of cyber and information activity with kinetic operations. While still limited in impact, these efforts reflected a broader strategy: shaping disruption beyond the battlefield.
Phase 3: Infrastructure and System-Level Targeting
(March 5–10)
By early March, the conflict moved beyond military objectives and into the systems that sustain state and economic activity.
Energy infrastructure, power grids, logistics hubs, and financial systems became consistent points of pressure. Strikes on refineries and industrial complexes—combined with increasing instability in the Strait of Hormuz—introduced immediate consequences for global energy markets and supply chains.
This phase marked a structural shift. The conflict was no longer defined by territorial or military outcomes alone. It began to affect availability, access, and continuity across critical systems.
Phase 4: Commercial and Private-Sector Targeting
(March 11–13)
The targeting set expanded again—this time explicitly incorporating the private sector.
Iranian-aligned channels began publicly identifying Western technology, cloud, and financial firms as operational targets. In parallel, cyber activity moved deeper into enterprise environments, with disruptions affecting global companies and financial institutions.
At the same time, physical operations reinforced this shift:
- Commercial shipping was targeted near the Strait of Hormuz
- Banking operations were disrupted or preemptively shut down
- Industrial facilities and refineries were forced offline
At this stage, economic pressure was no longer a byproduct of conflict—it had become a deliberate objective.
Phase 5: Hybrid Operations and Distributed Pressure
(Mid–Late March)
As kinetic operations continued, the conflict took on a more distributed and persistent character.
Cyber operations evolved in both scale and intent, expanding from disruption into data destruction, extortion, and psychological operations. Activity linked to groups such as Handala and broader proxy ecosystems demonstrated increasing coordination and willingness to target both regional and international entities.
At the same time, physical targeting patterns shifted toward long-term degradation:
- Industrial production sites were struck
- Ports and logistics corridors faced sustained pressure
- Aviation hubs and transit infrastructure became recurring targets
This phase blurred traditional boundaries. Military, cyber, economic, and information operations were no longer distinct lines of effort—they were operating in parallel against overlapping targets.
A Conflict Without a Single Center of Gravity
By the end of March, the conflict had stabilized into a sustained, multi-domain environment defined by persistence rather than decisive escalation.
Military exchanges continue across multiple fronts, but the broader impact is shaped by pressure on:
- Energy production and transport
- Maritime and aviation corridors
- Financial systems and commercial operations
- Digital infrastructure and enterprise environments
Rather than converging toward resolution, the conflict has distributed risk across systems that extend well beyond the immediate region.
Phase 6: Economic Warfare Formalized and Maritime Escalation
(Late March – Early April)
By late March and into early April, economic pressure became formalized as a central objective of the conflict.
Maritime activity in and around the Strait of Hormuz shifted from disruption to active enforcement. Threats to commercial shipping intensified, while both state and proxy actors signaled a willingness to restrict or halt transit entirely. At the same time, targeting patterns expanded further into energy infrastructure, including gas production and refining capacity across the Gulf.
These developments introduced a new level of systemic risk. With a significant portion of global seaborne crude tied to the region, even partial disruption began to influence global pricing, supply planning, and downstream operations far beyond the Middle East.
Phase 7: Ceasefire Fracture and Persistent Hybrid Operations
(Early–Mid April)
Attempts at de-escalation introduced a new layer of complexity rather than stability.
While diplomatic efforts produced temporary pauses in kinetic activity, underlying objectives remained unresolved. In some cases, these pauses created space for continued operations in other domains. Cyber activity, in particular, showed no meaningful reduction, with Iranian-aligned groups continuing campaigns targeting infrastructure, government systems, and private-sector entities.
At the same time, friction points, especially in Lebanon, remained active. The exclusion of key actors from ceasefire terms contributed to continued localized escalation, reinforcing the decentralized nature of the conflict.
This period demonstrated that pauses in military activity do not equate to reduced risk across the broader threat landscape.
Phase 8: Direct Economic Targeting and Globalization of Risk
(Mid April and Beyond)
Following the breakdown of ceasefire dynamics, the conflict moved into a phase defined by direct economic targeting and broader international involvement.
US and allied actions began to focus more explicitly on constraining Iran’s financial and energy systems, while Iranian responses expanded to include threats against Western-affiliated commercial entities, academic institutions, and infrastructure beyond the immediate region.
At the same time, indicators of internationalization became more pronounced:
- External actors providing military and technical support across sides
- Cyber operations extending into Western and allied networks
- Increased risk to global supply chains, energy markets, and financial systems
By this stage, the conflict was no longer confined to regional dynamics. It had evolved into a sustained pressure campaign with global economic and operational implications.
The Escalating Cyber and Information Front
From the earliest hours of the conflict, cyber operations have moved in parallel with kinetic activity—sometimes reinforcing it, and at other times extending its reach beyond the physical battlespace.
What has changed over time is not just the volume of activity, but the role cyber operations play within the broader campaign.
Early Phase: Disruption and Narrative Control
In the opening days, cyber activity focused primarily on disruption and influence.
Coordinated campaigns linked to pro-IRGC and pro-Russian-aligned groups targeted government websites, defense contractors, and public-facing services with distributed denial-of-service (DDoS) attacks and defacements. At the same time, information operations began to take shape, including the manipulation of widely used platforms such as the BadeSaba prayer app, where push notifications were leveraged to deliver messaging at scale.
These efforts were designed to create confusion, shape perception, and amplify the impact of concurrent military operations rather than cause lasting operational damage.
Expansion: Coordinated Campaigns and Infrastructure Access
As the conflict expanded regionally, cyber operations became more coordinated and more ambitious in scope.
Campaigns operating under banners such as #OpIsrael brought together loosely affiliated actors targeting infrastructure across Israel, the Gulf, and allied states. Claims during this period included access to industrial control systems, water infrastructure, and surveillance networks. While not all claims were independently verified, the consistency of targeting pointed to a broader intent: probing critical systems while signaling capability.
At the same time, verified activity—particularly from groups such as MuddyWater—demonstrated continued intrusion into aerospace, defense, and financial networks, reinforcing that espionage objectives remained active alongside disruption efforts.
Escalation: Enterprise Targeting and Data Destruction
By mid-March, cyber activity shifted again—this time toward enterprise environments and private-sector targets.
Incidents linked to groups such as Handala reflected a move beyond disruption into destructive operations. Reported activity included large-scale data wiping, exfiltration, and coordinated doxxing campaigns targeting individuals and organizations tied to Israeli or Western interests.
Equally significant was the reported use of “living-off-the-land” techniques, where attackers leveraged legitimate administrative tools within cloud environments to execute destructive actions. This approach reduces reliance on traditional malware and complicates detection, particularly for organizations dependent on signature-based defenses.
At this stage, cyber operations were no longer operating at the edges of the conflict. They were directly targeting the systems organizations rely on to operate.
Persistence Through Ceasefire: Cyber as a Continuous Pressure Mechanism
Subsequent developments demonstrated that cyber activity is not tied to the tempo of kinetic operations.
During periods of diplomatic pause, Iranian-aligned groups continued to operate with little observable reduction in activity. Public statements from groups such as Handala explicitly reinforced this posture, framing cyber operations as independent from military timelines.
At the same time, targeting patterns shifted rather than paused. Activity expanded to include:
- Western and allied government systems
- Critical infrastructure, including water and energy sectors
- Commercial platforms and authentication systems
This reflects a broader strategic advantage: cyber operations allow actors to maintain pressure, test defenses, and shape outcomes without requiring direct military engagement.
Current State: Distributed, Adaptive, and Blended Operations
At present, cyber activity reflects a blend of objectives:
- Espionage, particularly against defense and government networks
- Disruption, including DDoS and service degradation
- Destruction, through data wiping and system compromise
- Psychological operations, leveraging public platforms and data exposure
These activities are carried out by a mix of state-linked groups, proxy actors, and loosely affiliated hacktivist networks, often operating with overlapping targets and messaging.
The result is a distributed and adaptive threat environment in which attribution is complex, timelines are compressed, and the boundary between state and non-state activity is increasingly blurred.
What This Signals
Cyber operations in this conflict are not a supporting element—they are a persistent layer of pressure that operates alongside and, at times, independently from physical conflict.
For organizations, this introduces a different type of risk:
- Activity may continue even when kinetic conditions stabilize
- Targeting may shift quickly across sectors and geographies
- Detection becomes more difficult as attackers rely on legitimate tools and blended tradecraft
While cyber operations extend the reach of the conflict, the most immediate systemic pressure is emerging through physical and economic chokepoints—particularly in energy production and maritime transit.
Strategic Chokepoints and Systemic Risk
As the conflict expanded, physical targeting patterns converged around a small number of systems that carry disproportionate global impact: energy production, maritime transit, and regional mobility infrastructure.
Energy Infrastructure as a Primary Lever
Energy systems have emerged as one of the most consistently targeted elements of the conflict.
Strikes on refineries, gas facilities, and industrial complexes—combined with explicit threats against major Gulf energy assets—reflect a deliberate effort to constrain production and introduce volatility into global markets. Incidents affecting facilities in Saudi Arabia and the UAE, along with threats tied to Iran’s own production infrastructure, indicate that both sides view energy disruption as a means of exerting strategic pressure.
The scale of exposure is significant. A substantial portion of global seaborne crude transits through the region, and even partial disruption has immediate downstream effects on pricing, supply planning, and industrial operations.
This dynamic introduces a level of sensitivity that extends well beyond the region. Energy is a transmission mechanism for global economic impact.
Maritime Transit and the Strait of Hormuz
The Strait of Hormuz has remained the central chokepoint throughout the conflict.
From the earliest days, threats to shipping were used to signal escalation. Over time, those threats evolved into direct action, including strikes on commercial vessels, increased naval activity, and the positioning of maritime assets capable of restricting transit.
In later stages, this pressure became more formalized, with both state and proxy actors signaling a willingness to enforce constraints on shipping aligned with opposing interests. The result has been sustained disruption to maritime traffic, increased insurance and routing costs, and reduced throughput across one of the world’s most critical energy corridors.
For organizations dependent on global supply chains, the implications are immediate:
- Longer transit times
- Higher costs
- Reduced predictability in delivery schedules
Even without a complete shutdown, sustained pressure on the Strait introduces ongoing friction into global trade flows.
Aviation and Regional Mobility
Airspace and aviation infrastructure have also been repeatedly affected.
Early in the conflict, flight suspensions and airport disruptions were driven by proximity to kinetic activity. As the conflict progressed, aviation hubs themselves became targets. Incidents near major transit centers—particularly in the Gulf—demonstrate both the vulnerability and strategic importance of these nodes.
Aviation serves as a critical connector for personnel movement, logistics, and high-value cargo. Disruption at major hubs does not remain localized; it cascades across international routes, affecting scheduling, capacity, and access.
In combination with maritime constraints, this creates a compounding effect: fewer viable routes, increased congestion elsewhere, and limited flexibility for organizations attempting to move people or goods.
Expansion to Commercial and Financial Systems
Over time, economic pressure extended beyond physical infrastructure into commercial and financial environments.
Public warnings and targeting signals began to include:
- Banking institutions and financial districts
- Commercial office locations tied to Western firms
- Technology and cloud infrastructure hubs
In parallel, operational impacts became visible. Banking services were disrupted or preemptively suspended in parts of the Gulf, while threats against commercial centers introduced new considerations for business continuity and personnel safety.
This expansion reflects a shift in how the conflict defines “infrastructure.” It is no longer limited to energy or transport, as it also includes the systems that enable economic activity itself.
Business and Security Implications
As the conflict has expanded into energy systems, maritime corridors, aviation hubs, and commercial infrastructure, enterprise exposure is no longer limited to organizations with a direct regional footprint.
The targeting patterns observed throughout this conflict indicate that the systems underpinning global operations—logistics, cloud infrastructure, financial services, and workforce mobility—are all within scope.
For organizations, this introduces sustained operational friction rather than isolated disruption. Planning assumptions should shift accordingly.
Personnel and Physical Security
Exposure to physical risk has expanded beyond military installations into commercial environments.
Incidents affecting transit hubs, diplomatic facilities, and Western-linked commercial districts, combined with public warning lists identifying specific office locations in Jordan and the UAE, indicate that personnel operating in previously low-profile environments may now fall within the threat envelope.
This shift requires a more dynamic approach to workforce security.
Organizations should:
- Reassess travel posture across the UAE, Qatar, Bahrain, Kuwait, and Saudi Arabia
- Elevate security protocols at offices, hotels, and logistics sites
- Reinforce operational security practices, including routine variation and reduced visibility of affiliation
- Monitor diplomatic advisories and local threat reporting in near real time
- Reevaluate occupancy and travel policies for personnel in named commercial and financial districts
Supply Chain, Energy, and Commercial Operations
Disruption is not limited to physical logistics. It now extends into the broader commercial operating environment.
Pressure on maritime transit through the Strait of Hormuz, combined with strikes on energy infrastructure and disruptions to financial services, creates a layered risk model: goods may not move, payments may not process, and operations may not continue as planned.
Organizations should plan for sustained instability rather than short-term interruption.
Priorities should include:
- Modeling extended disruption to Gulf shipping routes
- Identifying alternative logistics pathways, including overland options
- Stress-testing supplier dependencies tied to energy inputs and regional ports
- Preparing for price volatility and delivery delays
- Assessing exposure to regional banking, payment processing, and financial services continuity
Cloud and Technology Infrastructure
The conflict has demonstrated that commercial technology infrastructure is not insulated from physical or cyber spillover.
The reported impact to cloud environments in the Gulf, combined with targeting signals directed at major technology providers, indicates that infrastructure supporting global applications may be exposed to localized disruption.
At the same time, strikes on regional communication and defense systems introduce additional risk to connectivity and resilience.
Organizations should:
- Validate geographic redundancy for critical workloads
- Confirm recovery timelines for regionally hosted environments
- Review third-party dependencies tied to Gulf-based infrastructure
- Ensure leadership understands cascading risks from localized outages
- Evaluate exposure tied to physical proximity of offices, data centers, and regional tech hubs
ICS / OT Environments
Operational technology environments face elevated risk due to the convergence of cyber and physical targeting.
Claims involving industrial control systems—paired with demonstrated attacks on energy and logistics infrastructure—suggest that disruption may extend beyond IT systems into physical operations.
Organizations operating ICS/SCADA environments should prioritize resilience over detection alone.
Key actions include:
- Auditing and restricting remote access pathways
- Enforcing phishing-resistant MFA for privileged users
- Segmenting industrial networks from corporate IT environments
- Validating response plans for destructive or manipulative scenarios
- Conducting exercises that assume loss of visibility or control
Ongoing Updates
Flashpoint will continue monitoring developments across physical, cyber, and geopolitical domains. Bookmark this page for updates as the situation evolves.
For organizations seeking deeper visibility into emerging threats, proxy activity, infrastructure targeting, and cross-domain escalation indicators, schedule a demo to see Flashpoint’s intelligence platform deliver timely, decision-ready intelligence.
Login
Table Of Contents
for Cyber Threat Intelligence: Key Takeaways for Security Leaders
/ 
— Profit, successful fraud, or payouts
— Credit cards, carding activity, or stolen payment data
— Banks or financial institutions
— Cryptocurrency-related activity
— Credentials or account access
— Successful breach or unlocked account
/ 
— Data exfiltration or transfer
— Databases or collections of stolen data
— Bots, automation tools, or malware
— Configuration, setup, or infrastructure
— Toolkits or bundled services
— Infrastructure, communication channels, or delivery mechanisms
— Corporate or enterprise targets
— Targeting or “hits”
— Specific targets, drop locations, or points of interest
— Global campaigns
— High-value or trending activity
— Verified success or working method
— Urgent update or active campaign
— Growth or increased results
can communicate “global carding opportunity” without requiring a shared language.
, which tracks over 