What Happened
- Following a joint US-Israel military offensive against Iran (Operation Epic Fury/Operation Roaring Lion, launched February 28, 2026), Iran's military command publicly named US-linked and Israeli-linked banks as military targets — converting a general cyber threat into an explicit state-level declaration of intent.
- US financial institutions — which operate critical infrastructure including payments, clearing, and settlement systems — moved to heightened alert, intensifying monitoring for distributed denial-of-service (DDoS) attacks, wiper malware, and deepfake-based fraud.
- Bank regulators including the California Department of Financial Protection and Innovation issued advisories warning of increased cybersecurity risk; other federal agencies were also coordinating threat assessments.
- Iran-aligned hacktivist groups have a documented history of targeting US financial infrastructure — past campaigns hit 46 major financial institutions with DDoS floods of up to 140 gigabits per second, causing tens of millions of dollars in damages.
- The Palo Alto Networks Unit 42 threat intelligence team issued an updated brief (March 26) cataloguing the escalating cyber risk, noting multi-vector Iranian cyber campaigns as the conflict widened.
Static Topic Bridges
Critical Information Infrastructure (CII) and Cybersecurity Governance in India
India designates certain sectors as Critical Information Infrastructure (CII) under Section 70 of the Information Technology Act, 2000 — any incapacitation of which would have a debilitating impact on national security, economy, or public safety. The National Critical Information Infrastructure Protection Centre (NCIIPC), under the National Technical Research Organisation (NTRO), is the nodal agency for CII protection. For the financial sector specifically, the RBI has issued a Cybersecurity Framework for Banks (2016) and the CERT-In-Finance sector CSIRT (CSIRT-Fin) handles financial sector incidents.
- NCIIPC protects six CII sectors: Power & Energy, Banking & Finance, Telecom, Transport, E-Governance, and Strategic & Public Enterprises.
- CERT-In (Indian Computer Emergency Response Team) is the national nodal agency for cybersecurity incident response; banks must report cyber incidents to RBI within 2–6 hours.
- In FY 2024-25, CERT-In conducted nearly 10,000 cybersecurity audits across critical sectors.
- India's IT Act Section 70A designates the NCIIPC as the agency for protecting CII.
Connection to this news: The targeting of US financial institutions in the Iran conflict illustrates precisely the risk that India's CII framework is designed to mitigate — geopolitical conflicts spilling over into cyber attacks on banking and payments infrastructure.
Cyber Warfare: State Actors, Hacktivists, and Hybrid Threats
Modern cyber conflict operates on multiple levels simultaneously: state-sponsored advanced persistent threat (APT) groups conduct precision attacks on high-value targets, while state-aligned hacktivist groups carry out noisier, disruptive campaigns (DDoS, website defacements) to signal displeasure and create panic. Iran has a well-documented cyber warfare capability, including groups like APT33 (Elfin), APT34 (OilRig), and Charming Kitten, which have targeted critical infrastructure, financial systems, and government networks globally. DDoS attacks, wiper malware (which permanently destroys data), and deepfake-enabled social engineering are the primary tools in this scenario.
- DDoS (Distributed Denial-of-Service): Floods a server with traffic to make it inaccessible — disrupts online banking and payment systems.
- Wiper malware: Permanently deletes or corrupts data — used in notable attacks including NotPetya (2017) and Shamoon attacks on Gulf oil companies.
- Iran's 2012-2013 Operation Ababil targeted 46 major US banks including JPMorgan Chase, Bank of America, and Wells Fargo.
- The 2010 Stuxnet attack (US-Israel) on Iran's nuclear centrifuges is widely cited as the first known cyber weapon deployment — and Iran has since significantly built up its cyber retaliation capabilities.
Connection to this news: Iran's explicit naming of banks as military targets represents an escalation from covert cyber operations to declared cyber warfare against financial infrastructure — a qualitative shift in the threat landscape that regulators worldwide, including in India, are monitoring closely.
Financial System as Critical Infrastructure: Systemic Risk and Resilience
Payment systems, clearing houses, and settlement infrastructure are classified globally as Financial Market Infrastructures (FMIs) — their failure cascades rapidly across the entire economy. The Bank for International Settlements (BIS) and Financial Stability Board (FSB) have identified cyber risk as one of the top systemic threats to financial stability. In India, the RBI oversees systemically important payment systems (SIPS) including RTGS, NEFT, and the Unified Payments Interface (UPI) ecosystem. A successful cyber attack on clearing or settlement systems could freeze transactions across the economy.
- RTGS (Real Time Gross Settlement) and NEFT (National Electronic Funds Transfer) are India's backbone payment systems, both operated by RBI.
- UPI processed over 17 billion transactions per month in 2025 — any disruption would have enormous economic impact.
- RBI's Payment Systems Vision 2025 identified cybersecurity resilience as a strategic priority.
- The FSB's 2024 report classified cyber incidents as a top-three threat to global financial stability alongside climate risk and fragmentation.
Connection to this news: The US experience — where banks became explicit targets of state-level cyber threats due to geopolitical conflict — is a direct warning for India's financial regulators about the intersection of geopolitics and financial system security.
Key Facts & Data
- Operation Epic Fury (US) and Operation Roaring Lion (Israel) launched February 28, 2026, triggering Iran's cyber threat escalation.
- Iran's military command publicly named US-linked and Israeli-linked banks as military targets.
- Past Iranian DDoS campaigns reached 140 Gbps — overwhelming bank servers and disrupting online services for millions of customers.
- 46 US financial institutions were targeted in Iran's 2012-2013 Operation Ababil cyber campaign.
- Three types of threats highlighted: DDoS attacks, wiper malware, deepfake-enabled fraud.
- CERT-In conducted approximately 10,000 cybersecurity audits across critical sectors in FY 2024-25.
- India's UPI ecosystem processes over 17 billion transactions per month.