U.S. companies face Iranian cyber threats led by unsupervised teenage hackers, warns former NSA operative
Following Saturday’s strikes on Tehran, millions of Iranians received unauthorized push notifications via the BadeSaba Calendar app. The application, which has over 5 million users, was breached to broadcast messages calling for a “People’s Army” and later providing surrender orders for Revolutionary Guard members, according to an assessment from cyber intel firm Flashpoint.
Pro-regime forces responded swiftly.
Flashpoint identified an escalation in Iran’s “Great Epic” cyber initiative, managed by a group known as the “Cyber Islamic Resistance.” This decentralized network has targeted fuel infrastructure and Western military contractors, utilizing data destruction and psychological tactics similar to the BadeSaba incident.
Experts predict a highly volatile 48-hour window as proxy groups and hacktivists operate without central oversight from Tehran. Kathryn Raines, a former NSA specialist now with Flashpoint, noted that these actors coordinate via platforms like Reddit and Telegram, though confirming their claims can take significant time.
The breach of BadeSaba serves as a blueprint for potential retaliatory strikes against Western corporations. Raines observed that the degradation of Tehran’s central command following recent strikes has left a leadership void in their cyber operations.
“This vacuum in Iranian leadership will likely result in more erratic and decentralized attacks by proxies,” she told Fortune.
Consequently, independent hacktivists are selecting targets without official authorization. This means even mid-sized companies could face aggressive attacks, creating risks that extend far beyond major political hubs, Raines explained.
She cautioned that critical security decisions are now “in the hands of a 19-year-old hacker in a Telegram room” lacking any formal supervision.
Brian Carbaugh, CEO of security firm Andesite and former CIA official, advised American business leaders to brace for ongoing instability. He emphasized that Iran remains a resilient force likely to deploy its sophisticated cyber tools alongside conventional military assets.
Carbaugh, a former CIA chief of staff, noted that creative resistance is deeply ingrained in Iran’s security culture. He warned that executives must prepare for a prolonged and unpredictable conflict.
As conventional military options are weakened, cyber warfare becomes more appealing due to its low cost, difficulty of attribution, and high potential for disruption. Iran continues to refine techniques modeled after Russian cyber strategies.
The Iranian security services maintain a strong sense of pride in their digital capabilities, which Carbaugh believes will persist or even intensify despite leadership losses.
Raines pointed out that most corporate defense strategies are ill-equipped for psychological operations like the BadeSaba hack, which targeted the religious schedules of millions during a military strike.
She explained that these “nihilistic” operations aim to undermine employee trust and morale rather than simply disabling hardware or stealing information.
Such attacks could involve deepfake communications from executives or false emergency instructions sent to staff in regions where information is restricted.
Raines noted that few organizations have contingency plans for these psychological scenarios, as most risk models rely on traditional state-level “red lines.”
In upcoming board meetings, the focus will likely shift toward how long a business can remain offline before suffering irreparable damage to its finances and brand.
“The priority is shifting from block rates to recovery speed,” Raines stated.
Carbaugh suggested that board members should inquire about their specific risk levels regarding the Iranian situation and demand clear mitigation strategies.
He recommended that leaders investigate their detection capabilities, partner engagements, and the role of AI in their security posture.
He cautioned that the cyber threat is not a temporary issue and will not vanish quickly.
“This situation is complex and evolving,” Carbaugh said, stressing the need for long-term vigilance across physical and digital assets.