{"id":11877,"date":"2026-05-27T20:27:01","date_gmt":"2026-05-27T20:27:01","guid":{"rendered":"https:\/\/sawahsolutions.com\/range\/irans-hackers-are-coordinating-more-closely-israeli-cyber-leader\/"},"modified":"2026-05-27T20:27:02","modified_gmt":"2026-05-27T20:27:02","slug":"irans-hackers-are-coordinating-more-closely-israeli-cyber-leader","status":"publish","type":"post","link":"https:\/\/sawahsolutions.com\/range\/irans-hackers-are-coordinating-more-closely-israeli-cyber-leader\/","title":{"rendered":"Iran\u2019s hackers are coordinating more closely: Israeli cyber leader"},"content":{"rendered":"
\n

Iran\u2019s state-backed hackers\u00a0are sharing more cyber tools and using AI to polish disinformation and recruitment messages since the U.S. and Israel launched their war on the country, Israel\u2019s top cyberdefense official said in an interview with Nextgov<\/i>.<\/p>\n

Yossi Karadi, who leads Israel\u2019s National Cyber Directorate, also said on Tuesday that he is pressing major AI labs for controlled access to powerful models like Anthropic\u2019s Mythos, arguing that governments need the same tools attackers are seeking to adopt.<\/p>\n

In the last year, Tehran’s hacking units have increasingly \u201cbegun to talk to each other, and then collaborate with each other, and then even sometimes exchange information\u201d among themselves, he said. \u201cOf course, when they work together, they can work more efficiently and better.\u201d<\/p>\n

Since the war began in February, Iran has sent hundreds of thousands of text messages to Israelis as part of a deception and influence campaign, he said.\u00a0<\/p>\n

\u201cIn some cases, they\u2019d send messages like, \u2018Don\u2019t go to the bomb shelters because they are closed,\u2019\u201d Karadi said.\u00a0Other messages sought to recruit Israelis for intelligence-sharing.<\/p>\n

For a while, those messaging campaigns were in \u201cvery bad Hebrew, so you understand, \u2018okay, it\u2019s nonsense,\u2019\u201d Karadi said. But more recently, AI has helped Tehran improve their messages.\u00a0<\/p>\n

In March, Israel said it bombed a key Iranian cyberwarfare operation center. Asked\u00a0how that attack and similar ones affected Iran’s hacking, Karadi replied that cyberactivity largely fluctuated\u00a0according to\u00a0the intensity of the conflict.\u00a0<\/p>\n

When bombing campaigns against Iran intensified, hacking activity tended to decrease because it was harder for state operatives to access physical assets like computers and other equipment needed for cyberattacks, he said. When strikes slowed, state hacking groups would have more room to reorganize and collaborate again.<\/p>\n

Karadi said there is little expectation that cyber activity from either side will stop even if a peace agreement is agreed, because parties can deny involvement in a cyberattack, unlike a physical strike with missiles or bombs.\u00a0<\/p>\n

\u201cThere is no ceasefire in cyber,\u201d he said. \u201cYou cannot force any agreement on cyber.\u201d\u00a0<\/p>\n

Over the last few months, pro-Iran hackers have compromised a swath of smaller Israeli organizations and a handful of American targets. They have targeted U.S. industrial control systems, federal officials said early last month. One group, likely state-affiliated, also claimed to have compromised medical-technology giant Stryker. And just last week, researchers said Iran-linked hackers had deployed a slew of cyberespionage techniques against the U.S. and Middle East nations including\u00a0Israel and\u00a0the UAE.<\/p>\n

Asked if the cybersecurity community underestimated the strength of Iran\u2019s hacking ecosystem, Karadi said he would only speak for Israel, and asserted they \u201cobviously did not underestimate\u201d Tehran. Since the 12-Day War last year, \u201cwe were in an 100%-alert situation, and we have been preparing ourselves for high-scale cyber war,\u201d he said.\u00a0<\/p>\n

The remarks provide a window into how Israeli officials believe Iran\u2019s cyber apparatus has adapted under wartime pressure and amid negotiations now underway between the U.S. and Tehran that could end the war, which began in late February.<\/p>\n

Karadi conducted the interview as part of a visit to Washington this week, where he said he has planned meetings with the FBI, the Cybersecurity and Infrastructure Security Agency, U.S. Cyber Command and representatives from industry.<\/p>\n

In those meetings, he said, officials have been discussing advanced cyber-focused AI models like Anthropic\u2019s Mythos, which have quickly become central to global cyber policy talks. Asked whether Israeli institutions have been given access to those systems, he said the effort is a work in progress.<\/p>\n

\u201cI haven\u2019t succeeded in it now, but hopefully I will,\u201d he said, adding that he is trying to access such models to scan Israeli government organizations for vulnerabilities. He declined to name specific AI companies he is engaging with.<\/p>\n

In early April, Anthropic launched Project Glasswing, an initiative with major companies designed to secure critical software across the globe using its Mythos model. It\u2019s been withheld from public release amid concerns over its highly skilled hacking capabilities. About a month later, OpenAI unveiled GPT-5.5-Cyber, a similarly advanced model that was also reserved for verified organizations to prevent the acceleration of offensive cyber tools.<\/p>\n

The White House and the federal government swiftly responded and worked to craft an executive order focused on AI and cybersecurity, but its signing was postponed last week amid overregulation concerns from industry.<\/p>\n

Representing a government cyberdefense organization, Karadi said such models worry him.<\/p>\n

\u00a0\u201cWhen you give [an attacker] a new tool, he needs to only use it at one time and one place. But I need to implement this tool at all the places and all the time,\u201d he said.\u00a0<\/p>\n

He expects more of these models to proliferate in the coming months, and he considers them to now be the \u201cmain threat\u201d in the cybersecurity world.<\/p>\n

\u201cI think that our world is getting more and more digital, AI-based and cloud-based,\u201d he said. \u201cIt will take us to a permanent state of cyber warfare, some of the time against enemies that you know. But most of the time \u2014 against ghosts.\u201d\n\n<\/svg><\/p>\n<\/div>\n