The Israel-Iran Conflict Through an Intelligence Lens

Relevant, timely, and actionable intelligence plays a pivotal role for organizations with direct or indirect interests in the Middle East, as well as other regions engaged in, or susceptible to, physical conflict. Just as we have provided insights into other global conflicts, including the Israel-Hamas War and the Russia-Ukraine War, this blog aims to utilize our current intelligence, historical data, and expert analysis to offer crucial perspectives—from timelines and contextual background to sophisticated, data-driven analyses—into the evolving conflict between Israel and Iran across cyber, physical, and geopolitical battlefields.

Direct attacks between Israel and Iran

On April 1, 2024, Israel conducted an air strike against the Iranian consulate in Damascus, Syria, killing two high-ranking generals in the Islamic Revolutionary Guard Corps (IRGC) and a member of Hezbollah. It marked the first time in 45 years that Israel and Iran exchanged direct military offensives on each other’s sovereign soil. In retaliation, on April 13, Iran launched approximately 170 kamikaze uncrewed aerial vehicles (UAVs), 120 ballistic missiles, and 30 cruise missiles towards Israel. Then, on April 19, Israeli forces issued a counter strike targeting an Iranian air defense radar site near Isfahan. Israel’s return of force has been reported to not cause loss of life or major damage to Iranian equities.

Both Israel and Iran’s restraint in the direct attacks observed so far indicate that both nations are looking to avoid wider-scale direct confrontations, or a full-fledged conventional war that would almost certainly guarantee deeper involvement from the United States and other allied powers.

Threat landscape

Critical infrastructure

Threats to critical infrastructure during military conflict traditionally encompassed the physical realm, but in recent years they have evolved to incorporate cyberattacks, posing significant challenges for security specialists. While Iran’s April 13 attack did not involve state-sponsored cyber threats, the potential for destructive cyberattacks in the future targeting telecommunications, the financial sector, and critical infrastructure is a looming concern. 

The risk of physical attacks targeting critical infrastructure is also a major fear, as illustrated by Israel’s (and its allies’) strategy of disrupting GPS signals in the region to prevent Iranian missiles and drones from reaching their intended targets, ultimately preventing potentially devastating strikes on military and civilian infrastructure. This tactic reportedly has become increasingly prevalent since the Hamas attack on Israel on October 7, and even more so since Israel’s strike on the Iranian consulate in Syria. 

The ripple effects of these types of threats have been felt well beyond the national borders of Israel and Iran, with countries such as Cyprus implementing stricter security measures to safeguard their own critical infrastructure and international diplomatic missions in the wake of Iran’s attacks on Israel. Heightened vigilance surrounding security underscores the need for comprehensive measures to mitigate potential threats to critical infrastructure in the region.

Cyber

Flashpoint analysts have been closely monitoring reports of cyber activity in the lead-up to the physical escalation and Iran’s attack on Israel. Notable events included the establishment of the “Cyber Court” domain along with corresponding Telegram and X accounts at the beginning of April 2024. Threat actors behind the Cyber Court collective, claiming to be a hacktivist group of ten, have been using these social media platforms to take credit for alleged data breaches of Israeli organizations.

Cyber entities of particular interest leading up to the April 13 retaliatory attacks by Iran were two groups contributing to the Cyber Court: “Cyber Av3ngers” and “NetHunt3r.” Additionally, the group “Handala Hack” (also known as “Hanzala Hack”), although not officially recognized as a collaborative group, has also been linked to certain Cyber Court activities.

Physical

Flashpoint analysts are closely monitoring the situation between Israel and Iran, as the possibility of a strike on Iran’s nuclear sites in retaliation for the April 13 attack is a major global concern. The day after Iran’s attack, the Jerusalem Post examined what such an attack could look like, while other reports indicated Iran had temporarily closed its nuclear facilities because of the possibility of such an attack in light of the potential threat, stating that it is willing to review the country’s “nuclear doctrine.” 

However, a recent report by the Wall Street Journal suggested an Israeli attack on Iran’s nuclear facilities seems unlikely, citing the risks of further conflict escalation and a potential shift in Iran’s nuclear strategy. Moreover, the challenge of targeting Iranian nuclear facilities built deep underground raises doubts about the success of any potential Israeli counterattacks.

Decades of hostility: Understanding the long-standing shadow war

The shadow war between Israel and Iran has been fueled by decades of tensions and minor attacks that, before April 2024, were always conducted through regional proxy groups. The roots of these escalating tensions can be traced back to the Iranian Revolution of 1979, which not only led to the establishment of the theocratic Islamic Republic that drastically changed Iran’s political landscape but also significantly shifted its foreign policy and diplomatic relations with Israel. The new Iranian regime viewed Israel as a threat and an enemy because of its close ties with the United States. 

In-line with their stance towards Israel, Iran has fervently supported the Palestinian Liberation Organization (PLO), which has also resulted in Iran financially backing groups like Hezbollah and Hamas which were formed via Operation Peace for Galilee and the Oslo Accords of 1993. This has led to a steady increase in hostilities as Israel became aware that Iran was funding militant groups, prompting them to seek to completely eliminate these groups, as well as conducting covert operations and diplomatic actions against Iran’s nuclear program.

Violence between Hezbollah and Israel

The enduring hostilities between the Lebanese group Hezbollah and Israel can be traced back to the 1980s when Israel launched Operation Peace for Galilee, a military invasion of southern Lebanon during which Israel aimed to eradicate the PLO. In response to Israel’s occupation of the area, Hezbollah was established as a means of resistance with the primary goal of combating Israeli forces. 

Although Israel eventually withdrew its troops from Lebanon in 2000, Hezbollah continued to oppose Israel long after, citing unresolved issues such as the debate about ownership of Shebaa Farms and Lebanese prisoners still held captive by Israel. 

These cross-border conflicts between Hezbollah and Israel continued until 2006, when tensions escalated. Hezbollah crossed into Israeli territory, leading to the abduction of two Israeli soldiers and casualties on both sides of the conflict. This provocation sparked the Lebanon War of 2006 between Hezbollah and Israel, which lasted for thirty-four days.

The Israel-Hamas War

Hamas was established in 1987 during the Palestinian uprising against Israeli occupation by members of the Muslim Brotherhood who had consistently opposed peace agreements with Israel. It was due to Hamas’ fierce opposition and refusal to recognize Israel’s right to exist that the Oslo Accords of 1993 had failed to be enacted.

Ever since their formation, Hamas has been involved in ongoing confrontations involving border disputes. Then on October 7, 2023, Hamas launched a coordinated cross-border assault on Israel, officially starting the Israel-Hamas War. This aggressive move included coordinated land, air, and sea attacks resulting in the deaths of approximately 1,200 Israeli citizens and the capture of more than 240 Israeli hostages. Tit-for-tat conflicts with Hezbollah in Lebanon had diverted Israel’s attention from the threats that were developing in the Gaza Strip.

A day after, Hezbollah initiated a new round of attacks on Israel from Lebanon, announcing their solidarity with the Palestinian territories. In response, the Israel Defense Forces (IDF) retaliated against Hamas militants in the Gaza Strip, leading to the deaths of over 33,000 Palestinians so far.

Image above: Mentions of attacks across English, Arabic, Hebrew, and Persian-language open-source channels.

Although Iran was not directly involved in the attacks, the country’s financial support of Hamas and other extremist militant groups in the region implicated its involvement and further exacerbated regional tensions. These long-standing grievances and strategic regional alliances were underlying factors in the cycle of violence that has been perpetuated for decades in the region.

Iran’s nuclear program

In addition to Iran’s support of regional militant groups, Iran’s nuclear program is one of the major points of contention in the Middle East today. Dating back to the 1950s, Iran’s nuclear program has long been suspected of having dual purposes, with a civil component for peaceful energy production designed to distract from a clandestine military component, which is alleged to be for nuclear weapons development.

In the early 2000s, after the discovery of undeclared nuclear facilities and uranium enrichment activities, suspicions about Iran’s true intentions raised concerns about the country’s lack of transparency and compliance with the International Atomic Energy Agency’s (IAEA) obligations under the Nuclear Non-Proliferation Treaty.

Despite Iran’s claims that its nuclear program was for peaceful purposes, many countries, including the United States and Israel, banded together to express concern that it was developing nuclear weapons. As a result, the Joint Comprehensive Plan of Action was signed into effect in 2015 with the sole purpose of limiting Iran’s nuclear activities and providing more oversight of its facilities. However, the United States withdrew from the agreement in 2018, effectively voiding Iran’s obligation to comply. As Iran’s nuclear program continues to advance, nation-states not aligned with the Iranian regime become increasingly wary of the possibility of Iran obtaining nuclear weapons capabilities.

Flashpoint analysts are continuously monitoring the situation in the Middle-East, including the possibilities of a strike on Iran’s nuclear facilities. Israel’s latest strike on April 19 targeted an air defense radar system protecting the Natanz nuclear facility near Isfahan. The International Atomic Energy Agency confirmed that there was no damage to Iranian nuclear sites.

Following Israel’s limited strike against Iran on April 19, both countries seemed to downplay the attack in the media and online. Leading up to the strike, many world leaders urged Israel not to respond in an effort to avoid an all-out conventional war.

Israel’s stated goal in conducting this attack was to show that they were capable of reaching Iranian soil—a goal that was achieved. However, Iran’s reaction to the attack was minimal and, at times, Iran denied Israel was even involved.

Multiple explosions were heard near Isfahan, though Iran claimed it was their defense systems combating drones or UAVs. Israel claimed to have launched two missiles, one of which they claimed struck an Iranian air base near Isfahan. Imagery shows the likely damage to one of Iran’s S-300 missile defense systems. Immediately following the attack and as more details of the event came to light, Iran regularly downplayed and even mocked the Israeli attack. Iran also stated that there were no intentions to retaliate.

What we can expect about the Israel-Iran conflict

Examining the direct conflicts that have taken place so far, both Israel and Iran have shown enough restraint to avoid a wider-scale direct confrontation or a full-fledged conventional war. That being said, the ongoing conflict between these two nations will continue. However, where and how these events will take place is not clear. Given the history between the two countries, future events could take place via the currently ongoing Israel-Hamas War, the employment of other regional militia groups such as Hezbollah in Lebanon and Syria, or through cyber warfare. Flashpoint will continue to monitor the ongoing conflict.