# Iranian-linked cyber operations against infrastructure > Live situation record from CLSTR: https://clstr.news/situations/iranian-linked-cyber-operations-against-infrastructure > Updated: 2026-10-25T00:12:42.000Z. Sources: 5. Developments: 2. Cyberespionage and disruptive operations linked to Iranian actors have targeted critical infrastructure across several regions. An operation identified as ‘Blinder Tunnel’ utilized sophisticated malware, such as ShelbyLoader V2 and a decoy application named StarkMeet, to target government entities and infrastructure in Israel and the Kurdistan Region of Iraq. This campaign involved the exfiltration of significant government cloud data and utilized GitHub’s API for command-and-control communications. Parallel or subsequent operations linked to the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence (MOIS) have targeted United States infrastructure, specifically impacting the healthcare and water supply sectors. Groups such as the Handala Hack Team have claimed responsibility for seizing personal information of U.S. servicemembers and targeting high-level government communications. These activities have resulted in practical disruptions, including hospital surgery delays and water advisories in various American towns. ## Timeline ### 2026-10-25: Iran-linked cyberattacks target U.S. critical infrastructure Iranian cyber actors, including the Handala Hack Team, have targeted U.S. critical infrastructure, including healthcare, water supplies, and military personnel data. 3 sources. https://clstr.news/cluster/iran-linked-cyberattacks-target-us-critical-infrastructure ### 2026-10-10: Iranian-linked hackers target critical infrastructure in Israel and Iraq An Iranian-linked cyberespionage campaign has targeted critical infrastructure and government data in Israel and Iraq using sophisticated malware and GitHub-based command-and-control tactics. 2 sources. https://clstr.news/cluster/iranian-linked-hackers-target-critical-infrastructure-in-israel-and-iraq --- Cite as: Iranian-linked cyber operations against infrastructure. CLSTR, https://clstr.news/situations/iranian-linked-cyber-operations-against-infrastructure