Analyzing National Cyber Attack Surfaces in the Israel-Iran Digital Conflict Using Criminal IP

Nation-state cyber warfare has evolved beyond simple data theft into a complex threat that can paralyze critical infrastructure. For over a decade, Israel and Iran have engaged in a series of cyber confrontations, turning cyberspace into a battlefield as intense as any physical conflict. Notable incidents — such as Stuxnet, which disabled Iran’s nuclear facilities, and cyberattacks targeting Israel’s water infrastructure — represent only a fraction of this ongoing digital confrontation.

In this post, we leverage Criminal IP’s threat intelligence data to analyze the cyberattack surface of both nations. We uncover the external exposure status of national systems across industrial, educational, and public digital infrastructures — including misconfigured servers and unsecured assets — and provide practical methods to respond to emerging cyber threats.

Cyberattack Exposure in the Middle East: Mapping Israel and Iran’s Digital Frontlines

Israel and Iran stand as two of the most prominent cyber nations in the Middle East, both as aggressors and as victims. Since the 2010 Stuxnet attack, both nations have intensified cyber operations aimed at strategic infrastructure. The common focuses include externally exposed infrastructures, such as military and government networks, SCADA/ICS systems, and public institutions with poor security practices. Many of these systems lack authentication or use expired certificates, making them vulnerable to attack. Exposed RDP, webmail, and VPN services offer multiple attack vectors, enabling automated and targeted intrusions at scale.

SCADA/ICS Detection Query

Criminal IP Search Query: tag: “SCADA” country: IL OR country: IR

• https://www.criminalip.io/asset/search?query=tag%3A+%22SCADA%22+country%3A+IL+OR+country%3A+IR

Criminal IP identified 16 exposed SCADA/ICS systems across Israel and Iran. Some scored “Critical” on the Inbound Risk Score due to open ports and vulnerabilities. One Confluence instance appears to be connected to a SCADA/ICS system, showing 233 CVEs — including many with publicly available attack proof-of-concepts (PoCs) on GitHub — making it a high-value target for cyberattacks.

Educational Infrastructure Detection Query

Criminal IP Search Query: “.ac.” country: IL OR country: IR NOT @

• https://www.criminalip.io/asset/search?query=%22.ac.%22+country%3A+IL+OR+country%3A+IR+NOT+%40

Criminal IP detected 2,605 exposed assets in Iran and 653 in Israel associated with educational infrastructures. While most appeared low-risk and safe for external exposure, several systems exhibited critical security flaws. The example below shows infrastructure from a major Israeli university, where 14 vulnerabilities were detected, including 3 with publicly available PoCs, placing the system in a vulnerable state.

Wi-Fi System Detection Query

Criminal IP Search Query: tag: “Wifi” country: IL OR country: IR

• https://www.criminalip.io/ko/asset/search?query=tag%3A+%22Wifi%22+country%3A+IL+OR+country%3A+IR

Externally exposed Wi-Fi devices serve not only as wireless communication hubs but also as entry points into internal networks. For instance, they can be exploited through various attack vectors such as configuration changes via the administrator web UI, firmware manipulation, or backdoor installation. In particular, devices without encryption settings are highly vulnerable to packet sniffing and traffic redirection. The screenshot below shows an IP address interfere as viewed via Criminal IP Asset Search. It displays the login page of a Linksys Wi-Fi device. Since default passwords are often left unchanged, the external exposure of such login pages can become a direct access point to the Wi-Fi network.

Externally exposed infrastructure controlling critical systems in industrial, educational, and public sectors can pose serious national security risks. Wi-Fi systems in public institutions are often exploited for cyber reconnaissance and initial access, requiring strict security policies and access controls to prevent data leaks and session hijacking.

Digital Battlefield Analysis Using Criminal IP: CTI-Based Cyber Attack Surface Detection

Having examined the exposure status of key institutions and public infrastructure, we next explore externally exposed assets along common attack vectors. Using the “SSL VPN” tag in Criminal IP, we can identify remotely accessible VPN infrastructure, which often serves as a primary entry point for threat actors.

SSL VPN Infrastructure Detection Query

Criminal IP Search Query: tag: “SSL VPN” country: IL OR country: IR

• https://www.criminalip.io/asset/search?query=tag%3A+%22SSL+VPN%22+country%3A+IL+OR+country%3A+IR

Criminal IP identified 5,753 exposed SSL VPN assets in Israel and 188 in Iran. Notably, Israeli infrastructure shows a reliance on Check Point VPN solutions.

A closer look at vulnerable assets revealed that many SSL VPN systems remained unpatched against recent OpenSSH vulnerabilities, with some still operating under CVEs dating back to 2016. Given that SSL VPNs can provide direct access to internal networks with only single-factor authentication, a single vulnerability can result in widespread compromise.

Admin Server Detection Query

Criminal IP Search Query: tag: “Admin” country: IL OR country: IR

• https://www.criminalip.io/asset/search?query=tag%3A+%22Admin%22+country%3A+IL+OR+country%3A+IR

Criminal IP identified 11,832 web-accessible admin panels across both nations. These portals provide high-privilege access to databases, system configurations, and user management. Many of these were also tagged with PBX (telephony systems) and network switches, some of which had open ports and unpatched vulnerabilities, making them prime targets for brute-force and exploit-based attacks.

In particular, these servers often have open ports and known vulnerabilities, making them highly susceptible to initial exploitation by threat actors.

Expired Certificate Detection Query

Criminal IP Search Query: ssl_expired: true country: IL OR country: IR

• https://www.criminalip.io/asset/search?query=ssl_expired%3A+true+country%3A+IL+OR+country%3A+IR

Using the “ssl_expired: true” filter, Criminal IP identified over 119,000 expired SSL certificates in Iran and more than 50,000 in Israel. Expired SSL certificates can disrupt HTTPS connections, break the trust chain, and compromise secure file transfers and email communications. These conditions also increase the risk of man-in-the-middle (MITM) attacks, credential theft, and session hijacking.

Conclusion

The ongoing cyber conflict between Israel and Iran has escalated into a sophisticated digital war, with attacks extending deep into national infrastructure across multiple sectors. This trend is not confined to these two nations; it serves as a stark reminder for all governments to critically evaluate and fortify their cybersecurity strategies.

Protecting critical infrastructure demands continuous security assessments, controlled exposure to the public internet, and physical segmentation of sensitive networks where appropriate. High-risk components — such as SCADA environments, VPN gateways, and administrative interfaces — must be routinely patched and safeguarded using robust authentication mechanisms.

Even foundational security measures like proper SSL/TLS configuration, strong encryption, and strict access controls play a vital role in thwarting early-stage threats.

In an environment where threats are increasingly persistent and advanced, organizations must adopt proactive security frameworks. This includes leveraging Cyber Threat Intelligence (CTI) and Attack Surface Management (ASM) platforms like Criminal IP for continuous asset discovery and risk detection.

Looking ahead, an effective cybersecurity posture will hinge on timeline-based attack analysis, securing third-party dependencies in the supply chain, and fostering cross-border CTI collaboration.