A ceasefire didn’t stop the cyber threat

In early April, the guns went quiet. The United States and Iran agreed to an initial two-week ceasefire, with Israel also agreeing to suspend strikes. The announcement produced a flood of headlines about diplomacy and de-escalation.

What those headlines missed was buried in the data flowing through SonicWall’s global network of security sensors.

Global attacks on industrial systems did not stop. They accelerated.

SonicWall monitors network security data from millions of devices across the globe. The numbers our sensors recorded from January through May 2026 tell a story that every business owner, hospital administrator and utility executive in America must understand. The ceasefire was a political event. The cyber war is a structural one, and it was escalating long before the first bomb fell.

“The ceasefire is a political event. The cyber war is a structural one.”

Escalation started long before the strikes

The surge in attacks on industrial control systems — the computer networks that run power grids, water treatment facilities, hospitals and factories — did not begin with Operation Epic Fury on Feb. 28. It began several months prior.

In July 2025, SonicWall sensors recorded the first major step-up in what cybersecurity professionals call SCADA-ATTACKS, attempts to exploit vulnerabilities in industrial control systems. Those attacks ran at 129,000 per month. By December 2025, they had reached 242,000. By May 2026, after the ceasefire: 361,000.

That represents a 474% year-over-year increase. The geopolitical conflict did not create this threat. It accelerated one that was already in motion.

What the ceasefire actually changed

The ceasefire did produce a real and measurable de-escalation, but only in specific places.

Iran itself, which had been generating roughly 44,000 offensive attack attempts per day before the strikes, went effectively silent.

An enemy going quiet is often more alarming than one making noise. Silence suggests regrouping, not retreating. But none of that regional de-escalation reversed the global trend in SonicWall’s data through May. The overall attack curve kept climbing during that period. The ceasefire drew a line in the sand in the Middle East. However, nobody told the hackers.

“An enemy going quiet is often more alarming than one making noise. Silence suggests regrouping, not retreat.”

The target: your building’s automation system

One specific attack type drove nearly half of the global surge, LOYTEC LGATE-902. And most people have never heard of it. This building automation gateway manages HVAC, access control and energy systems in commercial buildings. It was the most-targeted device type in SonicWall’s global sensor network.

Attacks targeting this device grew 380% from January to May 2026, and in the following months accounted for 48% of all recorded SCADA-ATTACKS globally. This is not a weapon aimed at government agencies or defense contractors. It is aimed at the systems controlling the temperature, lights and door locks in the office buildings, hospitals and schools where ordinary Americans work every day.

A hostile actor with access to a building’s automation system can disable climate controls in a hospital, lock or unlock access doors, or create physical disruptions that look like equipment failure, rather than a cyberattack. The attack surface is hidden in plain sight.

Why the silence from Iran should worry you more than the noise

Before Feb. 28, Iranian-addressed networks generated roughly 44,000 attack attempts per day against regional targets. After the strikes, that number collapsed to near zero and had not recovered as of a few months thereafter.

In cybersecurity, an adversary can go dark for two reasons:

Iranian-linked groups have a documented history of patient, long-horizon operations. They do not retreat. Rather, they adapt. The absence of detectable offensive traffic from Iranian networks is not necessarily a sign that the threat has passed. It may be a sign that the next operation is already in planning.

That context matters when examining the origination of the global surge in attacks. Attack traffic originating from Iranian networks fell sharply during the period studied. But the groups under Iran’s strategic umbrella often operate from infrastructure distributed across multiple countries. Those groups include:

The data does not allow us to assign attribution with certainty. However, it shows a pattern consistent with proxy activation: Iranian domestic traffic collapses, and global attack volume against critical infrastructure accelerates simultaneously. That is not proof of a hand-off, but it is what a hand-off would look like.

“Iranian domestic traffic collapses, and global attack volume against critical infrastructure accelerates simultaneously. That is not proof of a hand-off. It is, however, exactly what a hand-off would look like.”

What this means for American businesses

The geopolitical situation created a window of heightened global attention on cyber risk. That window is being used by a wide range of threat actors, not just Iranian ones. They seek to probe, scan and position themselves inside networks they have not yet activated.

The organizations most at risk are those connected to any major infrastructure sectors: hospitals, banks, utilities, defense suppliers and the SMBs that support them through supply chains. Businesses should not assume that a pause in military conflict means cyber risk has also subsided.

The January-May data tells a different story. Attacks accelerated to record highs, targeting systems most organizations never think to protect. Meanwhile, the adversary making the most noise went conspicuously, unsettlingly quiet.

Michael Crean is general manager of Managed Services at SonicWall. He served nine years in the U.S. Army before spending two decades in cybersecurity. He founded one of the industry’s first security-operations-center services built specifically for small and midsized businesses. He appeared on Fox News’ Fox Report Weekend in March 2026 to discuss Iranian cyber activity.