Cyber-Kinetic Warfare: Iran’s New Battle Strategy

Cyber-Kinetic Warfare Moves from Support to the Battlespace

Cyber-kinetic warfare is increasingly becoming an operational model in which cyber activity is conducted alongside physical military operations rather than as a separate campaign. Recent reporting on Iran’s operations against UAE indicates that cyberattacks were reportedly paired with missile and UAV strikes against ports, refineries and airports. UAE Cybersecurity Council chief Mohamed Al Kuwaiti said that cyberattacks accompanied kinetic attacks against these sites, while Wired Middle East reported that UAE had experienced between 600,000 and 800,000 digital attacks per day. 

Cyber activity can provide information before, during and after a physical strike. Instead of simply attempting to destroy or disrupt an adversary's networks, cyber access can be used for reconnaissance, surveillance, targeting support, persistence and battle-damage assessment (BDA). This creates a digital layer around conventional air and missile operations.

Iran’s Cyber Reconnaissance and Targeting

One of clearest examples involves internet-connected surveillance cameras. Check Point Research identified increased activity against IP cameras in Israel, UAE, Qatar, Bahrain, Kuwait, Lebanon and Cyprus beginning around 28 February 2026. The activity targeted Hikvision and Dahua cameras and was attributed by researchers to infrastructure associated with multiple Iran-nexus actors. Compromised cameras can provide real-time visual information that is relevant to military operations. Check Point assessed that the activity could support reconnaissance and physical warfare, including observing potential targets and assessing the consequences of strikes. This effectively turns a civilian or commercial surveillance device into a potential intelligence sensor. 

The same principle applies to telecommunications and other digital infrastructure. Iranian actors exploited vulnerabilities in SS7 telecommunications signaling to help identify locations of US personnel in Middle East. This cyber-enabled intelligence supported Iran's wartime objectives and could contribute directly to kinetic targeting. 

The operational chain is therefore increasingly identifiable:

 Gain access → collect information → identify or refine a target → support the physical strike → monitor the target → assess damage.

Cyber infrastructure can consequently function as an extension of intelligence, surveillance and reconnaissance (ISR), while also contributing to the targeting cycle.

Cyber, EW and Kinetic Operations

Iran’s experience also demonstrates that cyber operations do not necessarily operate independently from electronic warfare (EW), space and conventional airpower. During US-Iran conflict, US officials reported that coordinated cyber and space operations disrupted Iranian communications and sensor networks, reducing ability of Iranian forces to detect, coordinate and respond to attacks. This illustrates broader direction of multi-domain warfare. A military operation can combine cyber intrusion, electronic interference, intelligence collection, space-enabled surveillance, unmanned systems, missiles and aircraft within the same operational framework. 

The objective is not necessarily to achieve decisive physical destruction through one domain, but to create cumulative effects across the adversary’s sensing, communications, command-and-control and decision-making systems. AI could further accelerate this cycle by processing large volumes of open-source and technical information, identifying patterns, translating communications, supporting reconnaissance and reducing the time required to develop targets. However, effectiveness of such systems remains dependent on access, data quality, attribution and the ability to translate digital access into reliable operational effects.

Operation Divine Bytes

The same convergence of cyber and kinetic capabilities was evident in May 2025 India-Pakistan conflict, where Pakistan reportedly employed cyber operations alongside conventional military action under Operation Divine Bytes. The campaign targeted Indian communications, critical infrastructure and digital networks, while Pakistan’s Air Chief Marshal Zaheer Ahmed Babar Sidhu said PAF cyber forces had targeted communication hubs, power infrastructure and transport systems. The reported activity added a digital layer to Pakistan’s wider air and electronic warfare operations.

Operation Divine Bytes highlighted Pakistan’s evolving approach to multi-domain warfare, in which cyber capabilities are employed in conjunction with airpower, electronic warfare and information operations. By targeting an adversary’s digital infrastructure alongside physical military assets, cyber operations can create additional disruption across communications, command-and-control and critical infrastructure, while supporting the broader operational campaign. This episode illustrates how cyberspace is increasingly being incorporated into military planning as an operational domain that can complement kinetic effects rather than functioning as a separate technical battlefield.

The Emerging Battlefield

Iranian experience demonstrates how cyber access can complement physical firepower by providing information about where to strike, when to strike and what happened after the strike. Cameras can become surveillance sensors; telecommunications networks can provide location intelligence; compromised networks can provide information on infrastructure and activity; and digital access can potentially support deception or disruption.

For military planners, this means cyber defence can no longer be separated from conventional force protection. Protecting airbases, ports, command centres and missile infrastructure increasingly requires securing the digital systems surrounding them.

The evolution from Iran’s operations in the Gulf to Operation Divine Bytes in South Asia points toward a broader transformation in cyber-kinetic warfare. Future campaigns are likely to involve simultaneous competition across the cyber, electromagnetic, information, space and physical domains. The central operational question will increasingly be not simply who can destroy a target, but who can detect, understand, disrupt, strike and assess it faster across multiple domains.