Full Report
State news published a list of nearly 30 sites that could be targeted Iran has reportedly designated Amazon, Google, IBM, Microsoft, Nvidia, Oracle, and Palantir facilities as legitimate targets of retaliatory strikes, according to an Al Jazeera report citing Iran’s state-affiliated Tasnim news agency.…
Analysis Summary
# Threat Actor: Islamic Revolutionary Guard Corps (IRGC) / Iran
## Attribution & Identity
- **Primary Actor:** Islamic Revolutionary Guard Corps (IRGC) / Khatam al-Anbiya (Central Military Command).
- **Associated Entities:** Tasnim News Agency (State-affiliated media arm used for psychological operations and target dissemination).
- **Known Associations:** Iranian state-sponsored cyber and kinetic units.
## Activity Summary
According to reports from March 2026, Iran has escalated from traditional cyber warfare to "infrastructure warfare." Following alleged attacks on Iranian financial institutions by the US and Israel, the IRGC has designated 29 specific facilities belonging to major US technology firms as legitimate military targets for retaliatory strikes. This follow-on activity comes a week after Iran claimed responsibility for striking three AWS datacenters in the region.
## Tactics, Techniques & Procedures
- **Infrastructure Warfare:** A shift toward targeting physical cloud infrastructure, research centers, and corporate offices to disrupt regional digital economies.
- **Psychological Operations (PsyOps):** Utilizing state-sanctioned Telegram channels (Tasnim) to publish "hit lists" of specific civilian corporate coordinates to induce panic and force evacuations.
- **Kinetic Strikes:** Use of aerial attacks (drones/missiles) against physical datacenter locations.
- **Economic Retaliation:** Explicitly targeting "economic centers" in response to perceived financial/cyber attacks against Iranian banks.
- **MITRE ATT&CK IDs (Contextual):**
- **T1583:** Steppingstone/Infrastructure targeting.
- **T1491:** Defacement (via public state-media messaging).
- **Impact:** Physical destruction of assets.
## Targeting
- **Sectors:** Cloud Service Providers (CSPs), Artificial Intelligence (AI) Development, Semiconductors, Defense Technology, FinTech.
- **Geography:** Bahrain, Israel, Qatar, and the United Arab Emirates (UAE).
- **Victims:**
- **Amazon/AWS:** 5 facilities (Tel Aviv, Haifa, and Bahrain datacenters).
- **Microsoft:** 5 facilities.
- **IBM:** 6 facilities (AI research in Be’er Sheva).
- **Google:** 4 facilities (Dubai advertising/search and Qatar cloud support).
- **Nvidia:** 3 facilities (Main R&D center in Haifa).
- **Oracle:** 3 facilities (Jerusalem cloud services and Abu Dhabi main office).
- **Palantir:** 3 facilities (Abu Dhabi collaboration center and Tel Aviv regional office).
## Tools & Infrastructure
- **Kinetic Ordnance:** Aerial strike capabilities (unspecified drones or missiles used in Bahrain and UAE).
- **Communication Channels:** Telegram (Tasnim News Agency channel).
- **Impacted Services:** AWS, Snowflake, Red Hat, and EMQX (impacted by datacenter outages).
## Implications
This represents a significant escalation where private technology companies are being treated as state proxies. Iran is redefining "legitimate targets" to include civilian R&D and cloud infrastructure, arguing that these companies support US military and intelligence operations. This "infrastructure warfare" poses a high risk to regional business continuity and may force global tech giants to reconsider the security posture of their physical footprints in the Middle East.
## Mitigations
- **Disaster Recovery:** Organizations must activate multi-region disaster recovery playbooks to migrate workloads out of high-tension geographic zones.
- **Physical Security:** Implement 1km exclusion zones or enhanced physical hardening for listed facilities in Israel, UAE, Qatar, and Bahrain.
- **Geographic Redundancy:** Shift critical search, AI, and cloud management functions to "out-of-theater" datacenters to ensure global availability despite regional kinetic interference.
- **Personnel Safety:** Evacuation of non-essential personnel from regional offices identified in state-media "target slides."