U.S. companies face escalating cyber threats from Iranian proxy groups following recent strikes, according to cyber intelligence firm Flashpoint. Flashpoint reports that attacks mimicking the compromised BadeSaba Calendar app, which sent pro-regime messages to millions of Iranians, are now being deployed against Western targets. The app's hack demonstrated a template for cyber operations that could be reversed by Iranian-aligned actors. Kathryn Raines, a former NSA expert now at Flashpoint, warns this follows a leadership vacuum in Tehran's cyber command after Saturday's strikes. The group known as the 'Cyber Islamic Resistance' is allegedly using Telegram and Reddit for coordination, launching attacks like the shutdown of Jordanian gas stations and data destruction against U.S. and Israeli military providers.

This decentralized model means decisions now lie with individual hacktivists, potentially targeting mid-sized firms for symbolic reasons. Brian Carbaugh, a former CIA director, emphasizes the need for U.S. businesses to prepare for unpredictable, proxy-driven cyber warfare beyond traditional hotspots. The risk cascades globally, moving beyond Tehran, Washington, or New York.