Justice Dept Seizes Four Iranian Cyber Domains During Active Ceasefire Collapse
Domain seizures remove immediate C2 infrastructure but do not degrade the underlying APT capability—the same Iranian-affiliated actors documented by CISA on April 7 exploiting programmable logic controllers across US critical infrastructure remain active.
This creates a two-layer cyber threat: Justice Dept disrupts tactical command nodes while Iranian state APTs continue operational access to industrial control systems.
If the seized domains supported the PLC exploitation campaign, the seizure buys time for critical infrastructure operators to patch; if they supported separate repression operations, the PLC threat remains unaddressed and the two campaigns may represent resource division within Iranian cyber command.
This domain seizure is a low-friction law enforcement action that allows the US to maintain pressure on Iranian cyber operations without direct military escalation during a technically-still-active ceasefire.
It signals the US will pursue non-kinetic disruption channels (asset seizures, infrastructure takedowns) when diplomatic agreements collapse—a tactic that avoids triggering the ceasefire's military constraints while keeping Iranian cyber operations degraded.
The timing suggests a deliberate sequencing: kinetic retaliation (militia strikes, Hormuz blockade) draws military response risk; cyber disruption via Justice Dept draws none.
Defense contractors and critical infrastructure operators should expect sustained Iranian cyber targeting even as kinetic operations continue—the domain seizure removes only four C2 nodes, not the underlying APT capability already documented by CISA on April 7 exploiting PLCs across US critical infrastructure.
The announcement does not specify which Iranian entities operated these domains, which sectors they targeted, or whether the seized domains were actively supporting the PLC exploitation campaign CISA warned about on April 7.
Fault Lines
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.