5 times Israel’s Unit 8200 waged cyber war on Iran

Established in the 1950s, Unit 8200 is the largest in the Israeli Defence Forces, specialised in cyberwarfare, signal intelligence, code decryption and military intelligence. For more than a decade, it had been haunting Iran from the shadows, but Iran finally salvaged some retribution. Iranian barrage of missiles targeted the Israel Defence Forces Unit 8200, known as Aman, in the early hours of June 17, 2025, the fifth day of the Israel-Iran conflict. The Iranian Revolutionary Guard Corps claimed it was ‘the centre for planning terror operations and evils of the Zionist regime (Mossad) in Tel Aviv'. Following the strike, Israel had imposed media censorship on the Glilot, Herzliya. It was apparent that the hunter was being hunted now. However, there are no confirmed reports of the extent of damage.

On several occasions, Iran had faced sabotage in its nuclear facility, and numerous covert strikes on its missile systems, from Stuxnets to providing covert intelligence for assassinations. Here are the five times the IDF's Unit 8200 caused major damage to Iran's infrastructure, nuclear and missile facilities.

Stuxnet: The World’s First Cyber Weapon (2010)

Unit 8200 is credited with developing Stuxnet, along with the National Security Agency of the USA. It was a 500-kilobyte computer worm designed primarily to target Iran's Natanz nuclear facility by sabotaging Uranium centrifuges. Regarded as the first cyber weapon, it destroyed approximately 1,000 centrifuges at the facility. Although not officially identified by Iran, Stuxnet's damage was acknowledged publicly by Iranian officials.

"This attack could have damaged many centrifuges without destroying so many that the plant operator would have become suspicious," Reuters quoted a report by the Institute for Science and International Security.

Cyberattack on Iran’s Oil Terminal Systems (2012–2013)

Following the pressure of the international sanctions, Iran claimed an attack on its Oil Terminal Systems in May 2012. While no one claimed responsibility for the attack, US officials were quoted by WSJ as saying this was orchestrated by Israel. Although it did not cause major damage, it disabled oil export terminals and the data server. Although Israel denied involvement, analysts linked Israel's Unit 8200. “The results of our technical analysis support the hypothesis that [the worm] was developed by a government agency of a nation state with significant budget and effort,” said the Crysys laboratory in Hungary. Experts claim the virus named W32 Flamer was there in the system for more than two years lying dormant and struck suddenly to sabotage the systems.

Disruption of Iranian Missile Guidance Networks (2020–2022)

According to Defence Insider reports, Iranian Missile Guidance Networks were disrupted by Unit 8200. This electronic warfare and cyber operation scrambled guidance systems and spoofed telemetry data. This resulted in failed test launches and limited Iran's capability to develop long-range missiles.

Hacking Iran’s Fuel Distribution Network (October 2021)

In a major attack, 4300 petrol stations went offline in October 2021, across Iran. Users trying to purchase at the gas stations received a display reading "cyberattack 64411", which is associated with a hotline to the Ayatollah's office. This left the country paralysed, and public digital signage was hacked to read “Khamenei, where’s our fuel?” Insiders linked the embarrassment to Israeli cyber ops.

Intelligence for Covert Strikes & Assassinations (2010–2022)

Unit 8200 is believed to have provided real-time signals intelligence (SIGINT) enabling Mossad and IDF operations, including the assassinations of nuclear scientists like Mohsen Fakhrizadeh and strikes on Iranian weapons convoys in Syria. Even though these operations are universally attributed to Mossad, Unit 8200 works as the nervous system of Mossad and the IDF, as per the reports by The Guardian and Politico.

Each of these operations remains in the shadow with no clear attribution from any government sources; there have been claims and counterclaims without real and credible information. With its June 17 missile strike, Iran claims it has turned the tables, hitting the very infrastructure that once struck it silently. While Israel continues to deny such claims, there have been independent sources that use satellite images to verify the impact, but the extent of damage remains debatable.