Iran-linked cyberattackers have taken credit for a digital disruption in Albania last week that the hackers say was targeted because it hosted exiled opponents of the Islamic Republic, the Mujahedin-e Khalq, known as MEK. 

Homeland Justice, the hacking group, said they hit websites and took data from Albania’s capital, Tirana, and local media reports confirmed the cyber onslaught. 

U.S. cyber officials previously branded Homeland Justice as “Iranian state cyber actors” in the aftermath of a 2022 attack on Albania’s government. 

Homeland Justice took credit for the cyberattacks in a string of messages on Telegram pledging to send its opponents “back to the Dark Ages.”

“Iranian officials are also planning to take military action against any country that interferes in any way in making Iran insecure,” the hackers said on Telegram on Saturday. 

The hackers’ hit on Albania occurred before U.S. airstrikes on three key Iranian nuclear facilities prompted a fragile ceasefire Monday night. 

Still, last week’s salvo could be a harbinger of things to come, and the West is preparing. 

Cyber intelligence firm Flashpoint told The Washington Times that Americans should brace for intensified cyberattacks aimed at U.S. critical infrastructure.

Flashpoint’s National Security Intelligence Director Austin Warnick said people should be on guard for intrusions aimed at the energy, telecom, aerospace, water and financial sectors.

“The cyber situation could escalate through direct state-sponsored attacks utilizing Iran’s evolving destructive capabilities, potentially coordinated with physical actions, and driven by strong retaliatory and ideological motivations,” Mr. Warnick said in a statement.

Threat intelligence firm Recorded Future has encouraged Americans to anticipate distributed denial of service attacks on other efforts to take down digital services. 

Recorded Future analyst Alexander Leslie warned last week that Western entities were targets of Iran regardless of whether they had any physical presence in Iran or Israel. 

“Hacktivists, and pseudo-hacktivists that we mentioned in particular, aren’t precision operators,” Mr. Leslie said in a briefing. “They go after logos, headlines and brands that they associate with the enemy, regardless of location or affiliation, or if even that affiliation exists.”

U.S. officials are anticipating Iran may now strike back against America online. 

The Department of Homeland Security issued a bulletin on Sunday saying “low-level cyberattacks against U.S. networks by pro-Iranian hacktivists are likely” and that others with ties to the Islamic Republic may hit U.S. networks. 

“Both hacktivists and Iranian government-affiliated actors routinely target poorly secured U.S. networks and internet-connected devices for disruptive cyberattacks,” the bulletin said. 

While many cyber officials are sounding the alarm, some have cast doubt on the effectiveness of Iran’s cyber arsenal. 

Before the U.S. airstrikes in recent days, skeptics of Iran’s cyber sophistication told online publication SpyTalk last week that Iran’s cyber prowess does not match China or Russia’s digital armies. 

Pro-Iranian threat actors’ claims of hitting Israeli radio stations and blocking a Mossad website were determined to be false, per research from the cybersecurity firm Radware observed by SpyTalk. 

But the U.S. intelligence community has assessed that Iran’s digital attackers pose a large threat to Americans. 

“Iran’s growing expertise and willingness to conduct aggressive cyber operations also make it a major threat to the security of U.S. and allied and partner networks and data,” the U.S. intelligence community’s annual threat assessment said in March. 

Last year, America’s intelligence community attributed efforts to hack President Trump’s campaign to the Iranian regime as well. 

The ongoing conflict has also altered Iran’s cyber apparatus. 

Israel struck the Iranian Cyber Police (FATA) headquarters in Tehran last week, according to the Institute for the Study of War. 

The institute said the Iranian regime previously used FATA to thwart online dissent.

• Ryan Lovelace can be reached at rlovelace@washingtontimes.com.