AI Security AI安全 8h ago Updated 2h ago 更新于 2小时前 48

Iran Signed a Ceasefire — Its Hackers Didn't 伊朗签署停火协议——其黑客未停战

The ceasefire is a fiction. Not because missiles are still flying—they mostly aren't—but because the real battlefield doesn't care about diplomatic handshakes and photo ops at negotiating tables. While politicians congratulate themselves on pausing kinetic hostilities between the United States and Iran, Iranian state-aligned hackers are already inside American water systems, power grids, and defense contractor networks. They've been there since at least March. The six-agency joint advisory from 导弹和无人机停下了,至少协议上是这么写的。但另一边,在看不见的战场上,键盘和恶意代码的敲击声从未停歇,反而可能更加急促。美伊双方延长的这份停火协议,完美地展现了21世纪冲突的荒诞本质:我们精心划定停战线,却假装那些早已潜伏在电网、水处理厂和国防供应商网络深处的“数字士兵”不存在。这份停火协议,本质上是一份“眼不见为净”的协议。

75
Hot 热度
70
Quality 质量
60
Impact 影响力

Analysis 深度分析

The ceasefire is a fiction. Not because missiles are still flying—they mostly aren't—but because the real battlefield doesn't care about diplomatic handshakes and photo ops at negotiating tables. While politicians congratulate themselves on pausing kinetic hostilities between the United States and Iran, Iranian state-aligned hackers are already inside American water systems, power grids, and defense contractor networks. They've been there since at least March. The six-agency joint advisory from the FBI, CISA, NSA, EPA, DOE, and Cyber Command dropped the day before the ceasefire took effect, which tells you everything about how seriously the intelligence community takes these "pauses." They know what's actually happening. The question is whether anyone in a position to do anything about it has the spine to act.

Let's be brutally honest about what this moment exposes. We have spent two years—arguably a decade—watching the cybersecurity industrial complex sell its wares with apocalyptic rhetoric. "Nation-state threats are coming!" "Your critical infrastructure is vulnerable!" Every vendor at every RSA conference since 2015 has waved this flag. And yet here we are, in June 2026, and the foundational problem remains exactly where it was: programmable logic controllers inside American utilities were being manipulated by foreign actors for months before anyone officially acknowledged it publicly. Months. Not hours. Not days. Months of operational disruption and confirmed financial losses across water, energy, and government services. If this had been a physical invasion that went undetected for a quarter of a year, heads would roll. Instead, we get a joint advisory and some concerned language about "heightened vigilance."

The IRGC-linked group that announced it was "pausing attacks on the U.S., for now" while simultaneously vowing to revive them "when the time is right" deserves credit for at least one thing: honesty about the nature of cyber conflict. They said the quiet part out loud. There is no trust in this equation. There is no verification mechanism. There is no equivalent of satellite surveillance watching missile silos to confirm disarmament. When a hacker collective tells you they're taking a break, what they're actually telling you is that they've achieved sufficient access and are now waiting for strategic value to increase before pulling triggers. The pause isn't mercy. It's patience. And patience in cyberwarfare is far more dangerous than impulsive action, because it means the adversary is thinking, planning, and positioning rather than burning access on low-value operations.

Here's what should terrify anyone paying attention: the Geneva Conventions are completely irrelevant to this domain. The 1949 framework tells us what you cannot do to prisoners, what you cannot target in terms of hospitals and civilian infrastructure during kinetic conflict. It says absolutely nothing about what a state-sponsored hacking group can do to a regional water utility serving 200,000 people. This isn't a minor oversight. It's the most consequential legal vacuum in modern warfare, and every major cyber power is exploiting it with enthusiasm. The United States does it too—let's not pretend otherwise—but Iran has figured out something that the American national security establishment still seems reluctant to fully internalize: cyber operations against critical infrastructure are asymmetric warfare at its most efficient. You don't need a billion-dollar air force. You need twenty skilled developers, some phishing emails, and enough patience to map the attack surface of a poorly defended water treatment plant in rural Ohio.

The absence of rules creates a perverse incentive structure. In kinetic warfare, escalation has physical costs—planes get shot down, ships sink, soldiers die. These costs impose a natural brake on recklessness. In cyberwarfare, the costs are diffuse, delayed, and often attributable only with difficulty. When a water utility's programmable logic controllers are manipulated, the damage might manifest weeks later as contaminated supply or compromised treatment processes. By then, attribution is murky, the attackers have covered their tracks, and the political pressure to "do something" has dissipated into the general noise of the news cycle. This diffusion of consequence is not a bug for state-sponsored hackers. It's the entire operating principle.

What strikes me most about this moment is the cognitive dissonance at every level of American leadership. The same administration that brokered a ceasefire in physical space presides over a cybersecurity posture that is, at best, reactive and, at worst, performative. CISA issues advisories. The NSA monitors. Cyber Command maintains "forward defense." But the fundamental architecture of American critical infrastructure remains a patchwork of legacy systems, underfunded local utilities, and private-sector operators who view cybersecurity spending as a cost center rather than an existential necessity. The joint advisory mentioned victim organizations across water, energy, and government services. Notice the passive construction—"victim organizations." These aren't victims of some unforeseeable act of God. They're victims of a known threat actor operating against known vulnerabilities in known target sets. This is not surprise. This is neglect.

The IRGC-linked group that promised to continue operations against Israel "at full force" while pausing attacks on the U.S. is drawing a distinction that should alarm American strategists. They're not stopping because they can't continue. They're choosing not to, which means they've made a strategic calculation that preserving access to American networks is more valuable right now than using it. They're banking those capabilities for a future moment of maximum leverage. This is how sophisticated actors operate—cyber access as a strategic reserve, not a expendable munition. And it means that the ceasefire we're celebrating isn't a reduction of threat. It's a suspension of threat activity while the threat itself remains fully operational inside systems that millions of Americans depend on every day.

The real question nobody in Washington seems eager to answer is what "peace" even means in a domain where persistence is the primary objective. A missile, once launched, arrives or it doesn't. A cyber implant, once deployed, persists until detected and removed—which, in the case of legacy industrial control systems, might be never. You cannot ceasefire your way out of an adversary's persistent access. You cannot negotiate the removal of implants that have already been seeded across your infrastructure. The only path forward is aggressive detection, transparent disclosure, and a level of investment in operational technology security that makes the current expenditure look like what it is: a rounding error compared to the consequences of failure.

And failure, in this domain, doesn't mean losing a stock market point or suffering a PR embarrassment. It means water supplies poisoned. It means power grids going dark in August. It means defense systems failing at the moment they're needed most. The ceasefire is theater. The war is already inside the walls.

导弹和无人机停下了,至少协议上是这么写的。但另一边,在看不见的战场上,键盘和恶意代码的敲击声从未停歇,反而可能更加急促。美伊双方延长的这份停火协议,完美地展现了21世纪冲突的荒诞本质:我们精心划定停战线,却假装那些早已潜伏在电网、水处理厂和国防供应商网络深处的“数字士兵”不存在。这份停火协议,本质上是一份“眼不见为净”的协议。

在停火生效前24小时,美国六大联邦机构罕见地联合发布警报,揭露伊朗关联黑客自三月起就一直在操纵美国关键基础设施中的可编程逻辑控制器。水务、能源、政府部门运营中断和财务损失的确认,为这场持续的网络攻击提供了确凿证据。而就在协议生效后几小时,一个与伊斯兰革命卫队有关联的组织宣布“暂时”停止对美国的攻击,但明确表示将在“合适时机”恢复;另一个则宣称对以色列的行动将“全力”继续。看看,这就是现实:物理攻击的暂停,成了数字渗透的“静默期”。那些攻击者并非撤退,而是转入了更深的阴影中,可能正在收集情报、巩固据点、为下一轮打击调整参数。停火成了他们整理装备、等待命令的间隙。

问题的核心在于,我们用19世纪末和20世纪中叶的规则,去框定一场21世纪的混合战争。传统战争有《日内瓦公约》告诉我们什么不能对平民和医院做。它对网络战却束手无策。国际社会至今连一个像样的、有约束力的网络空间行为准则都未能达成。这个巨大的法律和规则真空,已经成了国家支持行为体最青睐的游乐场。攻击一座水坝会引发人道灾难和国际谴责,但瘫痪其控制系统,导致供水中断或水质污染呢?在许多人看来,这似乎只是一次“技术事件”,其严重性被大大低估和模糊化了。

这种割裂在美伊这对老对手身上体现得淋漓尽致。当德黑兰的导弹发射架需要冷却时,其网络部队或许正获得喘息之机,去审计和优化那些已经植入美国关键系统的持久性访问权限。停火没有触及数字战场,意味着攻击方可以专注于更隐蔽、更长效、破坏潜力更大的活动。从地缘政治角度看,这是一种极其划算的“交易”:用暂停一次可能招致报复的导弹袭击,换取在对方最关键的基础设施里“静默存在”的合法性。防御方面对的,是一个没有停火期的全天候威胁。

更令人不安的是,这种模式正在成为常态。从俄乌冲突到中东角力,网络战线总是与停火协议“互不干扰”。我们似乎默认了,数字攻击是冲突中可接受的“附加部分”,而不被视为直接的战争行为。这种默许正在塑造一种危险的预期:未来的“和平”可能只是炮火的暂停,而全面的数字间谍和破坏行动将不受限制地持续。关键基础设施的运营者,成了这场未宣布战争中首当其冲的平民。

当停火协议墨迹未干时,网络空间的“数字战士”们接到的不是放下武器的命令,而是“待机”和“深潜”的指令。这份协议最大的讽刺或许在于,它表面上为脆弱的地区带来了安宁,却在数字维度上固化了冲突的永久化。我们庆祝导弹没有再飞,却对已经钻进我们生活基础的“数字木马”视而不见。在真正的网络军备控制和国际规范出现之前,所谓的停火,不过是我们集体扭过头去,假装看不见那只已经伸进自家电闸的手罢了。

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

安全 安全 政策 政策 伦理 伦理
Share: 分享到: